- wlug - list.wlug.org.nz

Malware Found in Arch Linux AUR Package Repository
by Peter Reutemann 11 Jul '18

11 Jul '18

'Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.' -- source: https://it.slashdot.org/story/18/07/10/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stolen certificates from D-Link used to sign password-stealing malware
by Peter Reutemann 10 Jul '18

10 Jul '18

'Criminals recently stole code-signing certificates from router and camera maker D-Link and another Taiwanese company and used them to pass off malware that steals passwords and backdoors PCs, a researcher said Monday. The certificates were used to cryptographically verify that legitimate software was issued by D-Link and Changing Information Technology. Microsoft Windows, Apple’s macOS, and most other operating systems rely on the cryptographic signatures produced by such certificates to help users ensure that executable files attached to emails or downloaded on websites were developed by trusted companies rather than malicious actors masquerading as those trusted companies. Somehow, members of an advanced persistent-threat hacking group known as BlackTech obtained the certificates belonging to D-Link and Changing Information Technology, the researcher with antivirus provider Eset said in a blog post. The attackers then used the certificates to sign two pieces of malware, one a remotely controlled backdoor and the other a related password stealer. Both pieces of malware are referred to as Plead and are used in espionage campaigns against targets located in East Asia. The Japan Computer Emergency Response team recently documented the Plead malware here. AV provider Trend Micro recently wrote about BlackTech here. “The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region,” Eset researcher Anton Cherepanov wrote in Monday’s post.' -- source: https://arstechnica.com/information-technology/2018/07/stolen-certificates-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like attack uses speculative execution to overflow buffers
by Peter Reutemann 10 Jul '18

10 Jul '18

'When the Spectre and Meltdown attacks were disclosed earlier this year, the expectation was that these attacks would be the first of many, as researchers took a closer look at the way that the speculative execution in modern processors could be used to leak sensitive information and undermine the security of software running on those processors. In May, we saw the speculative store bypass, and today we have a new variant on this theme: speculative buffer overflows, discovered by Vladimir Kiriansky at MIT and independent researcher Carl Waldspurger.' -- source: https://arstechnica.com/gadgets/2018/07/new-spectre-like-attack-uses-specul… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With So Many Eyeballs, Is Open Source Security Better?
by Peter Reutemann 10 Jul '18

10 Jul '18

'Back in 1999, Eric Raymond coined the term "Linus' Law," which stipulates that given enough eyeballs, all bugs are shallow. Linus' Law, named in honor of Linux creator Linus Torvalds, has for nearly two decades been used by some as a doctrine to explain why open source software should have better security. In recent years, open source projects and code have experienced multiple security issues, but does that mean Linus' Law isn't valid? According to Dirk Hohndel, VP and Chief Open Source Officer at VMware, Linus' Law still works, but there are larger software development issues that impact both open source as well as closed source code that are of equal or greater importance. "I think that in every development model, security is always a challenge," Hohndel said. Hohndel said developers are typically motivated by innovation and figuring out how to make something work, and security isn't always the priority that it should be. "I think security is not something we should think of as an open source versus closed source concept, but as an industry," Hohndel said.' -- source: https://it.slashdot.org/story/18/07/10/1642226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Breaches Chrome Extension of Popular VPN Service Hola, Directs Users To Compromised Cryptocurrency Website
by Peter Reutemann 10 Jul '18

10 Jul '18

'A hacker has breached a Hola VPN developer account and has replaced the official Chrome extension with one that redirected users of the MyEtherWallet.com website to a phishing page controlled by the attacker. The compromise took place yesterday and only lasted for five hours the MyEtherWallet (MEW) team said in a tweet. The Hola VPN team admitted to the hack. "The attack was programmed to inject a JavaScript tag in to the MEW site to 'phish' information about MEW accounts that are logging in without being in 'incognito mode', by re-directing the MEW users to the hacker's website," the Hola VPN team said.' -- source: https://yro.slashdot.org/story/18/07/10/1720243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Anti-RISC-V FUD
by Lawrence D'Oliveiro 10 Jul '18

10 Jul '18

ARM put up a site attacking the open-source RISC-V processor architecture a few days ago, then had to take it down as a result of objections from its own staff <https://www.theregister.co.uk/2018/07/10/arm_riscv_website/>. Seems ARM is feeling the heat from the increasing traction that RISC-V is getting. Even though the original site is gone, it is still accessible via the Wayback Machine. And also one of the commenters points out that this graphic <https://www.arm.com/-/media/global/company/arm-risc-v-infographic.png> is still on ARM’s own site.

1 0

Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
by Peter Reutemann 05 Jul '18

05 Jul '18

'Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words: Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware. Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle' -- source: https://yro.slashdot.org/story/18/07/04/218234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Download Bomb Trick Returns in Chrome -- Also Affects Firefox, Opera, Vivaldi and Brave
by Peter Reutemann 03 Jul '18

03 Jul '18

'The release of Google Chrome 67 has reopened a "download bomb" bug that was exploited by tech support scammers last winter, and which had been fixed with the release of Chrome 65 in March 2018. Furthermore, the issue also appears to affect other browsers as well, such as Firefox, Vilvadi, Opera, and Brave, according to tests carried out by Bleeping Computer. The "download bomb" trick is a technique that involves initiating hundreds or thousands of downloads to freeze a browser on a specific page. Across the years, there have been multiple variations of download bombs, and they have often been used by tech support scammers to trap users on shady sites that tried to lure victims into calling a tech support number to have their browser unlocked. Over the winter, security researchers from Malwarebytes noticed a tech support scam campaign that employed a new "download bomb" technique to trap users on its shady sites.' -- source: https://news.slashdot.org/story/18/07/03/1416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study Finds That a Large Number of Popular Android Apps Secretly Cast the Screen To Third Parties, But They Don't Listen To Conversations
by Peter Reutemann 03 Jul '18

03 Jul '18

'It's the smartphone conspiracy theory that just won't go away: Many, many people are convinced that their phones are listening to their conversations to target them with ads. [...] Some computer science academics at Northeastern University had heard enough people talking about this technological myth that they decided to do a rigorous study to tackle it. For the last year, Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes ran an experiment involving more than 17,000 of the most popular apps on Android to find out whether any of them were secretly using the phone's mic to capture audio. The apps included those belonging to Facebook, as well as over 8,000 apps that send information to Facebook. Sorry, conspiracy theorists: They found no evidence of an app unexpectedly activating the microphone or sending audio out when not prompted to do so. Like good scientists, they refuse to say that their study definitively proves that your phone isn't secretly listening to you, but they didn't find a single instance of it happening. Instead, they discovered a different disturbing practice: apps recording a phone's screen and sending that information out to third parties.' -- source: https://yro.slashdot.org/story/18/07/03/1822250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Allows Outside App Developers To Read People's Gmails, Says Report
by Peter Reutemann 03 Jul '18

03 Jul '18

'According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative. What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails. ' -- source: https://yro.slashdot.org/story/18/07/02/2057256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Micro Focus Sells SUSE
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

<https://www.theregister.co.uk/2018/07/02/linux_makes_suse_sold_for_a_cool_2…>: Micro Focus CEO Chris Hsu subsequently decided that spending time with his family seemed more fun than piloting a juggernaut made of more offcuts than a cut-and-shut Ford Fiesta from Honest Bob's Motors. ... However, SUSE was a bright spot in the gloom, showing revenues of $164.4m and a solid, if unexciting, growth rate of 13.1 per cent in the six months to October 2017. ... For its part, SUSE is pretty happy with the deal. It will retain its CEO, Nils Brauckman, who seemed pleased to be free of Micro Focus ...

1 0

Metric-Compatible Fonts
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

I was idly doing some web searches the other day (as you do), and stumbled across this page <https://wiki.archlinux.org/index.php/Metric-compatible_fonts> at the ever-dependable Arch Wiki. My specific question was, what had happened to the “URW Palladio” font? Up until recently, this was the one that Fontconfig would offer up when I used the old “Palatino” name from Adobe PostScript days. (I used to like the way the curve of the “P” didn’t quite join up with the stem, but left a little gap with a pointy bit on the end. Ahem...) Turns out it’s still there, just under another name; it’s now called “P052” for some unfathomable reason. Anyway, that page gives a bunch of handy alternatives if you are looking for Free alternatives to proprietary fonts that preserve the metrics (widths, spacing etc), so substituting them won’t stuff up the formatting of a document.

1 0

'Why You Should Not Use Google Cloud'
by Peter Reutemann 02 Jul '18

02 Jul '18

'A user on Medium named "Punch a Server" says you should not use Google Cloud due to the "'no-warnings-given, abrupt way' they pull the plug on your entire system if they (or the machines) believe something is wrong." The user has a project running in production on Google Cloud (GCP) that is used to monitor hundreds of wind turbines and scores of solar plants scattered across 8 countries. When their project goes down, money is lost. An anonymous Slashdot reader shares the report: Early today morning (June 28, 2018) I receive an alert from Uptime Robot telling me my entire site is down. I receive a barrage of emails from Google saying there is some "potential suspicious activity" and all my systems have been turned off. EVERYTHING IS OFF. THE MACHINE HAS PULLED THE PLUG WITH NO WARNING. The site is down, app engine, databases are unreachable, multiple Firebases say I've been downgraded and therefore exceeded limits. Customer service chat is off. There's no phone to call. I have an email asking me to fill in a form and upload a picture of the credit card and a government issued photo id of the card holder. Great, let's wake up the CFO who happens to be the card holder. What if the card holder is on leave and is unreachable for three days? We would have lost everything -- years of work -- millions of dollars in lost revenue. I fill in the form with the details and thankfully within 20 minutes all the services started coming alive. The first time this happened, we were down for a few hours. In all we lost everything for about an hour. An automated email arrives apologizing for "inconvenience" caused. Unfortunately The Machine has no understanding of the "quantum of inconvenience" caused.' -- source: https://news.slashdot.org/story/18/07/01/0354200 The cloud is convenient, as you don't have to look after your own hardware and it allows you to add more processing power as needed. But this is a good example of why your own hardware might not be a bad idea... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PB Tech Used Trade Me Data For Spam
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120816…>: PB Tech has signed an enforceable undertaking with the [Department of Internal Affairs] after it was found to have collected Trade Me customer details during trades and then sent them unsolicited messages. This was in breach of the Unsolicited Electronic Messages Act.

1 0

Massive New 'Salesforce Tower' Light Sculpture: AI, Ubuntu, Fog, and a MacBook
by Peter Reutemann 30 Jun '18

30 Jun '18

'The new tallest building on the San Francisco skyline -- and the tallest building in America west of the Mississippi -- includes a nine-story electronic sculpture that's been called the tallest piece of public art on Earth. It uses 11,000 LED bulbs reflected off the tower-topping aluminum panels -- each pixel created by a set of red, green, blue and white lights controlled by 8-bit PIC microcontrollers. "On a clear night, the show is visible for 30 miles," reports IEEE Spectrum. Slashdot reader Tekla Perry shares their article about "the technology involved in the light show at the top of Salesforce Tower. Electrical engineer and artist Jim Campbell explains it all -- and how the window-washer problem stumped him for nearly a year." "[O]n the 62nd floor, a central PC-based computer runs Ubuntu Linux, sending instructions to a communications control system that splits the data and sends it at 11 Mbit to the 32 enclosures using a custom communications protocol... We will capture images throughout the day, sending them to Amazon's cloud, and run some algorithms designed to identify visual interesting-ness. For example, at its simplest, when we look at the sky, if it's all blue, it's boring, if it's all white, it's boring, if it has white and blue it is likely to be interesting. We'll chose the best half hour of the day at each camera, based on movement and color, to display...." And finally, when the main display shuts down late at night, another system designed by Campbell will kick in. In this static display, a set of 36 white LEDs will create a three-dimensional constellation of lights that will look like stars. "It's quieter, it has a random aspect to it," he says. "Since construction started, the tower has emerged as an icon of the new San Francisco -- techie, ambitious, perhaps a little grandiose," writes the New Yorker, capturing the moment when Campbell finally unveiled his four-year project -- while fighting stomach flu and a chest cold, on a night which turned out to be prohibitively foggy. The executive vice-president of Boston Properties told him cheerily, "Jim! Look on the brighter side. We've got every night for the rest of our lives." "There was a long silence from the people on the terrace. The fog was thick. At last, someone exclaimed, 'Woo-hoo!,' and a volley of cheers followed." Although the colors they were seeing came from the celebratory fireworks and not from Jim's light sculpture. Are there any San Francisco-area Slashdotters who want to weigh in on the Salesforce Tower?' -- source: https://tech.slashdot.org/story/18/06/30/2031224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not A Bug, It’s A Feature!
by Lawrence D'Oliveiro 30 Jun '18

30 Jun '18

The IndexByDate.txt files available on the various Bitsavers directories (e.g. <http://bitsavers.trailing-edge.com/pdf/>) list the various items available in order of date. But if you want them ordered by name, so items in the same directory come together, the logical thing to do is use the sort(1) <https://linux.die.net/man/1/sort> command on this file. You specify the sort key by a “field definition”. The man page says that, by default, each field starts at a non-whitespace character after whitespace. The file has a very regular format: splitting by whitespace, you get the date, the time, and then the pathname. So a command like sort -k3 IndexByDate.txt should work. Except I was seeing a sequence like this: 2006-08-17 22:17:12 ge/MarkI_Timesharing/IPC-202646_FORTRAN_Aug66.pdf 2012-08-29 02:26:21 generalAutomation/18_30/88A00026A-A_GA1830_Industrial_Supervisory_System_Reference_Manual_May69.pdf ... 2018-05-16 00:33:35 georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf 2006-08-27 11:36:57 ge/PAC-4000/GET-3201B_PAC-4000_SysMan_Mar66.pdf As you can see, the “ge” section is interrupted by “generalAutomation” and others, and then resumes after them. What was going on? It took me a while to realize that the sorting is done by locale, and the locale setting is set to ignore the slashes. Thus, the above sequence is effectively “gem” followed by “gen”, then “geo” and “gep”. What I wanted was a straight ASCII sort on the full pathname, without regard to any locale settings. But there is no hint in the man page as to how to specify this. Then I realized: the locale is controlled by environment variables. If you want the “non-localized” locale, then specify the locale called “C”, thus: LC_ALL=C sort -k3 IndexByDate.txt and this gives the order I want.

1 0

Linux Mint 19 'Tara' Released
by Peter Reutemann 30 Jun '18

30 Jun '18

'Linux Mint, the maker of popular Linux distro, announced on Friday the general availability of a new version of their operating system. Called Linux Mint 19 "Tara", the new version offers a range of new features, improvements, and a promise that it would stick around for a while. Writing for BetaNews, Brian Fagioli: The most significant aspect of Linux Mint 19 is the new Ubuntu 18.04 LTS base. Tara will receive updates until 2023 -- very impressive. The kernel is at 4.15, and all three desktop environments are being updated too. Mate is now at version 1.2, Cinnamon gets bumped up to 3.8, and Xfce is updated to 4.12. In Linux Mint 19, the star of the show is Timeshift, said, Clement Lefebvre, Linux Mint Project Leader. Although it was introduced in Linux Mint 18.3 and backported to all Linux Mint releases, it is now at the center of Linux Mint's update strategy and communication, he added. Thanks to Timeshift you can go back in time and restore your computer to the last functional system snapshot. If anything breaks, you can go back to the previous snapshot and it's as if the problem never happened.' -- source: https://linux.slashdot.org/story/18/06/29/2041255 Cheers, Petre -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Invests $22 Million In Feature Phone Operating System KaiOS
by Peter Reutemann 30 Jun '18

30 Jun '18

'Google is turning startup investor to further its goal of putting Google services like search, maps, and its voice assistant front and center for the next billion internet users in emerging markets. It has invested $22 million into KaiOS, the company that has built an eponymous operating system for feature phones that packs a range of native apps and other smartphone-like services. As part of the investment, KaiOS will be working on integrating Google services like search, maps, YouTube and its voice assistant into more KaiOS devices, after initially announcing Google apps for KaiOS-powered Nokia phones earlier this year. KaiOS is a U.S.-based project that started in 2017, built on the ashes of Mozilla's failed Firefox OS experiment, as a fork of the Linux codebase. Firefox OS was intended to be the basis of a new wave of HTML-5, low-cost smartphones. And while those devices and the wider ecosystem never really took off, KaiOS has fared significantly better. KaiOS powers phones made by OEMs including Nokia (HMD), Micromax and Alcatel, and it works with carriers including Sprint and AT&T -- it counts offices in North America, Europe and Asia. But its most significant deployment to date has been with India's Reliance Jio, the challenger telco that disrupted the Indian market with affordable 4G data packages. "This funding will help us fast-track development and global deployment of KaiOS-enabled smart feature phones, allowing us to connect the vast population that still cannot access the internet, especially in emerging markets," said KaiOS CEO Sebastien Codeville in a statement.' -- source: https://mobile.slashdot.org/story/18/06/29/2118251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Google, and Microsoft Use Design To Trick You Into Handing Over Your Data, Report Warns
by Peter Reutemann 29 Jun '18

29 Jun '18

'A study from the Norwegian Consumer Council dug into the underhanded tactics used by Microsoft, Facebook, and Google to collect user data. "The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users," states the report, which includes images and examples of confusing design choices and strangely worded statements involving the collection and use of personal data. Google makes opting out of personalized ads more of a chore than it needs to be and uses multiple pages of text, unclear design language, and, as described by the report, "hidden defaults" to push users toward the company's desired action. "If the user tried to turn the setting off, a popup window appeared explaining what happens if Ads Personalization is turned off, and asked users to reaffirm their choice," the report explained. "There was no explanation about the possible benefits of turning off Ads Personalization, or negative sides of leaving it turned on." Those who wish to completely avoid personalized ads must traverse multiple menus, making that "I agree" option seem like the lesser of two evils. In Windows 10, if a user wants to opt out of "tailored experiences with diagnostic data," they have to click a dimmed lightbulb, while the symbol for opting in is a brightly shining bulb, says the report. Another example has to do with Facebook. The social media site makes the "Agree and continue" option much more appealing and less intimidating than the grey "Manage Data Settings" option. The report says the company-suggested option is the easiest to use. "This 'easy road' consisted of four clicks to get through the process, which entailed accepting personalized ads from third parties and the use of face recognition. In contrast, users who wanted to limit data collection and use had to go through 13 clicks."' -- source: https://tech.slashdot.org/story/18/06/27/2233234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub Gentoo Organization Hacked
by Peter Reutemann 29 Jun '18

29 Jun '18

'June 28 at approximately 20:20 UTC unknown individuals have gained control of the Github Gentoo organization, and modified the content of repositories as well as pages there. We are still working to determine the exact extent and to regain control of the organization and its repositories. All Gentoo code hosted on GitHub should for the moment be considered compromised. This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Details are sparse, but we will update this story once we learn more.' -- source: https://it.slashdot.org/story/18/06/28/2240254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's Up With ProtonMail Outages?
by Peter Reutemann 28 Jun '18

28 Jun '18

Since we talked about ProtonMail in the past... 'ProtonMail, a secure email service provider used by more than two million users and references of which has been made in shows like Mr. Robot, has been facing outages for the last two days as it fights numerous DDoS attacks. "The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes," a ProtonMail spokesperson told BleepingComputer, adding that it has tracked the attack to a group that claims to have ties to Russia. But things are more complicated than that, and it appears ProtonMail users, who are already annoyed at the frequent outages over the last few days, are up for more such downtimes in the coming days. BleepingComputer: But in reality, the DDoS attacks have no ties to Russia, weren't even planned to in the first place, and the group behind the attacks denounced being Russian, to begin with. Responsible for the attacks is a hacker group named Apophis Squad. In a private conversation with Bleeping Computer today, one of the group's members detailed yesterday's chain of events. The Apophis member says they targeted ProtonMail at random while testing a beta version of a DDoS booter service the group is developing and preparing to launch. The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns." This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.' -- source: https://it.slashdot.org/story/18/06/28/159252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Every Android Device Launched Since 2012 Impacted By RAMpage Vulnerability
by Peter Reutemann 28 Jun '18

28 Jun '18

'Almost all Android devices released since 2012 are vulnerable to RAMpage bug, an international team of academics has revealed today. >From a report: The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack. Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory. In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.' -- source: https://it.slashdot.org/story/18/06/28/160220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Doubles Down on Linux and Open Source
by Peter Reutemann 28 Jun '18

28 Jun '18

'Google couldn't exist without Linux and open-source software. While you may not think of Google as a Linux company in the same way as you do Canonical, Red Hat, or SUSE, it wouldn't be the search and advertising giant it is today without Linux. So, it makes sense that Google is moving up from its Silver membership in The Linux Foundation, to the Platinum level. With this jump in status, Google gets a seat on the Foundation's board of directors. This position will be filled by Sarah Novotny, the head of open source strategy for Google Cloud Platform. Earlier this week, Chinese tech giant Tencent joined the Linux Foundation as a platinum member.' -- source: https://news.slashdot.org/story/18/06/27/1926211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

BBC Releases Computer History Archive
by Peter Reutemann 28 Jun '18

28 Jun '18

'A slice of computing history has been made public, giving people the opportunity to delve into an archive that inspired a generation of coders. The Computer Literacy Project led to the introduction of the BBC Micro alongside programs which introduced viewers to the principles of computing. It included interviews with innovators such as Bill Gates and Steve Wozniak. The BBC hopes the 1980s archive will encourage today's youngsters to become involved in computing. With the release of the archive, viewers can now search and browse all of the programmes from the project. The archive includes 267 programs, and 166 BBC Micro programs that were used on-screen.' -- source: https://news.slashdot.org/story/18/06/27/2037216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finally, It's the Year of the Linux... Supercomputer
by Peter Reutemann 27 Jun '18

27 Jun '18

'From ZDNet: "The latest TOP500 Supercomputer list is out. What's not surprising is that Linux runs on every last one of the world's fastest supercomputers. Linux has dominated supercomputing for years. But, Linux only took over supercomputing lock, stock, and barrel in November 2017. That was the first time all of the TOP500 machines were running Linux. Before that IBM AIX, a Unix variant, was hanging on for dear life low on the list." An interesting architectural note: "GPUs, not CPUs, now power most of supercomputers' speed."' -- source: https://linux.slashdot.org/story/18/06/27/152216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anonymizing Printed Documents
by Lawrence D'Oliveiro 27 Jun '18

27 Jun '18

It’s been known for a while that many printer vendors add extra hard-to-detect dots to their printouts to make a pattern that can be used to identify the source of the document later. Now a research group <http://www.theregister.co.uk/2018/06/27/german_researchers_defeat_printer_t…> has found a way to stymie this process by adding extra dots that fit the patterns, but confuse the identification system. They even have source code on GitHub.

