- wlug - list.wlug.org.nz

Linux Mint Is Killing the KDE Edition
by Peter Reutemann 27 Oct '17

27 Oct '17

'While both the Cinnamon and Mate versions of Linux Mint are decent choices for computer users, there was one version that was always utterly bizarre -- the KDE Edition. Don't get me wrong, KDE is a fine environment, but Kubuntu already exists. Having a version of Mint using KDE was redundant and confusing. Thankfully, today, the Linux Mint team announces it is finally killing the KDE edition. "In continuation with what's been done in the past, Linux Mint 18.3 will feature a KDE edition, but it will be the last release to do so. I would like to thank Kubuntu for the amazing work they have done. The quality of Plasma 5 in Xenial made backports a necessity. The rapid pace of development upstream from the KDE project made this very challenging, yet they managed to provide a stable flow of updates for us and we were able to ship good KDE editions thanks to that. I don't think this would have been possible without them," says Clement Lefebvre, Linux Mint. Lefebvre further says, "KDE is a fantastic environment but it's also a different world, one which evolves away from us and away from everything we focus on. Their apps, their ecosystem and the QT toolkit which is central there have very little in common with what we're working on. We're not just shipping releases and distributing upstream software. We're a product distribution and we see ourselves as a complete desktop operating system. We like to integrate solutions, develop whatâ(TM)s missing, adapt what's not fitting perfectly, and we do a great deal of that not only around our own Cinnamon desktop environment but also thanks to cross-DE frameworks we put in place to support similar environments, such as MATE and Xfce."' -- source: https://linux.slashdot.org/story/17/10/26/0325221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

How to Install Mycroft AI Assistant On Raspberry Pi
by Peter Reutemann 27 Oct '17

27 Oct '17

'Personal assistants like Alexa and Google Home are extremely popular right now, and interest is only growing. It’s not too hard to envision a near future where just about every home has its own AI assistant. What if you don’t want a huge corporation having a direct line into your home? Maybe you want to build your own to understand how they work? Mycroft is the solution. Mycroft is an open-source AI assistant that aims to compete with the likes of Alexa and Google. No, Mycroft isn’t entirely there yet, but the project is still in active development. Mycroft is based on the hugely popular Raspberry Pi, so you can actually set up your own with a Pi and test it out.' -- source: https://www.maketecheasier.com/install-mycroft-on-raspberry-pi/ Apparently, you can use it without creating an account: https://github.com/MycroftAI/mycroft-core#using-mycroft-without-home Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Who's building Linux in 2017?
by Peter Reutemann 27 Oct '17

27 Oct '17

'It's 2017 and Linux rules the computing world. Don't believe me? The Linux Foundation reports that Linux runs 90 percent of the public cloud workload, 82 percent of the world's smartphones, 62 percent of the embedded market, oh and a mere 99 percent of the supercomputer market. All that rests on the Linux kernel. In its 2017 Linux Kernel Development Report, Jonathan Corbet, Linux kernel developer and editor of LWN.net, and Greg Kroah-Hartman, stable Linux kernel maintainer, report on Linux's recent evolution. This report was released at the invitation-only Linux Kernel Summit in Prague, Czech Republic. Since 2005 and adoption of Git version control system, 15,637 developers from