1 0

OpenBSD Chief De Raadt Says No Easy Fix For New Intel CPU Bug 'TLBleed'
by Peter Reutemann 26 Jun '18

26 Jun '18

'Recompiling is unlikely to be a catch-all solution for a recently unveiled Intel CPU vulnerability known as TLBleed, the details of which were leaked on Friday, the head of the OpenBSD project Theo de Raadt says. iTWire reports: The details of TLBleed, which gets its name from the fact that the flaw targets the translation lookaside buffer, a CPU cache, were leaked to the British tech site, The Register; the side-channel vulnerability can be theoretically exploited to extract encryption keys and private information from programs. Former NSA hacker Jake Williams said on Twitter that a fix would probably need changes to the core operating system and were likely to involve "a ton of work to mitigate (mostly app recompile)." But de Raadt was not so sanguine. "There are people saying you can change the kernel's process scheduler," he told iTWire on Monday. "(It's) not so easy." He said that Williams was lacking all the details and not thinking it through. "They actually have sufficient detail to think it through: the article says the TLB is shared between hyperthreading CPUs, and it is unsafe to share between two different contexts. Basically you can measure evictions against your own mappings, which indicates the other process is touching memory (you can determine the aliasing factors)." De Raadt said he was still not prepared to say more, saying: "Please wait for the paper [which is due in August]."' -- source: https://it.slashdot.org/story/18/06/25/2219217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Likely NSA Data-Collection Facilities
by Lawrence D'Oliveiro 26 Jun '18

26 Jun '18

Further to the mention last night of secret facilities operated by AT&T in the US where the NSA has access, this article <https://arstechnica.com/tech-policy/2018/06/meet-the-8-spooky-att-buildings…> reports on a list of eight likely places as detailed by The Intercept <https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/>. While the NSA is not technically allowed to spy on wholly “domestic” communications, there seem to be no limits on any “incidental collection” as a result of targetting some foreign communication. That means they can grab the contents of entire mailboxes just for the sake of one message. Then keep the lot for whatever use they like.

1 0

How Should Open Source Development Be Subsidized?
by Peter Reutemann 24 Jun '18

24 Jun '18

'"Open source maintainers are exhausted and rarely paid," writes TechCrunch's editorial manager. "A new generation wants to change the economics." An anonymous reader quotes their report: [Patreon] is increasingly being used by notable open source contributors as a way to connect with fans and sustain their work... For those who hit it big, the revenues can be outsized. Evan You, who created the popular JavaScript frontend library Vue.js, has reached $15,206 in monthly earnings ($182,472 a year) from 231 patrons... While Patreon is one direct approach for generating revenues from users, another one is to offer dual licenses, one free and one commercial... Companies care about proper licensing, and that becomes the leverage to gain revenue while still maintaining the openness and spirit of open source software... Tidelift is designed to offer assurances "around areas like security, licensing, and maintenance of software," CEO Donald Fischer explained... In addition, Tidelift handles the mundane tasks of setting up open source for commercialization such as handling licensing issues... Open Collective wants to open source the monetization of open source itself. Open Collective is a non-profit platform that provides tools to "collectives" to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way. TechCrunch warns that "It's not just that people are free riding, it's often that they don't even realize it. Software engineers can easily forget just how much craftsmanship has gone into the open source code that powers the most basic of applications... "If you work at a for-profit company, take the lead in finding a way to support the code that allows you to do your job so efficiently. The decentralization and volunteer spirit of the open source community needs exactly the same kind of decentralized spirit in every financial contributor. Sustainability is each of our jobs, every day."' -- source: https://news.slashdot.org/story/18/06/23/2113222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Birth Of PDF
by Lawrence D'Oliveiro 21 Jun '18

21 Jun '18

<http://www.theregister.co.uk/2018/06/21/how_a_tax_form_kludge_gave_us_25_ye…>: [In 1985] ... both Apple and Adobe wanted to show off the LaserWriter's abilities with some sample files. Warnock thought it would be great to have the printer producing something complex but familiar so he personally hand-programmed an IRS tax form in PostScript. ... all those boxes and form fields required Warnock to code in lots of subroutines and utilities. The page took 2 minutes 45 seconds to print. Jobs was horrified at how slow that was. ... His new version of the IRS tax form printed on the LaserWriter in 22 seconds. In other words, by abandoning all the programming-language constructs (subroutines, conditionals, looping etc) in PostScript and just writing out a straight sequence of imaging commands, the code ran a lot faster, even if it was bigger. The article mentions the release of PDF 2.0, which is now being managed by ISO. Unfortunately, unlike Adobe, ISO do not make their specs available for free.

1 0

OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns
by Peter Reutemann 21 Jun '18

21 Jun '18

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Peter Reutemann 21 Jun '18

21 Jun '18

'Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said. Since making its debut late last year, Satori has proven to be a particularly versatile and sophisticated botnet. It made a name for itself in December when it infected more than 100,000 Internet-connected devices in just 12 hours by exploiting remote code-execution vulnerabilities in Huawei and RealTek routers. A month later, Satori operators released a new version that infected devices used to mine digital coins, proving that the IoT botnet could also take control of more traditional computing devices. In February, Satori resurfaced when it infected tens of thousands of routers manufactured by Dasan Networks.' -- source: https://arstechnica.com/information-technology/2018/06/widely-used-d-link-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPP Versus Free-Software Licensing
by Lawrence D'Oliveiro 20 Jun '18

20 Jun '18

Seems like the “CPTPP” aka “TPP-11” (TPP minus the USA) may not be entirely free of objectionable provisions. A submission to the Australian ratification process <https://www.techdirt.com/articles/20180615/09090440050/open-source-industry…> has pointed out the following problematic clause: No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. As you may know, such an access requirement is an integral part of copyleft licences like the GPL. What this clause seems to be saying is that such a requirement is unenforceable under the TPP.

2 4

meeting next Monday?
by Peter Reutemann 19 Jun '18

19 Jun '18

Hi everyone Any suggestions for next week's meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
by Peter Reutemann 18 Jun '18

18 Jun '18

'Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.' -- source: https://apple.slashdot.org/story/18/06/18/1336248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.18 Preparing Many New Features While Dropping 100k+ Lines of Code
by Peter Reutemann 18 Jun '18

18 Jun '18

'Linux 4.18 development is going strong with recent 4.18-rc1 release. This kernel cycle has dropped 107,210 lines of code so far but Linux 4.18 is adding many new features. The kernel is coming in lighter as a result of the LustreFS code being removed and other code cleanups. On the feature front, Phoronix reports, "ew AMDGPU support improvements, mainlining of the V3D DRM driver, initial open-source work on NVIDIA Volta GV100 hardware, merging of the Valve Steam Controller kernel driver, merging of the BPFILTER framework, ARM Spectre mitigation work, Speck file-system encryption support, removal of the Lustre file-system, the exciting restartable sequences system call was merged, the new DM writecache target, and much more."' -- source: https://linux.slashdot.org/story/18/06/18/1334205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Reason To Move To GPLv3?
by Lawrence D'Oliveiro 18 Jun '18

18 Jun '18

Red Hat has decided <http://www.theregister.co.uk/2018/06/18/red_hat_gpl_violation/> that it prefers the more lenient remediation provisions in GPLv3 for licence violators. So as a matter of policy, it is going to adhere to them even for products it has licensed GPL/LGPLv2.x. [Licensing export Paul] Berg said the GPL and LGPL version 3 have more lenient termination clauses for good reason: Most people have no idea they've violated the terms and would comply if made aware of the problem. The article mentions the case of a Linux kernel developer who has been exploiting--some say abusing--his contributions to extract money from various firms. This has been a great annoyance to the kernel community--the same community that made it clear some years ago that they were against moving to GPLv3.

1 0

Another Day, Another Intel CPU Security Hole: Lazy State
by Peter Reutemann 15 Jun '18

15 Jun '18

'The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system. Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: "It affects Intel designs similar to variant 3-a of the previous stuff, but it's NOT Meltdown." Still, "it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc." Lazy State does not affect AMD processors. This vulnerability exists because modern CPUs include many registers (internal memory) that represent the state of each running application. Saving and restoring this state when switching from one application to another takes time. As a performance optimization, this may be done "lazily" (i.e., when needed) and that is where the problem hides. This vulnerability exploits "lazy state restore" by allowing an attacker to obtain information about the activity of other applications, including encryption operations' -- source: https://it.slashdot.org/story/18/06/14/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Decades-old PGP bug allowed hackers to spoof just about anyone’s signature
by Peter Reutemann 15 Jun '18

15 Jun '18

'For their entire existence, some of the world's most widely used email encryption tools have been vulnerable to hacks that allowed attackers to spoof the digital signature of just about any person with a public key, a researcher said Wednesday. GnuPG, Enigmail, GPGTools, and python-gnupg have all been updated to patch the critical vulnerability. Enigmail and the Simple Password Store have also received patches for two related spoofing bugs. Digital signatures are used to prove the source of an encrypted message, data backup, or software update. Typically, the source must use a private encryption key to cause an application to show that a message or file is signed. But a series of vulnerabilities dubbed SigSpoof makes it possible in certain cases for attackers to fake signatures with nothing more than someone’s public key or key ID, both of which are often published online. The spoofed email shown at the top of this post can't be detected as malicious without doing forensic analysis that's beyond the ability of many users.' -- source: https://arstechnica.com/information-technology/2018/06/decades-old-pgp-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Censorship Of Telegram
by Lawrence D'Oliveiro 14 Jun '18

14 Jun '18

Bruce Schneier <https://www.schneier.com/blog/archives/2018/06/russian_censors.html>: Iran attempts to block Telegram have been more successful than Russia's, less because Iran's censorship technology is more sophisticated but because Telegram is not willing to go as far to defend Iranian users. The reasons are not rooted in business decisions. Simply put, Telegram is a Russian product and the designers are more motivated to poke Russia in the eye. ... In 1993, John Gilmore famously said that "The Internet interprets censorship as damage and routes around it." That was technically true when he said it but only because the routing structure of the Internet was so distributed. As centralization increases, the Internet loses that robustness, and censorship by governments and companies becomes easier.

1 0

KDE Plasma 5.13 Released
by Peter Reutemann 13 Jun '18

13 Jun '18

'KDE unveils the final release of Plasma 5.13, the free and open-source desktop environment. Members of the Plasma team have focused on optimizing startup and minimizing memory usage. Plasma Browser Integration is a suite of new features which make Firefox, Chrome and Chromium-based browsers work with your desktop. For example, downloads are now displayed in the Plasma notification popup, and the Media Controls Plasmoid can mute and skip videos and music playing from within the browser. Browser tabs can be opened directly using KRunner via the Alt-Space keyboard shortcut. System Settings design has been improved further. Window manager gained much-improved effects for blur and desktop switching. Wayland work continued, with the return of window rules, and initial support for screencasts and desktop sharing.' -- source: https://tech.slashdot.org/story/18/06/12/206253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Google Disables Inline Installation For Chrome Extensions
by Peter Reutemann 12 Jun '18

12 Jun '18

'Google today announced that Chrome will no longer support inline installation of extensions. New extensions lose inline installation starting today, existing extensions will lose the ability in three months, and in early December the inline install API will be removed from the browser with the release of Chrome 71. Critics have pointed out such moves make the Chrome Web Store a walled garden, while Google insists pushing users to the store ultimately protects them.' -- source: https://tech.slashdot.org/story/18/06/12/1820217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Slimbook 2 Review
by Peter Reutemann 08 Jun '18

08 Jun '18

'The kind folks at Slimbook recently sent me the latest generation of their ultrabook-style laptop line for review, the KDE Slimbook 2. You can hear my thoughts on the latest episode of the Ubuntu Podcast, released on June 7th 2018. Slimbook are a small laptop vendor based in Spain. All the laptops ship with KDE Neon as the default operating system. In addition to their hardware, they also contribute to and facilitate local Free Software events in their area. I was sent the laptop only for review purposes. There's no other incentive provided, and Slimbook didn't see this blog post before I published it. Being a small vendor, they don't have the same buying power with OEM vendors as other big name laptop suppliers. This is reflected in the price you pay. You're supporting a company who are themselves supporting Free Software developers and communities. If you're after the cheapest possible laptop, and don't care about its origin or the people behind the device, then maybe this laptop isn't for you. However, if you like to vote with your wallet, then the KDE Slimbook should absolutely be on your list to seriously consider.' -- source: https://popey.com/blog/posts/kde-slimbook-2-review.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stymied by browsers, attackers embed Flash 0-day inside MS Office document
by Peter Reutemann 08 Jun '18

08 Jun '18

'As browser makers make it increasingly hard to exploit vulnerabilities in Adobe Flash and other plugins, hackers targeting diplomats in the Middle East tried a new approach this month: using Microsoft Office to remotely load Flash content that used a potent zero-day flaw to take control of computers.' -- source: https://arstechnica.com/information-technology/2018/06/stymied-by-browsers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Much Physical Memory Do I Have?
by Lawrence D'Oliveiro 07 Jun '18

07 Jun '18

The free(1) <https://linux.die.net/man/1/free> command shows you system memory usage. E.g. on my laptop a few seconds ago: ldo(a)theodora:~> free total used free shared buff/cache available Mem: 7922644 1210968 3137520 135964 3574156 6265612 Swap: 8388604 24912 8363692 But there’s something not quite right about that “total” number. The machine has 8GiB of RAM, which should show as 8388608KiB. What happened to the remaining 465964KiB? That is taken up by the kernel. But where can you find a figure for this amount? Where can you make up a total that adds up to 8388608KiB? Seems there is no such place, at least not one accessible to non-privileged software. free(1) gets its info from /proc/meminfo, which is where the kernel reports it. But there is no place in this file (or anywhere else that I know of) that the kernel calculates its own memory usage. However, there is a privileged tool, dmidecode(8) <https://linux.die.net/man/8/dmidecode>, which can get information direct from the “DMI” (aka “SMBIOS”) table. In particular, the command dmidecode -t 17 on the laptop reports two “Memory Device” entries (slots for RAM DIMMs?), one of which says “Size: No Module Installed” while the other has “Size: 8192 MB” (which obviously means 8192MiB). So you have to take the total from here as your actual physical RAM, and subtract the amount shown by free(1) (or read from /proc/meminfo) to get the kernel RAM usage.

1 0

Microsoft Addresses Pressure From Developer Community, Promises To Rename GVFS
by Peter Reutemann 07 Jun '18

07 Jun '18

'Earlier this week an article ran about how Microsoft's multi-year refusal to rename its terabyte-scale Git extension "GVFS" (Git Virtual File System) had drawn the ire and dismay of the GNOME GVfs project (Gnome Virtual File System) which predates the Microsoft project by years. Thanks to Slashdot coverage and community pressure, Microsoft has now officially promised to rename GVFS to something else, and is asking the community for suggestions for a new name. Is this an official sign that MIcrosoft is finally listening to developers (albeit with a Slashdot-level of negative attention), or are they simply trying to appease the crowd while they are still in the news due to their acquisition of GitHub?' -- source: https://developers.slashdot.org/story/18/06/06/132215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Adds Post-Quantum Cryptography To an OpenVPN Fork
by Peter Reutemann 07 Jun '18

07 Jun '18

'Microsoft recently published an interesting open source project called "PQCrypto-VPN" that implements post-quantum cryptography (PQC) within OpenVPN. Being developed by the Microsoft Research Security and Cryptography group, as part of their research into post-quantum cryptography, this fork is being used to test PQC algorithms and their performance and functionality when used with VPNs. Microsoft's PQCrypto-VPN is published on Github and allows anyone to build an OpenVPN implementation that can encrypt communications using three different post-quantum cryptography protocols, with more coming as they are developed. These protocols are: (1) Frodo: a key exchange protocol based on the learning with errors problem (2) SIKE: a key exchange protocol based on Supersingular Isogeny Diffie-Hellman and (3) Picnic: a signature algorithm using symmetric-key primitives and non-interactive zero-knowledge proofs.' -- source: https://tech.slashdot.org/story/18/06/06/138258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPNFilter malware infecting 500, 000 devices is worse than we thought
by Peter Reutemann 07 Jun '18

07 Jun '18

'Two weeks ago, officials in the private and public sectors warned that hackers working for the Russian government infected more than 500,000 consumer-grade routers in 54 countries with malware that could be used for a range of nefarious purposes. Now, researchers from Cisco’s Talos security team say additional analysis shows that the malware is more powerful than originally thought and runs on a much broader base of models, many from previously unaffected manufacturers.' -- source: https://arstechnica.com/information-technology/2018/06/vpnfilter-malware-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UN Plan To Move The World To IPv6
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

The UN has a plan to try to increase IPv6 adoption <http://www.theregister.co.uk/2018/05/30/internet_engineers_united_nations_i…>. However, it does it by essentially saddling IPv6 with all the limitations of IPv4 that IPv6 was specifically created to overcome. The UN has been trying for a while to take over governance of the Internet and its standards. This has been fought off by a US-led effort in favour of the IETF, ICANN etc -- all the bodies we know and love. However, the UN can claim some moral high ground in its advocacy for greater adoption among the developing world -- places where such bodies tend to be under-represented.

1 1

Web Radio
by Lawrence D'Oliveiro 06 Jun '18

06 Jun '18

Just came across this WebSDR website <http://websdr.ewi.utwente.nl:8901/> which lets people listen to short-wave stations remotely. I haven’t actually tried fiddling with it -- it was linked from this article <https://warontherocks.com/2018/05/explaining-the-mystery-of-numbers-station…> on those mysterious “numbers stations” for broadcasting messages to spies.

1 0

Microsoft Acquires GitHub For $7.5B
by Peter Reutemann 04 Jun '18

04 Jun '18

'As rumored, Microsoft said Monday that it has acquired code repository website GitHub for a whopping sum of $7.5B in Microsoft stock. Microsoft Corporate Vice President Nat Friedman, founder of Xamarin and an open source veteran, will assume the role of GitHub CEO. GitHub's current CEO, Chris Wanstrath, will become a Microsoft technical fellow, reporting to Executive Vice President Scott Guthrie, to work on strategic software initiatives. From the blog post: "Microsoft is a developer-first company, and by joining forces with GitHub we strengthen our commitment to developer freedom, openness and innovation," said Satya Nadella, CEO, Microsoft. "We recognize the community responsibility we take on with this agreement and will do our best work to empower every developer to build, innovate and solve the world's most pressing challenges." Under the terms of the agreement, Microsoft will acquire GitHub for $7.5 billion in Microsoft stock. Subject to customary closing conditions and completion of regulatory review, the acquisition is expected to close by the end of the calendar year. GitHub will retain its developer-first ethos and will operate independently to provide an open platform for all developers in all industries. Developers will continue to be able to use the programming languages, tools and operating systems of their choice for their projects -- and will still be able to deploy their code to any operating system, any cloud and any device. The two companies, together, will "empower developers to achieve more at every stage of the development lifecycle, accelerate enterprise use of GitHub, and bring Microsoft's developer tools and services to new audiences," Microsoft said. A portion of the developer community has opposed the move, with some already leaving the platform for alternative services. Update: In a conference call with reporters, Mr. Nadella said today the company is "all in with open source," and requested people to judge the company's commitment to the open source community with its actions in the recent past, today, and in the coming future. GitHub will remain open and independent, Mr. Nadella said.' -- source: https://developers.slashdot.org/story/18/06/04/1314247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.17 Released
by Peter Reutemann 04 Jun '18

04 Jun '18

'In his weekly message to the Linux community on Sunday, Linus Torvalds announced the release of Linux 4.17. The release comes a couple of months after the first release candidate, and in his message Torvalds also talks about version 5.0 of the Linux kernel. Having previously said that Linux kernel v5.0 "should be meaningless," he said that this next major numerical milestone will come around "in the not too distance future." For now, though, it's version 4.17 -- or Merciless Moray, if you prefer -- that's of interest. Linux kernel 4.17 is not a major release, and Torvalds announced it without much fanfare. "So this last week was pretty calm, even if the pattern of most of the stuff coming in on a Friday made it feel less so as the weekend approached. And while I would have liked even less changes, I really didn't get the feeling that another week would help the release in any way, so here we are, with 4.17 released."' -- source: https://linux.slashdot.org/story/18/06/04/0913249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Said to Have Agreed to Acquire Coding Site GitHub
by Peter Reutemann 04 Jun '18

04 Jun '18

'Microsoft Corp. has agreed to acquire GitHub Inc., the code repository company popular with many software developers, and could announce the deal as soon as Monday, according to people familiar with the matter. GitHub preferred selling the company to going public and chose Microsoft partially because it was impressed by Chief Executive Officer Satya Nadella, said one of the people, who asked not to be identified discussing private information. Terms of the agreement weren't known on Sunday. GitHub was last valued at $2 billion in 2015. GitHub is an essential tool for coders. Many corporations, including Microsoft and Alphabet Inc.'s Google, use GitHub to store their corporate code and to collaborate. It's also a social network of sorts for developers. While GitHub's losses have been significant -- it lost $66 million over three quarters in 2016 -- it had revenue of $98 million in nine months of that year. On Friday, it was reported that Microsoft was in talks with GitHub about an acquisition. Now it seems like it's actually happening. Update: Our sister site, SourceForge, has weighed in. Here is a tool that will import your GitHub project to SourceForge. Update #2: Already, we are seeing plenty of backlash over this news. One user has started a petition to stop Microsoft from buying GitHub.' -- source: https://developers.slashdot.org/story/18/06/03/2042255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Emacs 26.1 Released With New Features
by Peter Reutemann 03 Jun '18

03 Jun '18

'There's a new version of the 42-year-old libre text editor with over 2,000 built-in commands, reports LWN.net: Highlights include a built-in Lisp threading mechanism that provides some concurrency, double buffering when running under X, a redesigned flymake mode, 24-bit color support in text mode, and a systemd [user] unit file. The Free Software Foundation has released a 10,653-word description of all the new features in Emacs 26.1. Here's a couple more: * The Emacs server now has socket-launching support. This allows socket based activation, where an external process like systemd can invoke the Emacs server process upon a socket connection event and hand the socket over to Emacs... This new functionality can be disabled with the configure option '--disable-libsystemd'. * The new function 'call-shell-region' executes a command in an inferior shell with the buffer region as input. * Intercepting hotkeys on Windows 7 and later now works better. * The new user variable 'electric-quote-chars' provides a list of curved quotes for 'electric-quote-mode', allowing user to choose the types of quotes to be used.' -- source: https://news.slashdot.org/story/18/06/01/202205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Atari Launches Linux Gaming Box Starting at $199
by Peter Reutemann 03 Jun '18

03 Jun '18

'Attempts to establish Linux as a gaming platform have failed time and time again, with Valve's SteamOS being the latest high-profile casualty. Yet, Linux has emerged as a significant platform in the much smaller niche of retro gaming, especially on the Raspberry Pi. Atari has now re-emerged from the fog of gaming history with an Ubuntu-based Atari VCS gaming and media streaming console aimed at retro gamers. In addition to games, the Atari VCS will also offer Internet access and optional voice control. With a Bluetooth keyboard and mouse, the system can be used as a standard Linux computer. The catch is that the already delayed systems won't ship until July 2019... By the launch date, Atari plans to have "new and exclusive" games for download or streaming, including "reimagined classic titles from Atari and other top developers," as well as multi-player games. The Atari VCS Store will also offer video, music and other content... The hardware is not open source, and the games will be protected with HDCP. However, the Ubuntu Linux stack based on Linux kernel 4.10 is open source, and includes a "customizable Linux UX." A Linux "sandbox" will be available for developing or porting games and apps. Developers can build games using any Linux compatible gaming engine, including Unity, Unreal Engine, and Gamemaker. Atari also says that "Linux-based games from Steam and other platforms that meet Atari VCS hardware specifications should work." Atari boasts this will be their first device offering online multi-player experiences, and the device will also come pre-loaded with over 100 classic Atari games. An Indiegogo campaign this week seeking $100,000 in pre-orders has already raised over $2.2 million from 8808 backers.' -- source: https://games.slashdot.org/story/18/06/01/2057206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CSS Is Now So Overpowered It Can Deanonymize Facebook Users
by Peter Reutemann 03 Jun '18

03 Jun '18

'Some of the recent additions to the Cascading Style Sheets (CSS) web standard are so powerful that a security researcher has abused them to deanonymize visitors to a demo site and reveal their Facebook usernames, avatars, and if they liked a particular web page of Facebook. Information leaked via this attack could aid some advertisers linking IP addresses or advertising profiles to real-life persons, posing a serious threat to a user's online privacy. The leak isn't specific to Facebook but affects all sites which allow their content to be embedded on other web pages via iframes. The actual vulnerability resides in the browser implementation of a CSS feature named "mix-blend-mode," added in 2016 in the CSS3 web standard. Security researchers have proven that by overlaying multiple layers of 1x1px-sized DIV layers on top of iframes, each layer with a different blend mode, they could determine what's displayed inside it and recover the data, to which parent websites cannot regularly access. This attack works in Chrome and Firefox, but has been fixed in recent versions.' -- source: https://tech.slashdot.org/story/18/06/02/0531202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amscay Essagemay
by Lawrence D'Oliveiro 02 Jun '18

02 Jun '18

Received this message a few days ago: Hello, Tphe3rer was a6n e7rdrmor in ymourq bi3llicng infoormaptniido0n: C6re7dit cfard ntu9mbejt:94*****c we c5obuldnt co8nfiidrem3 you8r5 deta4ilsf with youri b9an5k u C1ovn1tdenatl Providerl: iTyunes2 Store,App Store,xiCloud,ipTunesy Ma5tc7h... Dkaltex of expmir2at6ion: 30/0h5/18 Reason of expiratikon7: Acecountk n7egver been1 updqated Accuouynt stagteusz: On hmold1,Waitincg2 for ryeinae7wablme Your ac9cmount is ond hold, Warit2ingy fboyrq r0e3nejwald,8 you have 4g8 hours or wi3ll0 be closed.h Pxlmeaaseb renbew yeouqr suzbstcnroi2ptsison witih u5s tor convtinnue uvse acll s0eqrvices In otr9dern to3 ensiur9ed yo1urp Accoiunlt achtsi8ve,a yyou mcustf nsow c4lickz the fopldl6owjing lin8k andp fyollowx thce instar5uctilovnsd providie3d: (etc, etc) I realize there must be an upper IQ limit to those who are likely to respond to such an invitation. But surely there must be a lower limit as well, to being able to even understand the message in the first place. Is the interval between them nonempty?

1 0

Inkscape: By The Way ...
by Lawrence D'Oliveiro 01 Jun '18

01 Jun '18

That previous Libre Graphics World article linked to an item on Tavmjong Bah’s blog <http://tavmjong.free.fr/blog/>. “Mr Inkscape” himself has posts on the ins and outs of SVG and CSS, and tutorials on advanced features of Inkscape itself.

1 0

SVG 2.0 Chicken-And-Egg Dilemma
by Lawrence D'Oliveiro 01 Jun '18

01 Jun '18

From <http://libregraphicsworld.org/blog/entry/gradient-meshes-and-hatching-to-be…>: Essentially, we have arrived to the point where development of a major vector graphics file format for the Web is shaped by inactivity of Mozilla and Google, while Microsoft and W3C do the real work, a developer of one design tool [Inkscape] contributes a lot, but has no say in what goes into the standard, and a vendor [Adobe] of another design tool is taking a wait-and-see stance. By the way, it appears Alexandre Prokoudine has given up the battle with spammers, and has turned off all posting of new comments on his blog.

1 0

Chrome and Firefox leaks let sites steal visitors’ Facebook names, profile pics
by Peter Reutemann 01 Jun '18

01 Jun '18

'For more than a year, Mozilla Firefox and Google Chrome may have leaked users’ Facebook usernames, profile pictures, and likes if the users’ browsers visited malicious websites that employed a cutting-edge hack, researchers said Thursday. The data could be extracted through what’s known as a side-channel vulnerability in the browsers’ implementation of new standards for cascading style sheets introduced in 2016. One of the new features known as the “mix-blend-mode” leaked visual content hosted on Facebook to websites that included an iframe linking to it and some clever code to capture the data. Normally, a security concept known as the same-origin policy forbids content hosted on one domain to be available to a different domain. The vulnerability was significant because it allowed hackers to bypass this bedrock principle for two of the Internet’s most widely used browsers. The leak was independently discovered by two different research teams, and it was fixed late last year in version 63 of Chrome and two weeks ago in Firefox 60. While the updated browsers no longer pose a threat to user privacy, one of the researchers who discovered the vulnerability said the increasingly powerful graphics capabilities being added in the HTML5 and CSS standards are likely to make similar hacks possible in the future.' -- source: https://arstechnica.com/information-technology/2018/05/chrome-and-firefox-l… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1834: The World’s First Cyberattack
by Lawrence D'Oliveiro 31 May '18

31 May '18

How a pair of bond-trader brothers were able to covertly get information on prices days ahead of the competition, using the French Government-only telegraph network <https://www.schneier.com/blog/archives/2018/05/1834_the_first_.html>.

1 0

ProtonMail Launches Free ProtonVPN Service For Macs
by Peter Reutemann 31 May '18

31 May '18

'The creators of popular encrypted email service ProtonMail have released a free version of their ProtonVPN software for macOS. From a report: Even though the free version does not contain the full features that you would come to expect from a paid VPN service it is more than capable of obfuscating IP addresses and your location. While ProtonVPN has already released Windows and Android versions, according to Dr. Andy Yen, CEO of ProtonMail, their reason for releasing the free macOS version "is to make the world a safer place by ensuring that citizens around the world have access to an Internet free of spying and censorship. Releasing a free VPN service for macOS is another important step in that direction."' -- source: https://apple.slashdot.org/story/18/05/31/1327232 Here's the pricing/features overview: https://protonvpn.com/pricing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome 67 Released for Windows, Mac, and Linux
by Peter Reutemann 31 May '18

31 May '18

'Google released earlier today Chrome 67, the latest stable release of its web browser. According to changelogs released with Chrome 67, this version adds support for a Generic Sensors API, improves AR and VR experiences, and deprecates the HTTP-Based Public Key Pinning (HPKP) security feature. Probably the biggest change in Chrome 67 is the addition of the Generic Sensors API. As the name implies, this is an API that exposes data from device sensors to public websites. The new API is based on the Generic Sensor W3C standard. This API is meant primarily for mobile use, and in its current version, websites can use Chrome's Generic Sensors API to access data from a device's accelerometer, gyroscope, orientation and motion sensors. Another API that shipped with Chrome is the WebXR Device API. Developers can use this API to build virtual and augmented reality experiences on Chrome for mobile-based VR headsets like Google Daydream View and Samsung Gear VR, as well as desktop-hosted headsets like Oculus Rift, HTC Vive, and Windows Mixed Reality Headsets.' -- source: https://tech.slashdot.org/story/18/05/30/1440256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

pop linux reviewed on distrowatch
by Ian Young 30 May '18

30 May '18

https://distrowatch.com/weekly.php?issue=20180528 By a strange coincidence the Sys 76 Linux version gets a look over this week on Distrowatch about the same time as our last meeting. A range of interesting comments amidst the dross. ~ Ian Y

3 3

Sonic and Ultrasonic Attacks Damage Hard Drives and Crash OSes
by Peter Reutemann 30 May '18

30 May '18

'Attackers can cause potentially harmful hard drive and operating system crashes by playing sounds over low-cost speakers embedded in computers or sold in stores, a team of researchers demonstrated last week. The attacks use sonic and ultrasonic sounds to disrupt magnetic HDDs as they read or write data. The researchers showed how the technique could stop some video-surveillance systems from recording live streams. Just 12 seconds of specially designed acoustic interference was all it took to cause video loss in a 720p system made by Ezviz. Sounds that lasted for 105 seconds or more caused the stock Western Digital 3.5 HDD in the device to stop recording altogether until it was rebooted. The device uses flash storage to house its firmware, but by default it uses a magnetic HDD to store the large quantities of video it records. The attack used a speaker hanging from a ceiling that rested about four inches above the surveillance system's HDD. The researchers didn't remove the casing or otherwise tamper with the surveillance system. The technique was also able to disrupt HDDs in desktop and laptop computers running both Windows and Linux. In some cases, it even required a reboot before the PCs worked properly. ' -- source: https://hardware.slashdot.org/story/18/05/30/0349202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Spring Update Improves Linux On WSL With Unix Sockets and More
by Peter Reutemann 29 May '18

29 May '18

'Windows 10 build 1803 has come out this month, but with some problems. AnandTech has a deep-dive with the review examing many new features including the much better support for Linux. WSL (Windows Subsystem for Linux) now has native Curt and Tar from the command prompt as well as a utility to convert Unix to Windows pathnames called WSLpath.exe which is documented here. In addition it was mentioned on Slashdot in the past about OpenSSH being ported natively to Win32 in certain early builds. It now seems the reason was for Linux interoperability with this Spring Update 2. Unix sockets mean you can run Kali Linux on Windows 10 for penetration testing or run an Apache server in the background with full Linux networking support. Deemons now run in the background even with the command prompt closed. [...]' -- source: https://tech.slashdot.org/story/18/05/29/0244210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Satya Nadella: “I Believe Right Now Microsoft Is Probably On The Right Side Of History”
by Lawrence D'Oliveiro 27 May '18

27 May '18

Interview of the Microsoft boss by the Daily Telegraph <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120597…>: ... Nadella's four years in charge cannot be described as anything but a success. Under his watch, its share price has increased by 170 per cent, finally overtaking the levels from the peak of the dotcom boom. Except that share price seems a somewhat short-sighted way of measuring a company’s success. Look at HP. "I always make this case, which is if it was not for Microsoft's openness, the web wouldn't have happened. I was talking to [web creator Sir] Tim Berners-Lee yesterday and I sort of said: 'Think about the current ecosystems and how closed and how walled gardened and riddled with all kinds of ways they've rigged it, [compared] to where we were.' Talk about rewriting history. The Web was growing by leaps and bounds long before Microsoft even noticed it (remember how the first edition of Bill Gates’ book “The Road Ahead” didn’t even mention it?). Netscape was the leader and de-facto setter of standards, until Microsoft belatedly entered the race, and took over by giving away their product for free. Then we had the long period of stagnation under Internet Explorer 6, until Firefox came in to jolt them out of their complacency, followed by Apple’s Safari and Google’s Chrome. So to say that “Microsoft’s openness” had anything to do with it is just shamelessly false.

1 0

There Are Real Reasons For Linux To Replace ifconfig, netstat and Other Classic Tools
by Peter Reutemann 27 May '18

27 May '18

'One of the ongoing system administration controversies in Linux is that there is an ongoing effort to obsolete the old, cross-Unix standard network administration and diagnosis commands of ifconfig, netstat and the like and replace them with fresh new Linux specific things like ss and the ip suite. Old sysadmins are generally grumpy about this; they consider it yet another sign of Linux's 'not invented here' attitude that sees Linux breaking from well-established Unix norms to go its own way. Although I'm an old sysadmin myself, I don't have this reaction. Instead, I think that it might be both sensible and honest for Linux to go off in this direction. There are two reasons for this, one ostensible and one subtle. The ostensible surface issue is that the current code for netstat, ifconfig, and so on operates in an inefficient way. Per various people, netstat et al operate by reading various files in /proc, and doing this is not the most efficient thing in the world (either on the kernel side or on netstat's side). You won't notice this on a small system, but apparently there are real impacts on large ones. Modern commands like ss and ip use Linux's netlink sockets, which are much more efficient. In theory netstat, ifconfig, and company could be rewritten to use netlink too; in practice this doesn't seem to have happened and there may be political issues involving different groups of developers with different opinions on which way to go. (Netstat and ifconfig are part of net-tools, while ss and ip are part of iproute2.) However, the deeper issue is the interface that netstat, ifconfig, and company present to users. In practice, these commands are caught between two masters. On the one hand, the information the tools present and the questions they let us ask are deeply intertwined with how the kernel itself does networking, and in general the tools are very much supposed to report the kernel's reality. On the other hand, the users expect netstat, ifconfig and so on to have their traditional interface (in terms of output, command line arguments, and so on); any number of scripts and tools fish things out of ifconfig output, for example. As the Linux kernel has changed how it does networking, this has presented things like ifconfig with a deep conflict; their traditional output is no longer necessarily an accurate representation of reality.' -- source: https://linux.slashdot.org/story/18/05/27/1448211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mystery Donor Pledges $1 Million To The GNOME Foundation
by Peter Reutemann 27 May '18

27 May '18

'This week, The GNOME Foundation made a shocking revelation: a mystery donor has pledged $1 million dollars. We don't know who is promising the money -- it could be a rich man or woman, but more likely -- and this is pure speculation -- it is probably a company that benefits from GNOME, such as Red Hat or Canonical. "An anonymous donor has pledged to donate up to $1,000,000 over the next two years, some of which will be matching funds. The GNOME Foundation is grateful for this donation and plans on using these funds to increase staff to streamline operations and to grow its support of the GNOME Project and the surrounding ecosystem. While the GNOME Foundation has maintained its position as a proponent of the GNOME Project, growth has been limited. With these funds, the GNOME Foundation will be able to expand and lead in the free software space," says The GNOME Foundation.' -- source: https://linux.slashdot.org/story/18/05/27/1653225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New speculative-execution vulnerability strikes AMD, ARM, and Intel
by Peter Reutemann 22 May '18

22 May '18

'A new attack that uses processors' speculative-execution capabilities to leak data, named Speculative Store Bypass (SSB), has been published after being independently discovered by Microsoft's Security Response Center and Google Project Zero. Processors from Intel and AMD, along with some of those using ARM's designs, are all affected.' -- source: https://arstechnica.com/gadgets/2018/05/new-speculative-execution-vulnerabi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 22 May '18

22 May '18

Hi everyone We have a meeting next Monday: 'Carsten will give a short introduction to their FOSS project "DiLer" which is a LMS and school administration software and how they made it a business model. Some details are available at https://digitale-lernumgebung.de in English. Lawrence D'Oliveiro will show off Pop!_OS, the Ubuntu-derivative that System76 uses on their computers that they sell (https://system76.com/pop)' More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737153 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: Some Good Linux Desktop Option For Kids?
by Peter Reutemann 17 May '18

17 May '18

'I'm looking to re-purpose some of the older hardware that I've held onto to create something of a starter machine for my kids (both aged below 10). At this point it's still just a few shortcut icons I can setup on the desktop for them, primarily to web tools/sites they use, but I'd like some flexibility; everything I've read suggests options that haven't had any activity since 2015. Is there an option out there or is this just a custom job' -- source: https://ask.slashdot.org/story/18/05/17/1425203 See the discussion in the comments of that article. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu - Upgrading to 18.04
by Ian Stewart 17 May '18

17 May '18

Hi, Ubuntu users are probably aware that about three weeks ago version 18.04.0 was released. This is a Long Term Support (LTS) release. If you are running version 17.10, and your "Software & Updates" --> "Updates" --> "Notify me of a new Ubuntu version:" is set to either "For any new version" or "For long-term support versions", then you will probably have received a GUI pop-up screen asking you if you wanted to do an on-line upgrade to 18.04. I had no problems when performing the on-line upgrade with Ubuntu/Mate 17.10 to 18.04. (Which is better that when I did the 17.04 to 17.10, where I struck an application dependency problem.) I also have a 16.04 LTS Ubuntu/Mate laptop, and I was expecting a pop-up and to get prompted to do the software upgrade to 18.04 LTS, but all I could get was a message to say my 16.04 version was up-to-date. In reading this askubuntu posting: https://askubuntu.com/questions/1028624/not-able-to-upgrade-from-16-04-lts-… ...I found someone has posted the following comment: Upgrades from LTS releases are scheduled after the first patch - 18.04.1 which is usually a month after the first release. They need to make sure everything goes smoothly and then the software manager will allow it. If you're anxious, which based on my experience you shouldn't be cause there are probably tons of bugs, you can still force that upgrade, but that's not recommended. sudo do-release-upgrade -d ...despite it not being recommended I did the "sudo do-release-upgrade -d" and it upgraded my laptop from 16.04 to 18.04, and it seems to be booting and working fine. However, if you read the posting, then be aware that not everyone has had the same level of success: "I did a sudo do-release-upgrade -d on an ASUS SonicMaster with Ubuntu 16.04 LTS on it. After the upgrade, I restarted the machine, and the computer couldn't boot due to some infinite loops while showing messages regarding PCI bus." cheers, Ian.

1 1

Fedora-Based Linux Distro Korora Halts Development
by Peter Reutemann 16 May '18

16 May '18

'Korora, a Fedora-based Linux distro, halted its development this month, BetaNews' Brian Fagioli spotted Wednesday. The announcement would irk many, as Korora consistently received positive feedback from critics and users alike. News outlet ZDNet once described Korora as "Fedora++", while Slashdot readers, too, spoke highly of the distro. At the same time, the announcement should come as little surprise to anyone who has been tracking Korora's work. In a blog post, Korora team wrote: Korora for the forseeable future is not going to be able to march in cadence with the Fedora releases. In addition to that, for the immediate future there will be no updates to the Korora distribution. Our team is infinitesimal (currently 1 developer and 2 community managers) compared to many other distributions, we don't have the luxury of being able to dedicate the amount of time we would like to spend on the project and still satisfy our real life obligations. So we are taking a little sabbatical to avoid complete burn out and rejuvenate ourselves and our passion for Korora/Fedora and wider open source efforts. The team had expressed similar concerns earlier this year: For the past few years Korora has released a new version in line with each Fedora version. That means that approximately twice a year we prepare, test and create 5 different ISO versions. This is as well as, among other things, developing new projects, supporting existing releases and planning the future versions. As each team member has different skills some tasks, such as development, can only be done by one person. All this is done in our spare time along side our job, family and personal responsibilities. For a very small team, currently 3 people plus the occasional input from others, this is a lot of work. It means that often Korora has to take a back seat when real life intrudes. This isn't the first time Korora had to abruptly pause its development. In 2007, Christopher Smart, who kickstarted Korora (at the time based on Gentoo Linux), had discontinued the project -- only to revive it three years later.' -- source: https://linux.slashdot.org/story/18/05/16/1352245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu - Upgrading to 18.04
by rowan schischka 16 May '18

16 May '18

My Ubuntu 18.04 upgrade story from 17.10, originally 16.04. I had to re-install xserver-xorg-input-all to get my mouse and keyboard working I also had to reinstall gnome, for some reason only Unity desktop was installed. Other than that it is working fine.

1 0

It Doesn't Take a Genius to See That Microsoft Still Attacks GNU/Linux With Patents to Make Billions of Dollars in 'Protection' Money
by Peter Reutemann 14 May '18

14 May '18

'Intellectual Ventures, Finjan, RPX, and other Microsoft-connected trolls cannot be countered by LOT Network and the likes of it (notably OIN); Microsoft continues to shrewdly distribute patents to trolls, offering 'protection' from them (for a fee) and pressuring OEMs to bundle Microsoft 'apps' or risk retaliatory patent lawsuits' -- source: http://techrights.org/2018/05/14/microsoft-still-attacks-with-patents/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Attention PGP Users: New Vulnerabilities Require You To Take Action Now
by Peter Reutemann 14 May '18

14 May '18

'A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. From a report: EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages. The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific). In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication. Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.' -- source: https://it.slashdot.org/story/18/05/14/149222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malware Found In the Ubuntu Snap Store
by Peter Reutemann 14 May '18

14 May '18

'Oh, snap! Just because some packages are available to install directly from the Ubuntu Software Center doesn't make them safe. This is proved by a recent discovery of malware in some snap packages from the Ubuntu Snaps Store. At least two of the snap packages, 2048buntu and hextris, uploaded to the Ubuntu Snaps Store by user Nicolas Tomb, contained malware. All packages by Nicolas have since been removed from the Ubuntu Snaps Store, "pending further investigations." The report comes from a bug which mentions that the 2048buntu snap package (and other packages by Nicolas Tomb) contains a hidden cryptocurrency miner inside. ' -- source: https://news.slashdot.org/story/18/05/12/2140252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Same IP Address For Wired And Wireless Connections
by Lawrence D'Oliveiro 10 May '18

10 May '18

I did something I thought was a little dodgy in my DHCP server config, namely I assigned the same IP address to both the Ethernet and Wi-Fi MAC addresses for my laptop. I figured this was OK so long as I turned one off before turning on the other. Today, I tried breaking that rule. I started a large rsync transfer over wi-fi, decided it was too slow, and plugged in an Ethernet cable. And it worked! After a few seconds, I was able to turn off the wi-fi, and the transfer continued without a hiccup. Has anyone else tried this?

1 0

A first look at Ubuntu 18.04 LTS desktop
by Peter Reutemann 10 May '18

10 May '18

'Last week, Canonical released Ubuntu 18.04 LTS (codenamed "Bionic Beaver"), the latest long-term support version of the Ubuntu Linux distribution. Ars is working on a full review of the release, but I wanted to share some first impressions of the desktop, which is a major advance over the last LTS version.' -- source: https://arstechnica.com/information-technology/2018/04/bionic-beaver-a-firs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

System76 Oryx Pro Linux laptop is now thinner and faster, putting Apple MacBook Pro to shame
by Peter Reutemann 10 May '18

10 May '18

'Last week, System76 started to share details about its refreshed Linux-powered Oryx Pro laptop. It would be thinner and more powerful, while adding twice the battery life of its predecessor. Unfortunately, we did not yet know exactly what the laptop looked like. Today, we finally have official images. This new Oryx Pro is quite breathtaking, as it is a true Pro machine -- with the USB Type-A, Ethernet, and HDMI ports you expect -- while being just 19mm thin. It has the horsepower that power-users need, thanks to its 8th Gen Intel Core i7 processor and NVIDIA GeForce GTX 10-Series GPU. Hey, Apple, this is what a "Pro" laptop should be...' -- source: https://betanews.com/2018/05/09/system76-oryx-pro-linux-laptop/ The video is fun to watch, too. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
by Peter Reutemann 09 May '18

09 May '18

'Almost all major OS vendors released security patches yesterday after a researcher discovered that some OS makers have misinterpreted an Intel CPU debug feature and left their systems open to attacks. From a report: The vulnerability is in how the OS vendors implemented a hardware debug mechanism for Intel x86-64 architectures -- and more specifically the MOV SS and POP SS instructions. "In certain circumstances after the use of certain Intel x86-64 architecture instructions, a debug exception pointing to data in a lower ring (for most operating systems, the kernel Ring 0 level) is made available to operating system components running in Ring 3," the CERT/CC team explained in an advisory published yesterday. Explained in layman's terms, "this may allow an attacker to utilize operating system APIs to gain access to sensitive memory information or control low-level operating system functions." Operating systems that mishandle this debug exception and had their systems open to attacks include Apple, Microsoft, FreeBSD, Red Hat, Ubuntu, SUSE Linux, and other Linux distros based on the Linux Kernel -- which is also affected.' -- source: https://it.slashdot.org/story/18/05/09/1724220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Moves Browsers Into Post-Password Future With WebAuthn Tech
by Peter Reutemann 09 May '18

09 May '18

'Today, Mozilla released Firefox 60 for Windows, Mac, Linux and Android, and with it arrives Web Authentication API for desktop browsers. From a report: Firefox 60 supports technology called Web Authentication, or WebAuthn for short, that can be used to grant you access to websites with a physical authentication device like a YubiKey dongle, biometric identity proof using an Android phone's fingerprint reader or the iPhone's Face ID, and some other alternatives to passwords. Passwords are a particular problem on the web. Fake websites can coax you to type in credentials that then can be used to steal money from your bank account or snoop your email -- a problem called phishing. Even if you pick hard-to-guess passwords, never reuse them on multiple sites and always remember them, passwords still aren't that strong a foundation for security these days. We're still a long way away from a post-password future, but WebAuthn is an important step, if nothing else, in making sites more secure.' -- source: https://news.slashdot.org/story/18/05/09/1932232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare Embraces ARM As Qualcomm Might Leave
by Lawrence D'Oliveiro 09 May '18

09 May '18

Seems like Qualcomm might be giving up <http://www.theregister.co.uk/2018/05/08/arm_server_cpus_why_are_they_going_…> on trying to offer ARM servers for the data centre. But in that same article, one of the comments linked to this item <http://www.datacenterknowledge.com/design/cloudflare-bets-arm-servers-it-ex…> which says that Cloudflare is going all in on using ARM servers to expand its CDN worldwide. I suppose content delivery is a market segment where sheer CPU grunt is less important than I/O throughput, power efficiency etc.

1 0

Chrome 66 Arrives With Autoplaying Content Blocked By Default
by Peter Reutemann 09 May '18

09 May '18

'Google today launched Chrome 66 for Windows, Mac, Linux, and Android. The desktop release includes autoplaying content muted by default, security improvements, and new developer features. You can update to the latest version now using the browser's built-in silent updater or download it directly from google.com/chrome. In our tests, autoplaying content that is muted still plays automatically. Autoplaying content with sound, whether it has visible controls or not, and whether it is set to play on loop or not, simply does not start playing. Note that this is all encompassing -- even autoplaying content you are expecting or is the main focus of the page does not play. YouTube videos, for example, no longer start playing automatically. And in case that's not enough, or if a page somehow circumvents the autoplaying block, you can still mute whole websites.' -- source: https://tech.slashdot.org/story/18/04/18/0410202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Gimp 2.10.0 release
by Peter Reutemann 09 May '18

09 May '18

'The long-awaited GIMP 2.10.0 is finally here! This is a huge release, which contains the result of 6 long years of work (GIMP 2.8 was released almost exactly 6 years ago!) by a small but dedicated core of contributors. The Changes in short: - Image processing nearly fully ported to GEGL, allowing high bit depth processing, multi-threaded and hardware accelerated pixel processing, and more. - Color management is a core feature now, most widgets and preview areas are color-managed. - Many improved tools, and several new and exciting tools, such as the Warp transform, the Unified transform and the Handle transform tools. - On-canvas preview for all filters ported to GEGL. - Improved digital painting with canvas rotation and flipping, symmetry painting, MyPaint brush support… - Support for several new image formats added (OpenEXR, RGBE, WebP, HGT), as well as improved support for many existing formats (in particular more robust PSD importing). - Metadata viewing and editing for Exif, XMP, IPTC, and DICOM. - Basic HiDPI support: automatic or user-selected icon size. - New themes for GIMP (Light, Gray, Dark, and System) and new symbolic icons meant to somewhat dim the environment and shift the focus towards content (former theme and color icons are still available in Preferences). - And more, better, more, and even more awesome!' -- source: https://www.gimp.org/news/2018/04/27/gimp-2-10-0-released/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drupal Sites Fall Victims To Cryptojacking Campaigns
by Peter Reutemann 08 May '18

08 May '18

'After the publication of two severe security flaws in the Drupal CMS, cybercrime groups have turned their sights on this web technology in the hopes of finding new ground to plant malware on servers and make money through illegal cryptocurrency mining. [...] Now, as time passes by, more malware campaigns targeting Drupal sites are getting off the ground -- and two of them have been spotted the past week. The most recent of these campaigns has been discovered by US security researcher Troy Mursch. The researcher discovered a group that gained access to Drupal sites and hid a version of the Coinhive in-browser cryptocurrency miner inside a file named "jquery [dot] once [dot] js?v=1.2," loaded on each of the compromised sites. Mursch initially tracked down the infected files to over 100,000 domains, then narrowed down the results to 80,000 domains, and finally confirmed the infection on at least 348 sites where the in-browsing mining operation was actually taking place.' -- source: https://it.slashdot.org/story/18/05/07/1636258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Considering an HTML5-Based OS Installer
by Peter Reutemann 08 May '18

08 May '18

'Ubuntu's Self-Appointed Benevolent Dictator for Life, Mark Shuttleworth, is considering backing a new Ubuntu installer that would be using HTML5 via the Electron Framework. This theoretical installer would re-use the company's existing HTML5 code for managing MAAS installations, integrate with Electron, and also better support their Snap packaging format, according to his proposal. What could possibly go wrong with an HTML5/Electron operating system installer? Mark also announced that Ubuntu 18.10 is codenamed the Cosmic Cuttlefish.' -- source: https://news.slashdot.org/story/18/05/08/1712221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Run Linux Apps On Chrome OS
by Peter Reutemann 08 May '18

08 May '18

'Google today announced Chrome OS is getting Linux support. "As a result, Chromebooks will soon be able to run Linux apps and execute Linux commands," reports VentureBeat. "A preview of Linux on the Pixelbook will be released first, with support for more devices coming soon." From the report: "Just go to wherever you normally get those apps, whether it's on the websites or through apt-get in the Linux terminal, and seamless get those apps like any other Linux distribution," Chrome OS director of product management Kan Liu told VentureBeat. Support for Linux apps means developers will finally be able to use a Google device to develop for Google's platforms, rather than having to depend on Windows, Mac, or Linux machines. And because Chrome OS doesn't just run Chrome OS-specific apps anymore, developers will be able to create, test, and run any Android or web app for phones, tablets, and laptops all on their Chromebooks. Without having to switch devices, you can run your favorite IDE -- as long as there is a Debian Linux version (for the curious, Google is specifically using Debian Stretch here -- code in your favorite language and launch projects to Google Cloud with the command line. ' -- source: https://linux.slashdot.org/story/18/05/08/216240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting topics?
by Peter Reutemann 08 May '18

08 May '18

Hi everyone Any ideas for next week's meeting? Having a go at System76's Pop!_OS? Other ideas? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

3 3

Eight New Meltdown-Like Flaws Found
by Peter Reutemann 06 May '18

06 May '18

'Researchers have found eight new flaws in computer central processing units that resemble the Meltdown and Spectre bugs revealed in January, a German computing magazine reported on Thursday. The magazine, called c't, said it was aware of Intel Corp's plans to patch the flaws, adding that some chips designed by ARM Holdings, a unit of Japan's Softbank, might be affected, while work was continuing to establish whether Advanced Micro Devices chips were vulnerable... The magazine said Google Project Zero, one of the original collective that exposed Meltdown and Spectre in January, had found one of the flaws and that a 90-day embargo on going public with its findings would end on May 7... "Considering what we have seen with Meltdown and Spectre, we should expect a long and painful cycle of updates, possibly even performance or stability issues," said Yuriy Bulygin, chief executive officer of hardware security firm Eclypsium and a former Intel security researcher. "Hopefully, Meltdown and Spectre led to improvements to the complicated process of patching hardware." Neowin now reports that Intel "is expected to release microcode updates in two waves; one in May, and the other in August."' -- source: https://it.slashdot.org/story/18/05/05/1730203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drive-by Rowhammer attack uses GPU to compromise an Android phone
by Peter Reutemann 03 May '18

03 May '18

'Over the past few years, there has been a steady evolution in Rowhammer, the once largely theoretical attack that exploits physical defects in memory chips to tamper with the security of the devices they run on. On Thursday, researchers are unveiling the most practical demonstration yet of Rowhammer's power and reach: an exploit that remotely executes malicious code on Android phones by harnessing their graphical processors.' -- source: https://arstechnica.com/information-technology/2018/05/drive-by-rowhammer-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

More Dead Microsoft Technologies
by Lawrence D'Oliveiro 01 May '18

01 May '18

A roundup <http://www.theregister.co.uk/2018/05/01/windows_10_april_update_casualties/> of what’s gone in the latest Windows 10 update mentions that HomeGroup, Microsoft’s attempt to let a bunch of machines share files and printers on an ad-hoc basis, has now gone the way of Windows Home Server and Windows Media Center. Also it looks like XPS, Microsoft’s NIH alternative to PDF, has also bitten the dust. And the Windows Help Viewer may be next...

1 0

Fedora 28 Featuring GNOME 3.28 Released
by Peter Reutemann 01 May '18

01 May '18

'Fedora 28 has many new features, but one in particular will surely excite desktop/workstation users -- GNOME 3.28, which introduces Thunderbolt 3 support and improved laptop battery life. Fedora has long used GNOME as the default desktop environment, and best of all, it is mostly a stock affair -- no silly tweaks enabled by default. In other words, you get a very pure GNOME experience, making Fedora Workstation the preferred OS for many hardcore fans of the DE. "GNOME 3.28 adds the capability to favorite files, folders, and contacts for easier organization and access. Additionally, the new application Usage is included to help users more easily diagnose and resolve performance and capacity issues," says The Fedora Project.' -- source: https://linux.slashdot.org/story/18/05/01/1727233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB 3.2 Work Is On The Way For The Linux 4.18 Kernel: Report
by Peter Reutemann 30 Apr '18

30 Apr '18

'USB 3.2 was announced last summer as an incremental update to the USB standard to double the bandwidth for existing USB Type-C cables. We haven't seen much in the way of USB 3.2 mentions in the Linux kernel yet but then again we haven't really seen USB 3.2 devices yet. USB 3.2 brings a multi-lane operation mode for hosts and devices using existing Type-C cables as well as a minor update to the USB hub specification. USB 3.2 allows for new 10 Gbit/s and 20 Gbit/s rates using two lanes, USB 3.2 Gen 1x2 and USB 3.2 Gen 2x2, respectively. It looks like kernel developers are now working on getting their USB 3.2 Linux support in order. We were tipped off that as of last week there are some USB 3.2 patches queued in the usb-next tree maintained by Greg Kroah-Hartman's.' -- source: https://linux.slashdot.org/story/18/04/30/1558201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sinclair ZX Spectrum Designer Rick Dickinson Succumbs To Cancer
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Rick Dickinson, the designer for several machines sold by Sinclair in the 1980s, has died <http://www.theregister.co.uk/2018/04/26/rick_dickinson_dies/>. More recently, he was involved in the campaign to create the “ZX Spectrum Next” machine. Commenters have offered up some useful links: his Flickr gallery <https://www.flickr.com/photos/9574086(a)N02/albums> with some peeks at concept renders, and this item <https://www.youtube.com/watch?v=TAwHIcdidzI> from 2003 where he talks about his designs for Sinclair.

1 0

Microsoft Quarterly Report
by Lawrence D'Oliveiro 27 Apr '18

27 Apr '18

Just some items I found notable from here <https://arstechnica.com/gadgets/2018/04/even-windows-revenue-is-up-in-micro…>: * Office 365 is up, traditional MS Office is down. * Corporate sales of Windows are up, while consumer sales are down (“below the general decline of the PC market”). In each case, the former is growing faster than the latter is declining, so overall business is up.

1 0

Linux At The Leading Edge Of Enterprise-Level Storage
by Lawrence D'Oliveiro 26 Apr '18

26 Apr '18

First of all, some background (as I understand it): * “NVMe” is a standard for accessing storage (normally flash rather than hard drives) via a PCI-E bus <https://en.wikipedia.org/wiki/NVM_Express>. * “NVME-oF” (“NVMe over Fabrics”) (mentioned in the above article) is a further spec that allows one node to access storage attached to another node. Sounds like NBD, really <https://en.wikipedia.org/wiki/Network_block_device>, though the term “RDMA” (“Remote Direct Memory Access”) gets tossed around. So, this article <http://www.theregister.co.uk/2018/04/26/nvme_fabric_over_fibre_channel/> says things like NVME-oF “has to be implemented across network or fabric and, so far, Ethernet, with ROCE (RDMA over Converged Ethernet), is the favoured one”, though other lower-layer protocols also work. In particular, the writer is interviewing an industry guru about the prospects for FC-NVMe, which uses Fibre Channel as the transport. A couple of quotes caught my eye: Since the low-level driver isn't a part of the OS, like NVMe-oF, but rather supplied by the HBA vendor (Emulex or QLogic), the deployment for OSes outside the Linux model should be more agile... You must run a recent version of Linux; no other OSes have NVMe-oF drivers available (yet). In other words, NVME-oF is pretty much Linux-only at the moment. But it would be hardware-independent, which should mean you can mix and match storage from different vendors. Unlike FC-NVMe, where the “HBA vendor” needs to supply hardware-specific drivers. In other, other words, NVME-oF works only on Linux, but makes you “hardware-agile”, while FC-NVMe is hardware-specific but should (hopefully) be “OS-agile”. Which kind of “agility” will turn out to be more important, I wonder?

1 0

Drupal Warns of New Remote-Code Bug, the Second in Four Weeks
by Peter Reutemann 26 Apr '18

26 Apr '18

'For the second time in a month, websites that use the Drupal content management system are confronted with a stark choice: install a critical update or risk having your servers infected with ransomware or other nasties. From a report: Maintainers of the open-source CMS built on the PHP programming language released an update patching critical remote-code vulnerability on Wednesday. The bug, formally indexed as CVE-2018-7602, exists within multiple subsystems of Drupal 7.x and 8.x. Drupal maintainers didn't provide details on how the vulnerability can be exploited other than to say attacks work remotely. The maintainers rated the vulnerability "critical" and urged websites to patch it as soon as possible.' -- source: https://developers.slashdot.org/story/18/04/25/1956214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Was Our Census Data Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

According to this article <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12038826>, when we were filling out our census data online last month, it was actually going through the servers of a company called Incapsula, which was scanning the unencrypted data for malware. Since the company is based in the US, this naturally raises concerns about US Government access to the data of NZ residents and citizens. On the one hand, the article says “this is not a data breach”, but on the other hand Adding to the researchers' concerns, Stats NZ's digital key that is required to decrypt the data sent over TLS secured connections is now distributed across Incapsula's global network, Teague and Culnane said. "Our non-exhaustive search found that servers in Australia, the US, as well as New Zealand, all had the Stats NZ key," they added. Digital TLS keys are supposed to be protected and should only be kept on the servers that they relate to, the researchers said. If keys are leaked, attackers could use them to impersonate Stats NZ servers. and further down they use the phrase “clear security flaw”. Stats NZ insists the company is trusted and “Goverment-approved”. Given it’s also protecting the GCSB, I guess that is already very literally true.

1 0

Can Online Elections Ever Be Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Commentary <https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html> from Bruce Schneier: We can securely bank online, but can't securely vote online. If we could do away with anonymity -- if everyone could check that their vote was counted correctly -- then it would be easy to secure the vote. ... We can't, so we need to accept that our voting systems are insecure. We need an election system that is resilient to the threats. And for many parts of the system, that means paper.

1 0

meeting next week
by Peter Reutemann 25 Apr '18

25 Apr '18

Hi guys We have a WLUG meeting next Monday: "With the Cambridge Analytics scandal around (ab)using data obtained through Facebook, how about we have a look at (self-hosted) alternatives to the social network giant? Details on scandal: https://arstechnica.com/tech-policy/2018/03/facebooks-cambridge-analytica-s… Social media alternatives (eg diaspora, gnu social): https://alternativeto.net/software/facebook/" -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737141/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

What Private Browsing Mode Really Means
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Seems like a lot of people <http://www.theregister.co.uk/2018/04/24/private_web_browsing_study/> have the wrong idea about what is really “private” in private browsing mode. Many of them believe that * Activity while logged into an account (e.g. Google) will not be saved in that account’s history * Bookmarks made in private mode are not visible in standard mode * It prevents websites from tracking their location * It affords better protection against malware * It obscures their IP address. None of which is true. To its credit, when you open a private window in Firefox, it clearly states the things that are hidden and the things that are not.

1 0

Ubuntu 18.04?
by Peter Reutemann 24 Apr '18

24 Apr '18

Hi everyone Since April would be the usual month for an Ubuntu release, I was surprised that I hadn't heard anything so far. The following article mentions a release date of 26/4: https://fossbytes.com/ubuntu-18-04-bionic-beaver-release-date-features/ And according to the Ubuntu wiki, this still seems to be happening: https://wiki.ubuntu.com/BionicBeaver/ReleaseTaskSignup Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Accused of Showing 'Total Contempt' for Android Users' Privacy
by Peter Reutemann 23 Apr '18

23 Apr '18

'On the heels of a terse privacy debate, Google may have found another thing to worry about: its attempt to rethink the traditional texting system. From a report: Joe Westby is Amnesty International's Technology and Human Rights researcher. Recently, in response to Google's launch of a new messaging service called "Chat", Westby argued that Google, "shows total contempt for Android users' privacy." "With its baffling decision to launch a messaging service without end-to-end encryption, Google has shown utter contempt for the privacy of Android users and handed a precious gift to cybercriminals and government spies alike, allowing them easy access to the content of Android users' communications. Following the revelations by CIA whistleblower Edward Snowden, end-to-end encryption has become recognized as an essential safeguard for protecting people's privacy when using messaging apps. With this new Chat service, Google shows a staggering failure to respect the human rights of its customers," Westby contended. Westby continued, saying: "In the wake of the recent Facebook data scandal, Google's decision is not only dangerous but also out of step with current attitudes to data privacy."' -- source: https://tech.slashdot.org/story/18/04/23/1946251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Drupalgeddon2” touches off arms race to mass-exploit powerful Web servers
by Peter Reutemann 22 Apr '18

22 Apr '18

'Attackers are mass-exploiting a recently fixed vulnerability in the Drupal content management system that allows them to take complete control of powerful website servers, researchers from multiple security companies are warning. At least three different attack groups are exploiting "Drupalgeddon2," the name given to an extremely critical vulnerability Drupal maintainers patched in late March, researchers with Netlab 360 said Friday. Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers. Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.' -- source: https://arstechnica.com/information-technology/2018/04/drupalgeddon2-touche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers
by Peter Reutemann 19 Apr '18

19 Apr '18

'Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention." Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.' -- source: https://yro.slashdot.org/story/18/04/19/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: Is There a Good Alternative to Facebook?
by Peter Reutemann 18 Apr '18

18 Apr '18

'Long-time Slashdot reader Lauren Weinstein argues that fixing Facebook may be impossible because "Facebook's entire ecosystem is predicated on encouraging the manipulation of its users by third parties who posses the skills and financial resources to leverage Facebook's model. These are not aberrations at Facebook -- they are exactly how Facebook was designed to operate." Meanwhile one fund manager is already predicting that sooner or later every social media platform "is going to become MySpace," adding that "Nobody young uses Facebook," and that the backlash over Cambridge Analytica "quickens the demise." But Slashdot reader silvergeek asks, "is there a safe, secure, and ethical alternative?" to which tepples suggests "the so-called IndieWeb stack using the h-entry microformat." He also suggests Diaspora, with an anonymous Diaspora user adding that "My family uses a server I put up to trade photos and posts... Ultimately more people need to start hosting family servers to help us get off the cloud craze... NethServer is a pretty decent CentOS based option." Meanwhile Slashdot user Locke2005 shared a Washington Post profile of Mastodon, "a Twitter-like social network that has had a massive spike in sign-ups this week." Mastodon's code is open-source, meaning anybody can inspect its design. It's distributed, meaning that it doesn't run in some data center controlled by corporate executives but instead is run by its own users who set up independent servers. And its development costs are paid for by online donations, rather than through the marketing of users' personal information... Rooted in the idea that it doesn't benefit consumers to depend on centralized commercial platforms sucking up users' personal information, these entrepreneurs believe they can restore a bit of the magic from the Internet's earlier days -- back when everything was open and interoperable, not siloed and commercialized. The article also interviews the founders of Blockstack, a blockchain-based marketplace for apps where all user data remains local and encrypted. "There's no company in the middle that's hosting all the data," they tell the Post. "We're going back to the world where it's like the old-school Microsoft Word -- where your interactions are yours, they're local and nobody's tracking them." On Medium, Mastodon founder Eugene Rochko also acknowledges Scuttlebutt and Hubzilla, ending his post with a message to all social media users: "To make an impact, we must act." Lauren Weinstein believes Google has already created an alternative to Facebook's "sick ecosystem": Google Plus. "There are no ads on Google+. Nobody can buy their way into your feed or pay Google for priority. Google doesn't micromanage what you see. Google doesn't sell your personal information to any third parties..." And most importantly, "There's much less of an emphasis on hanging around with those high school nitwits whom you despised anyway, and much more a focus on meeting new persons from around the world for intelligent discussions... G+ posts more typically are about 'us' -- and tend to be far more interesting as a result." (Even Linus Torvalds is already reviewing gadgets there.) Wired has also compiled their own list of alternatives to every Facebook service. But what are Slashdot's readers doing for their social media fix? Leave your own thoughts and suggestions in the comments. Is there a good alternative to Facebook?' -- source: https://tech.slashdot.org/story/18/03/25/0039218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft’s bid to secure the Internet of Things: Custom Linux, custom chips, Azure
by Peter Reutemann 18 Apr '18

18 Apr '18

'The drive to connect everything to the Internet and build the Internet of Things has created a new security nightmare. Millions of devices with little to no active maintenance are now permanently online, enabling the creation of massive botnets as the devices go unpatched and unloved. Microsoft today announced its solution: Azure Sphere.' -- source: https://arstechnica.com/gadgets/2018/04/microsofts-bid-to-secure-the-intern… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When Two Secure Systems Make An Insecure Combination
by Lawrence D'Oliveiro 13 Apr '18

13 Apr '18

Just goes to show <https://www.schneier.com/blog/archives/2018/04/obscure_e-mail_.html> that two separate systems may be reasonably secure in their own right, but the interaction between them can create unexpected vulnerabilities.

1 0

Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
by Peter Reutemann 12 Apr '18

12 Apr '18

'Catalin Cimpanu, reporting for BleepingComputer: Cyber-espionage groups -- also referred to as advanced persistent threats (APTs) -- are using hacked routers more and more during their attacks, according to researchers at Kaspersky Lab. "It's not necessarily something new. Not something that just exploded," said Costin Raiu, director of Global Research and Analysis Team (GReAT) at Kaspersky Lab, in a webinar today. "We've seen a bunch of router attack throughout the years. A very good example is SYNful Knock, a malicious implant for Cisco [routers] that was discovered by FireEye but also threat actors such as Regin and CloudAtlas. Both APTs have been known to have and own proprietary router implants." But the number of APTs leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. For example, the Slingshot APT (believed to be a US Army JSOC operation targeting ISIS militants) has used hacked MikroTik routers to infect victims with malware.' -- source: https://tech.slashdot.org/story/18/04/12/1932248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Some Android Device Makers Are Lying About Security Patch Updates
by Peter Reutemann 12 Apr '18

12 Apr '18

'Security patches for smartphones are extremely important because many people store personal data on their devices. Lots of Android phones out there get regularly security patches, but according to a new report, some of them are lying about the patches that they've actually gotten. According to a study by Security Research Labs, some Android phones are missing patches that they claim to have. Wired explains that SRL tested 1,200 phones from more than a dozen phone makers for every Android security patch released in 2017. The devices tested include ones from Google, Samsung, Motorola, LG, HTC, Xiaomi, OnePlus, Nokia, TCL, and ZTE. The study found that outside of Google and its Pixel phones, well-known phone makers had devices that were missing patches that they claimed to have. "We found several vendors that didn't install a single patch but changed the patch date forward by several months," says SRL founder Karsten Nohl.' -- source: https://tech.slashdot.org/story/18/04/12/1851203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Releases Spectre v2 Microcode Updates for CPUs Going Back To 2011
by Peter Reutemann 11 Apr '18

11 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. Microsoft has released KB4093112, an update that also includes special OS-level patches for AMD users in regards to the Spectre v2 vulnerability. Similar OS-level updates have been released for Linux users earlier this year. Yesterday's microcode patches announcement is AMD keeping a promise it made to users in January, after the discovery of the Meltdown and Spectre (v1 and v2) vulnerabilities.' -- source: https://tech.slashdot.org/story/18/04/11/1826222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Biometric and App Logins Will Soon Be Pushed Across the Web
by Peter Reutemann 10 Apr '18

10 Apr '18

'Soon, it will be much easier to log into more websites using a hardware key plugged into your laptop, a dedicated app, or even the fingerprint scanner on your phone. Motherboard: On Tuesday, a spread of organizations and businesses, including top browser vendors such as Microsoft and Google, announced a new standards milestone that will streamline the process for web developers to add extra login methods to their sites, potentially keeping consumers' accounts and data more secure. "For users, this will be a natural transition. People everywhere are already using their fingers and faces to 'unlock' their mobile phones and PCs, so this will be natural to them -- and more convenient," Brett McDowell, executive director at the FIDO Alliance, one of the organizations involved in setting up the standard, told Motherboard in an email. "What they use today to 'unlock' will soon allow them to 'login' to all their favorite websites and a growing number of native apps that already includes Bank of America, PayPal, eBay and Aetna," he added. Passwords continue to be one of the weaker points in online security. A hacker may phish a target's password and log into their account, or take passwords from one data breach and use them to break into accounts on another site. The login standard, called Web Authentication (WebAuthn), will let potentially any website or online service use apps, security keys, or biometrics as a login method instead of a password, or use those alternative approaches as a second method of verification. The key here is making it easy and open for developers to use, and for it to work across all different brands of browsers. The functionality is already available in Mozilla's Firefox, and will be rolled out to Microsoft's Edge and Google Chrome in the new few months. Opera has committed to supporting WebAuthn as well.' -- source: https://yro.slashdot.org/story/18/04/10/1357241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux: Beep Command Can Be Used to Probe for the Presence of Sensitive Files
by Peter Reutemann 10 Apr '18

10 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: A vulnerability in the "beep" package that comes pre-installed with Debian and Ubuntu distros allows an attacker to probe for the presence of files on a computer, even those owned by root users, which are supposed to be secret and inaccessible. The vulnerability, tracked as CVE-2018-0492, has been fixed in recent versions of Debian and Ubuntu (Debian-based OS). At its core, the bug is a race condition in the beep utility that allows the OS to emit a "beep" sound whenever it is deemed necessary. Security researchers have discovered a race condition in the beep package that allows an attacker to elevate his code to root-level access.' -- source: https://linux.slashdot.org/story/18/04/10/142218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Computer Maker System76 To Move Manufacturing To the US
by Peter Reutemann 10 Apr '18

10 Apr '18

'Linux computer manufacturer System76 made its mark in part because of its commitment to open source principles and doing what it believes is right. Last year it released its homegrown Linux, Pop!_OS. In early March, System76 founder Carl Richell tweeted about the company's plans to locate its computer manufacturing factory in Denver, Colorado. By moving its manufacturing from China to the United States, System76 is offering more proof that it's not afraid to buck prevailing tech norms to do things "the System76 way." Carl Richell, founder and CEO of System76, says in a Twitter exchange that they anticipate shipping products from the factory by the end of the year.' -- source: https://linux.slashdot.org/story/18/04/10/1626202 Here's a link to Pop!_OS: https://system76.com/pop It's based on Ubuntu: https://system76.com/pop/tech Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Follows Chrome and Blocks the Loading of Most FTP Resources
by Peter Reutemann 10 Apr '18

10 Apr '18

'Mozilla says it will follow in the steps of Google Chrome and start blocking the loading of FTP subresources inside HTTP and HTTPS pages. >From a report: By FTP subresources, we refer to files loaded via the FTP protocol inside img, script, or iframe tags that have a src="ftp://". FTP links placed inside normal angle bracket links or typed directly in the browser's address bar will continue to work. The reasoning is that FTP is an insecure protocol that doesn't support modern encryption techniques and will inherently break many other built-in browser security and privacy features, such as HSTS, CSP, XSA, or others. Furthermore, many malware distribution campaigns often rely on compromising FTP servers and redirecting or downloading malware on users' computers via FTP subresources. Mozilla engineers say FTP subresource blocking will ship with Firefox 61, currently scheduled for release on June 26.' -- source: https://tech.slashdot.org/story/18/04/10/188244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Opposes Tying UEFI Secure Boot to Kernel Lockdown Mode
by Peter Reutemann 08 Apr '18

08 Apr '18

'The kernel lockdown feature further restricts access to the kernel by user-space with what can be accessed or modified... Pairing that with UEFI SecureBoot unconditionally is meeting some resistance by Linus Torvalds. The goal of kernel lockdown, which Linus Torvalds doesn't have a problem with at all, comes down to "prevent both direct and indirect access to a running kernel image, attempting to protect against unauthorised modification of the kernel image and to prevent access to security and cryptographic data located in kernel memory, whilst still permitting driver modules to be loaded." But what has the Linux kernel creator upset with are developers trying to pair this unconditionally with UEFI SecureBoot. Linus describes Secure Boot as being "pushed in your face by people with an agenda." But his real problem is that Secure Boot would then imply Kernel Lockdown mode... "Tying these things magically together IS A BAD IDEA."' -- source: https://linux.slashdot.org/story/18/04/07/2159245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Programmer Unveils OpenGL Bindings for Bash
by Peter Reutemann 08 Apr '18

08 Apr '18

'Compiled languages have long provided access to the OpenGL API, and even most scripting languages have had OpenGL bindings for a decade or more. But, one significant language missing from the list is our old friend/nemesis Bash. But worry no longer! Now you can create your dazzling 3D visuals right from the comfort of your command line! "You'll need a system with both Bash and OpenGL support to experience it firsthand," explains software engineer Michael Conrad, who created the first version 13 years ago as "the sixth in a series of 'Abuse of Technology' projects," after "having my technical sensibilities offended that someone had written a real-time video game in Perl. "Back then, my primary language was C++, and I was studying OpenGL for video game purposes. I declared to my friends that the only thing worse would be if it had been 3D and written in Bash. Having said the idea out loud, it kept prodding me, and I eventually decided to give it a try to one-up the 'awfulness'..."' -- source: https://developers.slashdot.org/story/18/04/07/0035203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel drops plans to develop Spectre microcode for ancient chips
by Peter Reutemann 04 Apr '18

04 Apr '18

'Intel has scaled back its plans to produce microcode updates for some of its older processors to address the "Spectre variant 2" attack. Core 2 processors are no longer scheduled to receive updates, and, while some first generation Core products have microcode updates available already, others have had their update cancelled.' -- source: https://arstechnica.com/gadgets/2018/04/intel-drops-plans-to-develop-spectr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 28 Beta Linux Distro is Finally Here
by Peter Reutemann 03 Apr '18

03 Apr '18

'Today, version 28 of the Fedora finally achieves beta status. After a short delay -- it was scheduled to be available a week earlier -- the distro is back on track, and looking better than ever. As is typical now, there are three versions of the operating system -- Atomic Host, Server, and Workstation. While all three have their places, normal desktop computer users will want to focus on Workstation. While there are plenty of new features (and bugs), the most exciting aspect of Fedora 28 Workstation is the inclusion of the GNOME 3.28 desktop environment.' -- source: https://linux.slashdot.org/story/18/04/03/1846233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel To Lose A Few Architectures
by Lawrence D'Oliveiro 03 Apr '18

03 Apr '18

Looking at the source code <https://elixir.bootlin.com/linux/latest/source/> for the latest (4.16) Linux kernel, I see support for 31 different major processor architectures currently <https://elixir.bootlin.com/linux/latest/source/arch>. However, the next, 4.17 kernel is due to drop the ability to run on 8 of them <http://www.theregister.co.uk/2018/04/03/linux_kernel_4_16_released/>, due to the fact that nobody is using them any more--or at least, nobody with an interest in implementing new kernels <http://lkml.iu.edu/hypermail/linux/kernel/1804.0/00306.html>. Interesting to read Arnd Bergmann’s observations on what these dead-end architectures have in common: In the end, it seems that while the eight architectures are extremely different, they all suffered the same fate: There was one company in charge of an SoC line, a CPU microarchitecture and a software ecosystem, which was more costly than licensing newer off-the-shelf CPU cores from a third party (typically ARM, MIPS, or RISC-V). It seems that all the SoC product lines are still around, but have not used the custom CPU architectures for several years at this point. In contrast, CPU instruction sets that remain popular and have actively maintained kernel ports tend to all be used across multiple licensees.

1 0

Adobe Is Helping Some 60 Companies Track People Across Devices
by Peter Reutemann 31 Mar '18

31 Mar '18

'Neowin reports of Adobe's recent announcement of its new Marketing Cloud Device Co-op initiative: The announcement of the new solution for tracking customers across devices was made at the Adobe Summit this week in Las Vegas to a digital marketing conference. According to an Adobe blog post released earlier this month citing Forrester, consumers are increasingly accessing multiple devices before making a purchase decision -- an average of 5.5 connected devices per person. This behavior creates a challenge for retailers, who cannot easily target people in their marketing campaigns, ultimately depending on Facebook or Google to track people instead of devices. Both Facebook and Google are able to do this job because of the massive amount of users logged into their ecosystems regularly, so most retailers have been opting to use those platforms as a way to reach potential customers. But Adobe's approach is to provide a platform agnostic solution acting as a glue between the world's biggest brands' own data management platforms. In order for Device Co-op to work, each company that has joined the initiative will provide Adobe with "cryptographically hashed login IDs" and HTTP header data, which Adobe claims will completely hide the customer's identity. This data will be used to create groups of devices used by the same person or household, which will then be made available to all the members of the initiative so they can target people on different devices, instead of creating one customer profile per device, as can be seen from the example given in the image above. Until now, some 60 companies have joined the Adobe initiative, including brands such as Subway, Sprint, NFL, Lenovo, Intel, Barnes & Noble, and Subaru. Also, preliminary measurements made by Adobe indicate that Device Co-op could link up to 1.2 billion devices worldwide, based on the amount of accesses seen by current members. But it is important to note that the initiative is currently collecting data of U.S. and Canada users only. Adobe is claiming the initiative will not disclose a user's identity to its members, including any personal data, but, given the recent Facebook and Cambridge Analytica scandal, many will be skeptical of those claims. Thankfully, Adobe is allowing users to completely opt out all of their devices from the services via this website.' -- source: https://yro.slashdot.org/story/18/03/31/0059259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Prestigious Free Software Award Goes to Karen Sandler
by Peter Reutemann 31 Mar '18

31 Mar '18

'Each year the Free Software award goes to someone making "a great contribution to the progress and development of free software, through activities that accord with the spirit of free software." This year's winner is a former executive of the GNOME Foundation, Karen Sandler. Jeremy Allison - Sam, Slashdot reader #8,157, brought this announcement. Richard Stallman, President of the FSF, presented Sandler with the award during a ceremony. Stallman highlighted Sandler's dedication to software freedom. Stallman told the crowd that Sandler's "vivid warning about backdoored nonfree software in implanted medical devices has brought the issue home to people who never wrote a line of code. Her efforts, usually not in the public eye, to provide pro bono legal advice to free software organizations and [with Software Freedom Conservancy] to organize infrastructure for free software projects and copyleft defense, have been equally helpful." In her acceptance speech, Sandler spoke about her dedication to free software as a patient, advocate and professional. "Coming to terms with a dangerous heart condition should never have cost me fundamental control over the technology that my life relies on", said Sandler... "This issue is personal not just for me but for anyone who relies on software, and today that means every single person." ' -- source: https://news.slashdot.org/story/18/03/31/0322217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Experts See Chromebooks as a Closed Ecosystem That Improves Security
by Peter Reutemann 31 Mar '18

31 Mar '18

'The founder of Rendition Security believes his daughter "is more safe on a Chromebook than a Windows laptop," and he's not the only one. CNET's staff reporter argues that Google's push for simplicity, speed, and security "ended up playing off each other." mspohr shared this article: Heading to my first security conference last year, I expected to see a tricked-out laptop running on a virtual machine with a private network and security USB keys sticking out -- perhaps something out of a scene from "Mr. Robot." That's not what I got. Everywhere I went I'd see small groups of people carrying Chromebooks, and they'd tell me that when heading into unknown territory it was their travel device... "If you want prehardened security, then Chromebooks are it," said Kenneth White, director of the Open Crypto Audit Project. "Not because they're Google, but because Chrome OS was developed for years and it explicitly had web security as a core design principle...." Drewry and Liu focused on four key features for the Chromebook that have been available ever since the first iteration in 2010: sandboxing, verified boots, power washing and quick updates. These provided security features that made it much harder for malware to pass through, while providing a quick fix-it button if it ever did. That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system. The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops... "Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."' -- source: https://tech.slashdot.org/story/18/03/31/0443257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC V Processor Gets Support From Google, Samsung, Qualcomm, and Tesla
by Peter Reutemann 31 Mar '18

31 Mar '18

'Google, Qualcomm, and Samsung "are among 80 tech companies joining forces to develop a new open-source chip design for new technologies like self-driving vehicles," writes Seeking Alpha, citing a (pay-walled) report on The Information. "Western Digital and Nvidia also plan to use the new chip design for some of their products," while Tesla "has joined the RISC-V Foundation and is considering using the tech in its new chip efforts." MIT Technology Review adds that while Arm had hoped to bring their low-power/high performance processors to AI and self-driving cars, "The company that masterminded the processor inside your smartphone may find that a set of free-to-use alternative designs erode some of its future success."' -- source: https://news.slashdot.org/story/18/03/31/0622248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure
by Peter Reutemann 30 Mar '18

30 Mar '18

'Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory' -- source: https://tech.slashdot.org/story/18/03/28/2010240 Time to move to another operating system... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Yet Another Microsoft Windows Reorg
by Lawrence D'Oliveiro 30 Mar '18

30 Mar '18

From <https://arstechnica.com/gadgets/2018/03/windows-leader-terry-myerson-out-as…>: The Windows platform has many masters. It is important for both Microsoft's client and server businesses, of course, but it's also fundamental to the Azure platform. While it has become increasingly unified, responsibility for its development (and financial reporting) has often been split between divisions. Conway’s Law says that any piece of software reflects the organizational structure that produced it. The fact that there is no single mind in charge of the overall product will inevitably manifest itself in discontinuities in the characteristics of that product. Yes, I know: scratch that future tense. It already has.

1 0

An Open Source, Royalty-Free AV1 Codec Has Been Released
by Peter Reutemann 28 Mar '18

28 Mar '18

'After three years in development the Alliance for Open Media is releasing the royalty-free AOMedia Video Codec 1.0 (AV1) specification. The AV1 codec promises an average of 30 percent greater compression over competing codecs according to independent member tests. The release of AV1 includes: * Bitstream specification to enable the next-generation of silicon * Unoptimized, experimental software decoder and encoder to create and consume the bitstream * Reference streams for product validation * Binding specifications to allow content creation and streaming tools for user-generated and commercial vid' -- source: https://news.slashdot.org/story/18/03/28/1610215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Many VPN Providers Leak Customer's IP Address via WebRTC Bug
by Peter Reutemann 28 Mar '18

28 Mar '18

'Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.' -- source: https://yro.slashdot.org/story/18/03/28/1813213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002]
by Peter Reutemann 28 Mar '18

28 Mar '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <...> Date: Thu, Mar 29, 2018 at 9:20 AM Subject: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002] To: nzlug(a)lists.nzoss.org.nz I know there's plenty of Drupal out there, and I don't usually forward these around, but in case you havn't heard... The Drupal team took the unusual step of warning that this was coming several days ago, that helps set the tone for the severity of this. I've taken the unusual step of disabling my own Drupal based website until I can attend to its update. Mark. ---------------------------- Original Message ---------------------------- Subject: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 From: security-news(a)drupal.org Date: Thu, March 29, 2018 8:21 am To: security-news(a)drupal.org -------------------------------------------------------------------------- View online: https://www.drupal.org/sa-core-2018-002 Project:Â Drupal core [1] Date:Â 2018-March-28 Security risk:Â *Highly critical* 21âˆ•25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability:Â Remote Code Execution Description:Â CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution:Â Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By:Â * Jasper Mattsson [14] Fixed By:Â * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett _______________________________________________ Security-news mailing list Security-news(a)drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromebooks In Schools?
by Lawrence D'Oliveiro 28 Mar '18

28 Mar '18

In among this article about Apple’s new push to get IPads used in schools <https://arstechnica.com/gadgets/2018/03/analysis-new-ipads-will-help-apple-…> is the interesting information that Google Chromebooks are heavily used throughout the US school system: Google offers G Suite for Education for free, sans some features. Adding the full suite of enterprise features costs only $4 per user per month, compared to $25 per user per month for other kinds of organizations. Papers are typed in Google Docs. Presentations are done using Google Presentations. Each student has a Google email account assigned through the district. Homework is handed out and done entirely on Chromebooks in many classes. In so many words, Google has spread its tentacles throughout the entire school district at every level ... Are Chromebooks used in schools here? I noticed a couple of units on sale in OfficeMax when I dropped in there a few weeks ago. I don’t recall seeing them anywhere else in town.

1 0

Bring your own Linux to Windows with new open source tool
by Peter Reutemann 27 Mar '18

27 Mar '18

'After starting with Ubuntu, Microsoft has added a number of Linux distributions to its Windows Subsystem for Linux (WSL) Linux runtime environment. A Windows machine can simultaneously offer an Ubuntu, SUSE, Debian, and Kali "personality," providing users with a choice of the different distributions' preferences and package management. But if your distribution isn't yet available or if you want a Linux installation that's customized just the way you like it, there's now an answer: Microsoft has an open source tool for building your own Linux package. The tool is aimed at two groups: distribution owners (so they can produce a bundle to ship through the Microsoft Store) and developers (so they can create custom distributions and sideload them onto their development systems). Microsoft's tool provides the basic glue between Windows and the Linux distribution. It handles telling the system about the distribution and performing initial setup such as user creation, and it can be customized to—for example—print a message of the day when the distribution is started.' -- source: https://arstechnica.com/gadgets/2018/03/microsofts-new-open-source-tool-let… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

As predicted, more speculative execution processor attacks are discovered
by Peter Reutemann 26 Mar '18

26 Mar '18

'Researchers from the College of William and Mary, Carnegie Mellon, the University of California Riverside, and Binghamton University have described a security attack that uses the speculative execution features of modern processors to leak sensitive information and undermine the security boundaries that operating systems and software erect to protect important data. That probably sounds familiar. The Spectre attacks, published earlier this year, take advantage of the speculative execution features of modern processors to leak sensitive information. The new attack, named BranchScope by the researchers, shares some similarity with variant 2 of the Spectre attack, as both BranchScope and Spectre 2 take advantage of the behavior of the processor's branch predictor.' -- source: https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google starts blocking “uncertified” Android devices from logging in
by Peter Reutemann 26 Mar '18

26 Mar '18

'Google is apparently stepping up its efforts to crack down on illicit distribution of Google's Android apps. According to XDA Developers, Google logins on unlicensed devices will now fail at setup, and a warning message will pop up stating "Device is not certified by Google." This warning screen has appeared on and off in the past during a test phase, but XDA (and user reports) indicate it is now headed for a wider rollout.' -- source: https://arstechnica.com/gadgets/2018/03/google-starts-blocking-uncertified-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kritia 4.0 Released, Conversation With The Team
by Lawrence D'Oliveiro 26 Mar '18

26 Mar '18

Another high-quality article from Alexandre Prokoudine <http://libregraphicsworld.org/blog/entry/krita-4-0-interview> about the just-released major revamp of Krita. It now straddles both “paint” and “draw” worlds, with Inkscape-styled SVG-based vector functionality added to the older paint functions. Oh, and it does animations as well. The item links to the “official” release video, but another informative one worth checking out is this <https://www.youtube.com/watch?v=OXvHHJUyBDg>.

2 3

Shodan Search Exposes Thousands of Servers Hosting Passwords and Keys
by Peter Reutemann 25 Mar '18

25 Mar '18

'Thousands of etcd servers "are spitting sensitive passwords and encrypted keys," reports Fossbytes: Security researcher Giovanni Collazo was able to harvest 8781 passwords, 650 AWS access keys, 23 secret keys, and 8 private keys. First, he ran a query on the hacker search engine Shodan that returned around 2300 servers running etcd database. Then, he ran a simple script that gave him the login credentials stored on these servers which can be used to gain access to CMSs, MySQL, and PostgreSQL databases, etc. etcd is a database used by computing clusters to store and exchange passwords and configuration settings between servers and applications over the network. With the default settings, its programming interface can return administrative login credentials without any authentication upfront... All of the data he harvested from around 1500 servers is around 750MB in size... Collazo advises that anyone maintaining etcd servers should enable authentication, set up a firewall, and take other security measures. Another security research independently verified the results, and reported that one MySQL database had the root password "1234".' -- source: https://developers.slashdot.org/story/18/03/24/1943239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Scraped Call, Text Message Data For Years From Android Phones
by Peter Reutemann 25 Mar '18

25 Mar '18

'This past week, a New Zealand man was looking through the data Facebook had collected from him in an archive he had pulled down from the social networking site. While scanning the information Facebook had stored about his contacts, Dylan McKay discovered something distressing: Facebook also had about two years worth of phone call metadata from his Android phone, including names, phone numbers, and the length of each call made or received. This experience has been shared by a number of other Facebook users who spoke with Ars, as well as independently by us -- my own Facebook data archive, I found, contained call-log data for a certain Android device I used in 2015 and 2016, along with SMS and MMS message metadata. In response to an email inquiry about this data gathering by Ars, a Facebook spokesperson replied, "The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it's a widely used practice to begin by uploading your phone contacts." The spokesperson pointed out that contact uploading is optional and installation of the application explicitly requests permission to access contacts. And users can delete contact data from their profiles using a tool accessible via Web browser. If you granted permission to read contacts during Facebook's installation on Android a few versions ago -- specifically before Android 4.1 (Jelly Bean) -- that permission also granted Facebook access to call and message logs by default. The permission structure was changed in the Android API in version 16. But Android applications could bypass this change if they were written to earlier versions of the API, so Facebook API could continue to gain access to call and SMS data by specifying an earlier Android SDK version. Google deprecated version 4.0 of the Android API in October 2017 -- the point at which the latest call metadata in Facebook user's data was found. Apple iOS has never allowed silent access to call data. You are able to have Facebook delete the data it collects from you, "but it's not clear if this deletes just contacts or if it also purges call and SMS metadata," reports Ars. Generally speaking, if you're concerned about privacy, you shouldn't share your contacts and call-log data with any mobile application.' -- source: https://yro.slashdot.org/story/18/03/25/056246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 3 Model B+ Benchmarks Show Significantly Improved Performance
by Peter Reutemann 25 Mar '18

25 Mar '18

'Pi Day was marked this year by the launch of the Raspberry Pi 3 Model B+ as the next evolution to this $35 ARM single-board computer. Phoronix has now put out Raspberry Pi 3 B+ benchmarks showing that the Ethernet performance is indeed much faster now but still doesn't stack up to other high performance boards, the SoC temperature is noticeably lower than the very warm Raspberry Pi 3, and the overall performance is a nice upgrade while retaining the same price point as its predecessors. Follow up tests looking at the Wi-Fi performance also show the new 802.11ac dual-band wireless to be much faster as well.' -- source: https://hardware.slashdot.org/story/18/03/25/0556258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate-Speech Laws In Europe
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

<https://www.techdirt.com/articles/20180321/17581339475/spanish-hate-anti-te…>: People are being arrested and charged with speech having nothing to with promoting hate or terrorism. ... It's gotten so bad Amnesty International -- an entity that usually spends its time decrying the acts of dictators and brutal authoritarians -- has felt compelled to speak up about Spain's terrible speech laws. ... The report also notes several other European countries are also beginning to curtail the rights of their citizens in their quest to target hate speech and international terrorism. Germany's hate speech law roll out has been an unmitigated disaster and other countries like France and Italy seem all too willing to join Spain and Germany in killing satire, parody, and content they just don't agree with. All of this is being done under the heading of "public safety," but in reality, the public is no safer and will develop an unhealthy fear of their own governments.

1 0

TLS 1.3 Has Been Approved
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

The latest version of TLS (the official name for what used to be called “SSL”, i.e. the protocol that your browser uses for URLs beginning “https://”) is now an official IETF standard <http://www.theregister.co.uk/2018/03/23/tls_1_3_approved_ietf/>. This should not only make the setup of secure connections quicker, but also harder to crack. ... banks and businesses complained that, thanks to the way the new protocol does security, they will be cut off from being able to inspect and analyze TLS 1.3 encrypted traffic flowing through their networks, and so potentially be at greater risk from attack. Unfortunately, that self-same ability to decrypt secure traffic on your own network can also be potentially used by third parties to grab and decrypt communications. An effort to effectively insert a backdoor into the protocol was met with disdain and some anger by internet engineers, many of whom pointed out that it will still be possible to introduce middleware to monitor and analyze internal network traffic. Note the key phrase “forward secrecy”. This means that, even if your private key should become compromised down the track, this will still not help attackers decrypt any records they may have kept of your secure communications prior to that. And yes, you can expect the usual suspects to be unhappy about the introduction of such a feature.

1 0

Firefox In 2018: We'll Tackle Bad Ads, Breach Alerts, Autoplay Video, Says Mozilla
by Peter Reutemann 24 Mar '18

24 Mar '18

'Firefox maker Mozilla has outlined its 2018 roadmap to make the web less intrusive and safer for users. First up, Mozilla says it will proceed and implement last year's experiment with a breach alerts service, which will warn users when their credentials have been leaked or stolen in a data breach. Mozilla aims to roll out the service around October. Breach Alerts is based on security consultant Troy Hunt's data breach site Have I Been Pwned. Firefox will also implement a similar block on autoplay video to the one Chrome 66 will introduce next month, and that Safari already has. However, Dotzler says Firefox's implementation will "provide users with a way to block video auto-play that doesn't break websites". This feature is set to arrive in Firefox 62, which is scheduled for release in May. After Firefox 62 the browser will gain an optional Chrome-like ad filter and several privacy-enhancing features similar to those that Apple's WebKit developers have been working on for Safari's Intelligent Tracking Prevention. By the third quarter of 2018, Firefox should also be blocking ad-retargeting through cross-domain tracking. It's also going to move all key privacy controls into a single location in the browser, and offer more "fine-grained" tracking protection. Dotzler says Mozilla is in the "early stages" of determining what types of ads Firefox should block by default. Also on the roadmap is a feature that arrived in Firefox 59, released earlier this month. A new Global Permissions feature will help users avoid having to deny every site that requests permission for location, camera, microphone and notifications. Beyond security and privacy, Mozilla plans to build on speed-focused Quantum improvements that came in Firefox 57 with smoother page rendering.' -- source: https://news.slashdot.org/story/18/03/23/2110244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Server 2019 Will Feature Linux and Kubernetes Support
by Peter Reutemann 22 Mar '18

22 Mar '18

'Microsoft announced this week that it will launch the next major release of Windows Server later this year with better support for hybrid workloads, Linux workloads, and hyper-converged infrastructure. >From a report: This release will succeed Windows Server 2016, which was made generally available in October 2016. While Microsoft moved to twice-yearly updates for Windows Server starting last year, the company bundles those changes into a long-term servicing channel once every two or three years for administrators who prefer less frequent releases. Those companies that haven't moved over to the semi-annual channel will get their first taste of Windows Server's Linux and Kubernetes support, which are currently in beta.' -- source: https://tech.slashdot.org/story/18/03/22/1647243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVidia Titan V GPUs Giving Wrong Answers To Scientific Simulations
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

<http://www.theregister.co.uk/2018/03/21/nvidia_titan_v_reproducibility/>: Nvidia’s flagship Titan V graphics cards may have hardware gremlins causing them to spit out different answers to repeated complex calculations under certain conditions, according to computer scientists. ... Gamers and casual users will not notice any errors or issues, however folks running scientific software may encounter the glitches.

2 1

Artificial Intelligence And The Future of Online Content Moderation
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

Report on a workshop on the use of artificial intelligence in governing communication online <https://freedom-to-tinker.com/2018/03/21/artificial-intelligence-and-the-fu…>: Over the course of the day, [the writer] learned many things about automated filtering that [he] hadn’t previously thought about. • Regulators and platforms are under tremendous pressure to act, based on the assumption that the technical problems are easy. • Takedown requests are a frequent instrument for censorship. • The larger platforms share content hashes of unwanted content, but the database and process are opaque. • Different countries have very different definitions of unlawful content. • Norms and speech evolve over time, often rapidly. In other words, it seems to me that, whether they are doing it deliberately or not, the regulators are pushing more and more power into the hands of the social-media platforms.

1 0

Mozilla Launches a Petition Asking Facebook To Do More For User Privacy
by Peter Reutemann 21 Mar '18

21 Mar '18

'After it was revealed that the personal data of 50 million Facebook users was shared without consent, Mozilla is calling on the social network to ensure that user privacy is protected by default, particularly when it comes to apps. Ashley Boyd, Mozilla's vice president of advocacy, says that billions of Facebook users are unknowingly at risk of having their data passed on to third parties. He says: "If you play games, read news or take quizzes on Facebook, chances are you are doing those activities through third-party apps and not through Facebook itself. The default permissions that Facebook gives to those third parties currently include data from your education and work, current city and posts on your timeline."' -- source: https://tech.slashdot.org/story/18/03/21/182253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD promises firmware fixes for security processor bugs
by Peter Reutemann 20 Mar '18

20 Mar '18

'AMD has responded to the reports last week of a range of security flaws affecting its Platform Security Processor (PSP) and chipset. The company acknowledges the bugs and says that, in coming weeks, it will have new firmware available to resolve the PSP bugs. These firmware fixes will also mitigate the chipset bugs.' -- source: https://arstechnica.com/gadgets/2018/03/amd-promises-firmware-fixes-for-sec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Unveils the 'World's Smallest Computer'
by Peter Reutemann 19 Mar '18

19 Mar '18

'On the first day of IBM Think 2018, the company's flagship conference, IBM has unveiled what it claims is the world's smallest computer. It's smaller than a grain of salt and features the computer power of the x86 chip from 1990. Mashable first spotted this gem: The computer will cost less than ten cents to manufacture, and will also pack "several hundred thousand transistors," according to the company. These will allow it to "monitor, analyze, communicate, and even act on data." It works with blockchain. Specifically, this computer will be a data source for blockchain applications. It's intended to help track the shipment of goods and detect theft, fraud, and non-compliance. It can also do basic AI tasks, such as sorting the data it's given. According to IBM, this is only the beginning. "Within the next five years, cryptographic anchors -- such as ink dots or tiny computers smaller than a grain of salt -- will be embedded in everyday objects and devices," says IBM head of research Arvind Krishna. If he's correct, we'll see way more of these tiny systems in objects and devices in the years to come. It's not clear yet when this thing will be released -- IBM researchers are currently testing its first prototype. ' -- source: https://hardware.slashdot.org/story/18/03/19/210245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19 'Tara' Cinnamon Will Be Faster
by Peter Reutemann 19 Mar '18

19 Mar '18

'Mint developers say they feel the app-launching time on the Linux distro seemed slow when using the Cinnamon desktop environment. So, they are working on fixing it. BetaNews reports: Windows build time was four times slower with Cinnamon compared to Metacity, while recovery time was nearly four times slower too. So yes, app-launching on Cinnamon -- as of today -- is slow comparatively. The big benefit to pinpointing a problem, however, is that it is the first step in solving it. And so, Linux Mint 19 Cinnamon will be faster as a result. "We developed a little script and a method to measure how long it took to flood the desktop environment with the creation of 200 windows. We could then measure the time reported by the script to build these 200 windows, and the time it actually took the desktop environment to recover from it and have these windows placed/mapped correctly and ready to be interacted with. Both measures were significantly higher in Cinnamon than in other desktops," says The Linux Mint Team.' -- source: https://linux.slashdot.org/story/18/03/19/1648259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Joins Group Working To 'Cure' Open-Source Licensing Issues
by Peter Reutemann 19 Mar '18

19 Mar '18

'Microsoft is joining Red Hat, Facebook, Google and IBM in committing to extending right to "cure" open source licensing noncompliance before taking legal measures. From a report: On March 19, officials from Microsoft -- along with CA Technologies, Cisco, HPE, SAP and SUSE -- said they'd work with open together with the already-committed vendors to provide more "predictability" for users of open source software. "The large ecosystems of projects using the GPLv2 and LGPLv2.x licenses will benefit from adoption of this more balanced approach to termination derived from GPLv3," explained Red Hat in a press release announcing the new license-compliance partners. The companies which have agreed to adopt the "Common Cure Rights Commitment" said before they file or continue to prosecute those accused of violating covered licenses, they will allow for users to cure and reinstate their licenses.' -- source: https://news.slashdot.org/story/18/03/19/1720228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When China Hoards Its Hackers Everyone Loses
by Peter Reutemann 18 Mar '18

18 Mar '18

'For over a decade Pwn2Own -- happening this week -- has brought together security talent from across the globe in a friendly hacking competition that is a cornerstone of research and advancement on par with Black Hat and Def Con. China's hackers routinely win, sweeping the board -- notably, the Tencent and Keen teams. Pwn2Own is good-natured, and all in the name of researchers finding big bugs, nabbing great bounties and drawing attention to security holes and zero-days that need to be fixed. But this year, according to Pwn2Own manager Brian Gorenc, China is no longer allowing its researchers to compete. Prior to the start of Pwn2Own this week, Gorenc told press "There have been regulatory changes in some countries that no longer allow participation in global exploit contests, such as Pwn2Own and Capture the Flag competitions." One thing's for certain: yearly champions Tencent's Keen Labs and Qihoo 360's 360Vulcan team are nowhere to be found and Trend Micro, the conference organizer, has confirmed to Engadget that there are no Chinese competitors in this year's competition. [...] It's a worrying development in the direction of isolationism and away from the benefits of competition in the spirit of improving security for all. It comes at a time when relations between the US and China strain under the weight of Huawei security concerns, which are not at all new, but are certainly coming to a head as American companies sever business ties with the firm.' -- source: https://it.slashdot.org/story/18/03/18/2042207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says
by Peter Reutemann 18 Mar '18

18 Mar '18

'For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."' -- source: https://it.slashdot.org/story/18/03/18/1930240 cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Community Considers a Crowd-Sourced Promo Video
by Peter Reutemann 17 Mar '18

17 Mar '18

'Slashdot reader Beacon11 writes that "Alan Pope, a community advocate for Ubuntu, has requested comments and ideas regarding the creation of a crowd-sourced promo video that, in 30 seconds, conveys that Ubuntu is for everyone." Alan Pope writes: So for example you might see a woman on a train typing an article, a guy in an office creating a presentation, a kid on the sofa playing a game with a controller on their TV, someone watching a film, someone developing code, kids playing with robots, a farmer planning animal feeding. You get the idea... So I'd really like to do this as a shared community project, with video clips submitted by Ubuntu users from around the world, perhaps even taking in a landmark or two here and there. I'd expect the video to represent the diversity of users, and variety of activities people are able to do with Ubuntu. Though they're currently just discussing its feasibility, Alan writes that "I think if we work together we could make something amazing."' -- source: https://news.slashdot.org/story/18/03/17/0524228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal "Reader's Choice Awards"
by Peter Reutemann 17 Mar '18

17 Mar '18

'The newly-relaunched Linux Journal is conducting its annual "Reader's Choice Awards," and this month announced the winners for Best Text Editor, Best Laptop, and Best Domain Registrar. Vim was chosen as the best editor by 35% of respondents, handily beating GNU Emacs (19%) Sublime Text (10%) and Atom (8%). Readers' Choice winner Vim is an extremely powerful editor with a user interface based on Bill Joy's 40-plus-year-old vi, but with many improved-upon features including extensive customization with key mappings and plugins. Linux Journal reader David Harrison points out another great thing about Vim "is that it's basically everywhere. It's available on every major platform." For best laptop their readers picked Lenovo (32%), followed by Dell (25%) and System76 (11%). The ThinkPad began life at IBM, but in 2005, it was purchased by Lenovo along with the rest of IBM's PC business. Lenovo evolved the line, and today the company is well known as a geek favorite. Lenovo's ThinkPads are quiet, fast and arguably have one of the best keyboards (fighting words!). Linux Journal readers say Lenovo's Linux support is excellent, leaving many to ponder why the company doesn't ship laptops with Linux installed. In February readers also voted on the best web browser, choosing Firefox (57%) over Chrome (17%) and Chromium (7%). And they also voted on the best Linux distribution, ultimately selecting Debian (33%), open SUSE (12%), and Fedora (11%).' -- source: https://linux.slashdot.org/story/18/03/17/0438256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel: Our Next Chips Won’t Have Data Leak Flaws We Told You Totally Not To Worry About
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<http://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/>: In public statements and private briefings to reporters and analysts, it has shifted from claiming these bugs are overblown and not a problem, to admitting they are a problem but are easy to mitigate, to confessing they are not so easy to mitigate but at least there are no ill effects, to conceding there are some ill effects but it's nothing to worry about, to finally confirming: the issues are so embarrassing, we've redesigned our processors to address the design blunders.

1 0

How A Norwegian Comment Section Turned Chaos Into Order—With A Simple Quiz
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turn…>: "It was a basic idea," NRKbeta developer Ståle Grut told a South By Southwest crowd on Tuesday. "Readers had to prove they read a story before they were able to comment on it."

1 0

New Raspberry Pi - Model 3B+
by Ian Stewart 14 Mar '18

14 Mar '18

A new model of Raspberry Pi single board computer was appropriately released yesterday (...being the 14th day of the 3rd month of the year, or Pi Day 3.14) Its the latest revision of their third-generation single-board computers. This model 3B+ is an enhanced version of the 3B, which was released two years ago. Some details<https://www.raspberrypi.org/blog/raspberry-pi-3-model-bplus-sale-now-35/>, the technical data sheet<http://www.farnell.com/datasheets/2582162.pdf?_ga=2.61358060.1158065867.152…>, and a 7 minute youtube clip<https://www.youtube.com/watch?v=zQZxdiz2UAs> Raspberry Pi 3 Model B+ is now on sale for US$35, and features: A 1.4GHz 64-bit quad-core ARM Cortex-A53 CPU Dual-band 802.11ac wireless LAN and Bluetooth 4.2 Faster Ethernet (Gigabit Ethernet over USB 2.0) Power-over-Ethernet support (with separate PoE HAT) Improved PXE network and USB mass-storage booting Improved thermal management A Power-over-Ethernet (PoE<https://en.wikipedia.org/wiki/Power_over_Ethernet>) Hat is to be released shortly. The R-Pi will default to attempting to do a PXE boot over Ethernet. Thus the R-Pi may be positioned and operated at quite a long physical distance from what is its supply of power and from where it loads its operating system. The NZ on-line outlet of Element14<http://nz.element14.com/raspberry-pi/2773729/raspberry-pi-3-model-b/dp/2842…> have the R-Pi 3B+ available at NZ $51.52 + $7.73 GST = $59.25 What is a little strange is the R-Pi Zero-W, released over a year ago, is still not available in NZ from Element14. cheers, Ian.

2 2

GNOME 3.28 'Chongqing' Linux Is Here
by Peter Reutemann 14 Mar '18

14 Mar '18

'GNOME 3.28 is the latest version of GNOME 3, and is the result of 6 months' hard work by the GNOME community. It contains several major new features, as well as many smaller improvements and bug fixes. In total, the release incorporates 24105 changes, made by approximately 778 contributors. The Project explains, "GNOME 3.28 comes with more beautiful things! First, and most significantly, GNOME's default interface font (called Cantarell) has undergone a significant update. Character forms and spacing have been evolved, so that text is more readable and attractive. Several new weights have also been added -- light and extra bold -- which are being used to produce interfaces that are both modern and beautiful. Other beautiful things include GNOME's collection of background wallpapers, which has been updated to include a lovely set of photographs, and the selection of profile pictures, which has been completely updated with attractive new images to pick from." Unfortunately, you can't just click on a button and upgrade to GNOME 3.28 today. Actually, for the most part, you will need to wait for it to become available for your operating system. Sadly, this can take a while. Fedora users, for instance, will have to wait for a major OS upgrade for it to become available. ' -- source: https://linux.slashdot.org/story/18/03/14/1624227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0

Let’s Encrypt takes free “wildcard” certificates live
by Peter Reutemann 14 Mar '18

14 Mar '18

'In July of 2017, the nonprofit certificate authority Let's Encrypt promised to deliver something that would put secure websites and Web applications within reach of any Internet user: free "wildcard" certificates to enable secure HTTP connections for entire domains. Today, Let's Encrypt took that promised service live, in addition to a new version of the Automated Certificate Management Environment (ACME) protocol, an interface that can be used by a variety of client software packages to automate verification of certificate requests. ACME version 2 "has gone through the IETF standards process," said Josh Aas, executive director of the Internet Security Research Group (ISRG), the group behind Let's Encrypt, in a blog post on the release. ACME v2 is currently a draft Internet Engineering Task Force standard, so it may not yet be in its final form. But the current version is the result of significant feedback from the industry. And its use is required to obtain wildcard certificates. In addition to the ACME v2 requirement, requests for wildcard certificates require the modification of a Domain Name Service "TXT" record to verify control over the domain—a similar method to that used by Google and other service providers to prove domain ownership. But much of this can be automated by hosting providers that provide DNS services. A single Let's Encrypt account can request up to 300 wildcard certificates over a period of three hours, allowing a hosting provider to handle requests for customers who may not have shell access to their sites.' -- source: https://arstechnica.com/information-technology/2018/03/lets-encrypt-takes-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Rowan Schischka 13 Mar '18

13 Mar '18

>And yet here we are, watching prosecutorial discretion morph into >putting someone's head on a platter over recovery disks any one of us >could download hundreds of times from Microsoft's website without a >single murmur about "lost sales" from the tech giant. Just because something is available online without a fee does not mean it can be treated as public domain. The punishment may not appear to reasonably fit the crime, but this is what was laid out by lawmakers. I would hope a reasonable fine would be equivalent to what an OEM would profit from selling a disc. I worked in anti-piracy a few years back, I should have given a lecture on licensing while I was in Hamilton. Microsoft is very smart in taking money.

2 1

Researchers Find Critical Vulnerabilities in AMD's Ryzen and EPYC Processors, But They Gave the Chipmaker Only 24 Hours Before Making the Findings Public
by Peter Reutemann 13 Mar '18

13 Mar '18

'Alfred Ng, reporting for CNET: Researchers have discovered critical security flaws in AMD chips that could allow attackers to access sensitive data from highly guarded processors across millions of devices. Particularly worrisome is the fact that the vulnerabilities lie in the so-called secure part of the processors -- typically where your device stores sensitive data like passwords and encryption keys. It's also where your processor makes sure nothing malicious is running when you start your computer. CTS-Labs, a security company based in Israel, announced Tuesday that its researchers had found 13 critical security vulnerabilities that would let attackers access data stored on AMD's Ryzen and EPYC processors, as well as install malware on them. Ryzen chips power desktop and laptop computers, while EPYC processors are found in servers. The researchers gave AMD less than 24 hours to look at the vulnerabilities and respond before publishing the report. Standard vulnerability disclosure calls for 90 days' notice so that companies have time to address flaws properly. An AMD spokesperson said, "At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings," an AMD spokesman said. Zack Whittaker, a security reporter at CBS, said: Here's the catch: AMD had less than a day to look at the research. No wonder why its response is so vague.' -- source: https://it.slashdot.org/story/18/03/13/1558221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 59, 'By Far the Biggest Update Since Firefox 1.0', Arrives With Faster Page Loads and Improved Private Browsing
by Peter Reutemann 13 Mar '18

13 Mar '18

'Mozilla today launched Firefox 59 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 59 brings faster page load times, private browsing mode that strips path information, and Android Assist. In related news, Mozilla is giving Amazon Fire TV owners a new design later this week that lets them save their preferred websites by pinning them to the Firefox home screen. Enterprise users also have something to look forward to: On Wednesday, Firefox Quantum for Enterprise is entering the beta phase. Firefox 59 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.' -- source: https://tech.slashdot.org/story/18/03/13/1623251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN
by Peter Reutemann 13 Mar '18

13 Mar '18

'A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.' -- source: https://yro.slashdot.org/story/18/03/13/1836218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
by Peter Reutemann 12 Mar '18

12 Mar '18

'Stating with Firefox 60 -- expected to be released in May 2018 -- websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information. >From a report: Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs. But at the start of the month, Mozilla engineers decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default. This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors. The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.' -- source: https://news.slashdot.org/story/18/03/12/1641205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Lawrence D'Oliveiro 12 Mar '18

12 Mar '18

<https://www.techdirt.com/articles/20180223/17294539295/microsoft-helps-get-…>: Someone dedicates his life to keeping landfills free of harmful material and the government wants to send him to prison. And it's all based on Microsoft's assertion it would have sold as many recovery disks as Lundgren created if only Lundgren hadn't created them. Ignored is the fact they never were distributed. Also ignored is the dubiousness of "lost sales" assertions, which are always 100% conjecture and always presented as a simplistic equation: "1 Piracy = 1 Lost Sale." But in this case, no sales were lost because no sales were replaced with bootleg boot disks. And "sales" must be a legal term of art. Microsoft allows anyone to download a recovery disk for free. But in court, these are suddenly worth money because infringement. To ensure someone gets tossed in jail for breaking the chain of planned obsolescence, Microsoft (and prosecutors) want the court to believe the existence of recovery disks that do nothing unless a person already has a licensed copy of Windows has somehow made the company $700,000 poorer. Given the limitations of burned recovery disks, it's impossible to see where infringement even comes into play. And yet here we are, watching prosecutorial discretion morph into putting someone's head on a platter over recovery disks any one of us could download hundreds of times from Microsoft's website without a single murmur about "lost sales" from the tech giant.

1 0

Command Line Text Processing
by Peter Reutemann 11 Mar '18

11 Mar '18

Useful tutorials: https://github.com/learnbyexample/Command-line-text-processing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

1 0

SgxSpectre Attack Can Extract Data From Intel SGX Enclaves
by Peter Reutemann 11 Mar '18

11 Mar '18

'A new variation of the Spectre attack has been revealed this week by six scientists from the Ohio State University. Named SgxSpectre, researchers say this attack can extract information from Intel SGX enclaves. Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more... Neither Meltdown and Spectre were able to extract data from SGX enclaves. This is where SgxSpectre comes in. According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to implement SGX support into their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX. Academics say an attacker can leverage the repetitive code execution patterns that these SDKs introduce in SGX enclaves and watch for small variations of cache size. This allows for side-channel attacks that allow a threat actor to infer and slowly recover data from secure enclaves. Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16. Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.' -- source: https://it.slashdot.org/story/18/03/10/0446211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 9.4 Released
by Peter Reutemann 11 Mar '18

11 Mar '18

'The Debian project is pleased to announce the fourth update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. Phoronix adds that Debian 9.4 "has a new upstream Linux kernel release, various dependency fixes for some packages, an infinite loop fix in Glade, several CVE security fixes, a larger stack size for NTP, a new upstream release of their NVIDIA proprietary driver package, Python 3 dependency fixes, and other security fixes."' -- source: https://linux.slashdot.org/story/18/03/10/2120216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developer McHardy Drops GPLv2 'Shake Down' Case
by Peter Reutemann 11 Mar '18

11 Mar '18

'Former Linux developer Patrick McHardy dropped his Gnu General Public License version 2 (GPLv2) violation case against Geniatech in a German court this week. ZDNet explains why some consider this a big "win": People who find violations typically turn to organizations such as the Free Software Foundation, Software Freedom Conservancy (SFC), and the Software Freedom Law Center to approach violators. These organizations then try to convince violating companies to mend their ways and honor their GPLv2 legal requirements. Only as a last resort do they take companies to court to force them into compliance with the GPLv2. Patrick McHardy, however, after talking with SFC, dropped out from this diplomatic approach and has gone on his own way. Specifically, McHardy has been accused of seeking his own financial gain by approaching numerous companies in German courts. Geniatech claimed McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions... In July 2016, the Netfilter developers suspended him from the core team. They received numerous allegations that he had been shaking down companies. McHardy refused to discuss these issues with them, and he refused to sign off on the Principles of Community-Oriented GPL Enforcement. In October 2017, Greg Kroah-Hartman, Linux kernel maintainer for the stable branch, summed up the Linux kernel developers' position. Kroah-Hartman wrote: "McHardy has sought to enforce his copyright claims in secret and for large sums of money by threatening or engaging in litigation...." Had McHardy continued on his way, companies would have been more reluctant to use Linux code in their products for fear that a single, unprincipled developer could sue them and demand payment for his copyrighted contributions... McHardy now has to bear all legal costs for both sides of the case. In other words, when McHardy was faced with serious and costly opposition for the first time, he waved a white flag rather than face near certain defeat in the courts. ' -- source: https://linux.slashdot.org/story/18/03/10/2323242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Well, It Got Them To The Moon And Back ...
by Lawrence D'Oliveiro 10 Mar '18

10 Mar '18

... and only crashed twice‡. Source code <https://github.com/chrislgarry/Apollo-11/blob/master/Luminary099/LUNAR_LAND…>, and note the comments on lines 179 and 180: # TEMPORARY, I HOPE HOPE HOPE ‡The famous “1202 alarm” and “1201 alarm” incidents during the landing.

1 0

Microsoft Throttles On-Prem Tech Donation Scheme For Nonprofits
by Lawrence D'Oliveiro 09 Mar '18

09 Mar '18

Cloud services will be cheaper, but actually buying premium versions of products will cost more <http://www.theregister.co.uk/2018/03/09/microsoft_charity_donation_shakeup/>. Clearly pushing people towards the rental option. Which means, when the corporate largesse runs out, the charity is left with nothing. Kind of like what has happened at the Enderley Community Centre, with all their Adobe CC products: when the funding ran out, the software stopped being usable.

1 0

Hardcoded Password Found in Cisco Software
by Peter Reutemann 08 Mar '18

08 Mar '18

'Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.' -- source: https://it.slashdot.org/story/18/03/08/145209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disabling Super-Key App-Menu Shortcut In KDE
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

Another new “feature” that KDE has acquired in the last few months is that you just have to press and release the Super (aka “Windows”†) modifier key, and the application menu will appear. This annoys me because I frequently lean on modifier keys while thinking about whether to use them, then release them when I change my mind. And then this damn menu pops up. As is usual with KDE, turning this off is pretty easy, but in this case it’s a little counterintuitive. If you right-click on the app-menu icon in the taskbar, you can choose the “Application Launcher Settings” item in the menu that appears (the name might vary a little bit depending on which particular app menu widget you have installed). In the settings dialog that comes up, you will see two panes to choose from, “Appearance” and “Keyboard shortcuts”. Naturally you go to “Keyboard shortcuts”, only to see an entry showing Alt-F1 as the trigger keystroke. So where do you control the use of the Super key? Never fear. Remove this Alt-F1 setting, and the special behaviour of the Super key disappears as well. †No, it doesn’t have a Windows logo on my Das Keyboard Pro 4. It’s imprinted with some kind of indescribable wing-like symbol.

1 0

Ask Slashdot: Should We Worry Microsoft Will 'Embrace, Extend, and Extinguish' Linux?
by Peter Reutemann 07 Mar '18

07 Mar '18

'While there is no proof that anything nefarious is afoot, it does feel like maybe the Windows-maker is hijacking the Linux movement a bit by serving distros in its store. I hope there is no "embrace, extend, and extinguish" shenanigans going on. Just yesterday, we reported that Kali Linux was in the Microsoft Store for Windows 10. That was big news, but it was not particularly significant in the grand scheme, as Kali is not very well known. Today, there is some undeniably huge news -- Debian is joining SUSE, Ubuntu, and Kali in the Microsoft Store. Should the Linux community be worried? My concern lately is that Microsoft could eventually try to make the concept of running a Linux distro natively a thing of the past. Whether or not that is the company's intention is unknown. The Windows maker gives no reason to suspect evil plans, other than past negative comments about Linux and open source. For instance, former Microsoft CEO Steve Ballmer once called Linux "cancer" -- seriously.' -- source: https://tech.slashdot.org/story/18/03/07/159249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

British Military Spends More On Computers Than Weapons And Ammo
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

From <http://www.theregister.co.uk/2018/03/07/mod_spends_more_computers_than_weap…>: Spending on weapons and ammunition for the Armed Forces totalled £1.15bn in fiscal year 2016/17, whereas the MoD spent £1.45bn on computer services in the same period. For the four prior years, spending on computers consistently outpaced that for arms and ammo, with half a billion more being spent on computers than weapons in 2015/16. ... Only shipbuilding and repairing, aircraft and spacecraft, and "technical and financial services" spending outpaced the MoD's expenditure on computers. Even construction, at £1.20bn, lagged behind it.

1 0

Google Launches First Android P Developer Preview
by Peter Reutemann 07 Mar '18

07 Mar '18

'Google today launched the first Android P developer preview, available for download now at developer.android.com. From a report: The preview includes an updated SDK with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, and the official Android Emulator. Unlike last year, there is no emulator for testing Android Wear on Android P. [...] Today's preview includes the following new APIs and features (but you can expect much more; this is just the first preview, after all): Display cutout support; HDR VP9 Video, HEIF image compression, and Media APIs; HEIF (heic) images encoding has been added to the platform; multi-camera API; ImageDecoder for bitmaps and drawables; Improved messaging notifications; Data cost sensitivity in JobScheduler; indoor positioning with Wi-Fi RTT: Platform support for the IEEE 802.11mc WiFi protocol -- also known as WiFi Round-Trip-Time (RTT) -- lets you take advantage of indoor positioning in your apps.' -- source: https://tech.slashdot.org/story/18/03/07/1811201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Turning Off Software Update Notifications In KDE
by Lawrence D'Oliveiro 06 Mar '18

06 Mar '18

Seems the latest version of KDE includes an automatic notifier when there are system updates available. This is great for, shall we say, “normal” users. But I run Debian Unstable. Which means I will be nagged for more updates within a matter of hours after doing a system upgrade, and things will rapidly go downhill from there. So naturally I would rather turn these off completely. The obvious place to find this setting would be in the “Notifications” panel in the System Settings. Unfortunately, the “Event source:” menu lists about three dozen different sources of notification events, and it isn’t obvious (at least, it wasn’t to me) which one handles software updates. The answer is, it’s the one called “Discover”. You will see only one event in its list: “Updates Are Available”. Simply uncheck all the forms of notification for this event. Hmm, I wonder if this panel couldn’t do with a search box...?

1 0

No Safe Haven For Victims Of Digital Abuse
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Blocking messages from online abusers -- and even changing your identity to get away from them -- may work fine against someone on the other side of the world. But what if the abuser is your close partner? <https://slate.com/technology/2018/03/apps-cant-stop-exes-who-use-technology…>: When you learn that your privacy has been compromised, the common advice is to prevent additional access—delete your insecure account, open a new one, change your password. But in abusive romantic relationships, disconnection can be extremely fraught. For one, it can put the victim at risk of physical harm: If abusers expect digital access and that access is suddenly closed off, it can lead them to become more violent or intrusive in other ways. It may seem cathartic to delete abusive material, like alarming text messages—but if you don’t preserve that kind of evidence, it can make prosecution more difficult. And closing some kinds of accounts, like social networks, to hide from a determined abuser can cut off social support that survivors desperately need. (Found from <https://www.schneier.com/blog/archives/2018/03/intimate_partne.html>)

1 0

Libre Content Creation: 2018 In Perspective
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Nice roundup <http://libregraphicsworld.org/blog/entry/2018-in-perspective> from Alexandre Prokoudine on where a bunch of Free graphics/audio/video projects have gone and where they are likely to go over the coming year. Gimp 2.10 continues to be delayed, but in return the list of goodies promised continues to lengthen: The team initially intended v2.10 to be more or less a GEGL-based upgrade of v2.8 plus high bit depth precision support. Needless to say, the plan hasn't exactly worked: there will be a lot more than that. In fact, even now, when only critical bugs are supposed to be worked on, the team cannot resist making improvements that aren't blocking the release. Another interesting one is an initiative in Germany to come up with a nonproprietary alternative to common colour specifications like Pantone: In December 2017, FreieFarbe e.V. announced that their initiative for „Open Colour Communication“ standard was supported by DIN and will become a DIN SPEC (which is the first step towards DIN Norm). It is claimed that DIN intends to turn this into an international standard via ISO later. The FreieFarbe / FreeColour initiative aims to provide an open alternative to Pantone, HKS, and other proprietary colour systems. They argue that unlike Pantone and some other proprietary manufacturers like RAL, FreiFarbe has an actual color system. On the music-production front, Zyn-Fusion seems to be developing as the successor to the venerable ZynAddSubFX, while VCV Rack is the candidate for the ultimate software modular synth, complete with rat’s nest of (virtual) connecting wires. (I’ve seen a demo or two on YouTube.)

1 0

Re: [wlug] FreeBSD's New Code of Conduct
by William Mckee 27 Feb '18

27 Feb '18

virtual contact! none of that. more sjw bs. cheers, william. On 21/02/2018 7:08 pm, "Lawrence D'Oliveiro" <ldo(a)geek-central.gen.nz> wrote: On Sun, 18 Feb 2018 11:25:31 +1300, Peter Reutemann quoted: > '> Physical contact and simulated physical contact (e.g., textual > descriptions like "hug" or "backrub") without consent or after a > request to stop.' From <http://www.theregister.co.uk/2018/02/21/freebsd_code_of_ conduct_controversy/>: OpenSUSE board member and YouTuber Bryan Lunduke has used his YouTube channel <https://www.youtube.com/watch?v=SxNdQJSlg54> to ask if FreeBSD also wants to regulate virtual high fives or fist bumps. Lunduke's video is a rather more polite expression of comments found in corners of the Internet where gender politics is derided and debate is sometimes infamously uncivil. _______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

2 1

Mozilla Removes Individual Cookie Management in Firefox 60
by Peter Reutemann 26 Feb '18

26 Feb '18

'The most recent version of Firefox Nightly, currently at version 60, comes with changes to Firefox's cookie management. Mozilla merged cookie settings with site data in the web browser which impacts how you configure and manage cookie options. If you run Firefox 59 or earlier, you can load about:preferences#privacy to manage privacy related settings in Firefox. If you set the history to "use custom settings for history" or "remember history", you get an option manage cookie settings and to remove individual cookies from Firefox. A click on the link or button opens a new browser window in which all set cookies are listed. You can use it to find set cookies, look up information, remove selected or all cookies. Mozilla engineers changed this in recent versions of Firefox 60 (currently on the Nightly channel).' -- source: https://news.slashdot.org/story/18/02/26/1853203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox - turning off processes per tab
by Peter Reutemann 26 Feb '18

26 Feb '18

Hi everyone In case you don't like Firefox's new feature of separating tabs into separate processes (far more resource hungry), change the following setting in "about:config" to "false": browser.tabs.remote.auto Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

OpenBSD Releases Meltdown Patch
by Peter Reutemann 25 Feb '18

25 Feb '18

'OpenBSD's Meltdown patch has landed, in the form of a Version 11 code update that separates user memory pages from the kernel's -- pretty much the same approach as was taken in the Linux kernel. From a report: A few days after the Meltdown/Spectre bugs emerged in January, OpenBSD's Phillip Guenther responded to user concerns with a post saying the operating system's developers were working out what to do. Now he's revealed the approach used to fix the free OS: "When a syscall, trap, or interrupt takes a CPU from userspace to kernel the trampoline code switches page tables, switches stacks to the thread's real kernel stack, then copies over the necessary bits from the trampoline stack. On return to userspace the opposite occurs: recreate the iretq frame on the trampoline stack, switch stack, switch page tables, and return to userspace." That explanation is somewhat obscure to non-developers, but there's a more readable discussion of what the project's developers had in mind from January, here.' -- source: https://it.slashdot.org/story/18/02/23/1519245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Botched npm Update Crashes Linux Systems, Forces Users to Reinstall
by Peter Reutemann 22 Feb '18

22 Feb '18

'A bug in npm (Node Package Manager), the most widely used JavaScript package manager, will change ownership of crucial Linux system folders, such as /etc, /usr, /boot. Changing ownership of these files either crashes the system, various local apps, or prevents the system from booting, according to reports from users who installed npm v5.7.0. -- the buggy npm update. Users who installed this update -- mostly developers and software engineers -- will likely have to reinstall their system from scratch or restore from a previous system image.' -- source: https://it.slashdot.org/story/18/02/22/2034213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ricoh MP C3003 or similar wanted
by Gregory Machin 22 Feb '18

22 Feb '18

Hi, This is very off topic. I'm working on script (currently powershell, my port to python)to manage (backup and restore) the addess book on Ricoh printers. The idea is to be able to manage large number of printers address books. I'm looking for a printer I can use for my dev work. It I don't care if the printer or scanner are faulty just need to brains to be functional. If anyone has such I could have or loan for a couple of months, that would be great. If not all good. Many thanks G

1 0

Google To Cease “Offshoring” Local Revenue
by Lawrence D'Oliveiro 21 Feb '18

21 Feb '18

Wonder of wonders <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11999548>: Government moves to crack down on tax avoidance by multinational firms are already bearing fruit, with Google telling Parliament it will no longer funnel New Zealand revenues via low-tax jurisdictions such as Singapore. ... The practice saw Google's New Zealand subsidiary provide only services as part of the sales process - paying just $356,000 in tax on only $12.2m in revenue. Estimates of Google's sales revenue from New Zealand range in the hundreds of millions of dollars annually.

1 0

uTorrent Client Affected by Some Pretty Severe Security Flaws
by Peter Reutemann 21 Feb '18

21 Feb '18

'A Google security researcher has found multiple security flaws affecting the uTorrent web and desktop client that allow an attacker to infect a victim with malware or collect data on the users' past downloads, reports BleepingComputer. From the report: The vulnerabilities have been discovered by Google Project Zero security researcher Tavis Ormandy, and they impact uTorrent Web, a new web-based version of the uTorrent BitTorrent client, and uTorrent Classic, the old uTorrent client that most people know. Ormandy says that both uTorrent clients are exposing an RPC server -- on port 10000 (uTorrent Classic) and 19575 (uTorrent Web). The expert says that attackers can hide commands inside web pages that interact with this open RPC server. The attacker only needs to trick a user with a vulnerable uTorrent client to access a malicious web page. Furthermore, the uTorrent clients are also vulnerable to DNS rebinding -- a vulnerability that allows the attacker to legitimize his requests to the RPC server.' -- source: https://it.slashdot.org/story/18/02/21/180206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Has a New Spectre and Meltdown Firmware Patch For You To Try Out
by Peter Reutemann 21 Feb '18

21 Feb '18

'The Spectre/Meltdown debacle continues to rumble on, and now the chip manufacturer has announced the availability of a new 'microcode solution' to the vulnerability. The updated firmware applies to 6th, 7th and 8th Generation Intel Core devices, and the release sees the company crossing its fingers and hoping that everything works out this time. This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.' -- source: https://it.slashdot.org/story/18/02/21/186257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD's New Code of Conduct
by Peter Reutemann 21 Feb '18

21 Feb '18

'FreeBSD has a new code of conduct, which is making several people angry. From the blog post: This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee. Participants are responsible for knowing and abiding by these rules. Harassment includes but is not limited to: Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion. Unwelcome comments regarding a person's lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment. Deliberate misgendering. Deliberate use of "dead" or rejected names. Gratuitous or off-topic sexual images or behaviour in spaces where they're not appropriate. Physical contact and simulated physical contact (e.g., textual descriptions like "hug" or "backrub") without consent or after a request to stop. Threats of violence. Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm. Deliberate intimidation. Stalking or following. Harassing photography or recording, including logging online activity for harassment purposes. Sustained disruption of discussion. Unwelcome sexual attention. Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others. Continued one-on-one communication after requests to cease. Deliberate "outing" of any private aspect of a person's identity without their consent except as necessary to protect vulnerable people from intentional abuse. Publication of non-harassing private communication without consent. Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning). Knowingly making harmful false claims about a person.' -- source: https://yro.slashdot.org/story/18/02/17/0826206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to Get Started Using WSL in Windows 10
by Peter Reutemann 20 Feb '18

20 Feb '18

'In this article, we will walk through the process of getting started with WSL on your Windows 10 machine. You must be running the latest version of Windows 10 with Fall Creator Update installed. Then, check which version of Windows 10 is installed on your system by searching on “About” in the search box of the Start menu. You should be running version 1709 or the latest to use WSL. If an older version is installed, you need to download and install the Windows 10 Fall Creator Update (FCU) from this page. Once FCU is installed, go to Update Settings (just search for “updates” in the search box of the Start menu) and install any available updates.' -- source: https://www.linux.com/blog/learn/2018/2/how-get-started-using-wsl-windows-10 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 20 Feb '18

20 Feb '18

Hi everyone Just to let you know that we have a meeting next Monday: 'Ian Young will be demoing Manjaro (https://manjaro.org/) a Linux distribution that has become very popular recently according to the Linux Journal's poll (https://linux.slashdot.org/story/18/02/14/1850259) General discussion on backup tools and strategies: What tool do you use? What approach is working for you? What should you stay away from at all costs?' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246736977/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cron Is Becoming Obsolete
by Lawrence D'Oliveiro 20 Feb '18

20 Feb '18

I have to get out of the habit of (only) checking various /etc/cron* locations for periodic system tasks. Debian is making more and more use of systemd timer tasks. The nice thing is, you can see them all with a simple command: systemctl status \*.timer Got caught out with this on a client’s machine the other day: when you install the certbot package (for managing certificates issued by Let’s Encrypt) on Debian, it also automatically adds a systemd timer to run certificate renewals twice a day, you don’t need to set up your own cron task to manage this.

1 0

Chrome Extension Brings 'View Image' Button Back
by Peter Reutemann 19 Feb '18

19 Feb '18

'Google recently removed the convenient "view image" button from its search results as a result of a lawsuit with stock-photo agency Getty. Thankfully, one day later, a developer created an extension that brings it back. 9to5Google reports: It's unfortunate to see that button gone, but an easy to use Chrome extension brings it back. Simply install the extension from the Chrome Web Store, and then any time you view an image on Google Image Search, you'll be able to open that source image. You can see the functionality in action in the video below. The only difference we can see with this extension versus the original functionality is that instead of opening the image on the same page, it opens it in a new tab. The extension is free, and it will work with Chrome for Windows, Mac, Chrome OS, or anywhere else the full version of Chrome can be used. 9to5Google has a separate post with step-by-step instructions to get the Google Images "view image" button back.' -- source: https://tech.slashdot.org/story/18/02/19/0334208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite
by Peter Reutemann 15 Feb '18

15 Feb '18

'ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder. ' -- source: https://it.slashdot.org/story/18/02/12/2319257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Wants To Collect Data About Your System -- Starting With 18.04 LTS
by Peter Reutemann 15 Feb '18

15 Feb '18

' In an announcement on Ubuntu mailing list, Will Cooke, on behalf of the Ubuntu Desktop team, announced Canonical's plans to collect some data related to the users' system configuration and the packages installed on their machines. From a report: Before you read anything further, it's important to note that users will have the option to opt-out of this data collection. The company plans to add a checkbox to the installer, which would be checked by default. The option could be like: "Send diagnostics information to help improve Ubuntu." As per your convenience, you can opt-out during the installation. An option to do the same will also be made available in the Privacy panel of GNOME Settings. With this data collection, the team wishes to improve the daily experiences of the Ubuntu users. It's worth noting that the collected data will be sent over encrypted connections and no IP addresses will be tracked. To be precise, the collected data will include: flavour and version of Ubuntu, network connectivity or not, CPU family, RAM, disk(s) size, screen(s) resolution, GPU vendor and model, OEM manufacturer, location (based on the location selection made during install), no IP information, time taken for Installation, auto-login enabled or not, disk layout selected, third party software selected or not, download updates during install or not, livePatch enabled or not.' -- source: https://news.slashdot.org/story/18/02/15/1410203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DeepFakes Explained
by Lawrence D'Oliveiro 15 Feb '18

15 Feb '18

Heard about the latest hot new trend on the Internet? Slightly disturbing, even? It’s splicing someone’s face into a video in place of that of an entirely unrelated person, to make it look like they’re the one in the scene. Except that the result doesn’t look fake at all--you’d think it was real. Naturally, Rule 34 applies. But here <https://www.youtube.com/watch?v=7XchCsYtYMQ> is a watchable, and entirely SFW, overview of how it all works. Oh, and the software for doing this is all over GitHub.

2 2

Manjaro at meeting
by Ian Young 15 Feb '18

15 Feb '18

I have been using Manjaro of late so could try to summon up something to say ~ IanY

2 1

Critical Telegram flaw under attack disguised malware as benign images
by Peter Reutemann 14 Feb '18

14 Feb '18

'Makers of the Telegram instant messenger have fixed a critical vulnerability that hackers were actively exploiting to install malware on users' computers, researchers said Tuesday. The flaw, which resided in the Windows version of the messaging app, allowed attackers to disguise the names of attached files, researchers from security firm Kaspersky Lab said in a blog post. By using the text-formatting standard known as Unicode, attackers were able to cause characters in file names to appear from right to left, instead of the left-to-right order that's normal for most Western languages.' -- source: https://arstechnica.com/information-technology/2018/02/telegram-app-purged-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s compiler-level Spectre fix shows how hard this problem will be to solve
by Peter Reutemann 14 Feb '18

14 Feb '18

'The Meltdown and Spectre attacks that use processor speculative execution to leak sensitive information have resulted in a wide range of software changes to try to limit the scope for harm. Many of these are operating system-level fixes, some of which depend on processor microcode updates. But Spectre isn't a simple attack to solve; operating system changes help a great deal, but application-level changes are also needed. Apple has talked about some of the updates it has made to the WebKit rendering engine, used in its Safari browser, but this is only a single application. Microsoft is offering a compiler-level change for Spectre. The "Spectre" label actually covers two different attacks. The one that Microsoft's compiler is addressing, known as "variant 1," concerns checking the size of an array: before accessing the Nth element of an array, code should check that the array has at least N elements in it. Programmers using languages like C and C++ often have to write these checks explicitly. Other languages, like JavaScript and Java, perform them automatically. Either way, the test has to be done; attempts to access array members that don't exist are a whole class of bugs all on their own. [...] In fairness, Microsoft does warn that "there is no guarantee that all possible instances of variant 1 will be instrumented," but as Kocher's examination shows, it's not simply that some Spectre-vulnerable code will escape the compiler's fixes. Much—and perhaps even most—Spectre-vulnerable code will escape. And even if it were only a few instances, bad guys would be able to locate the unprotected routines and focus their attacks accordingly.' -- source: https://arstechnica.com/gadgets/2018/02/microsofts-compiler-level-spectre-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0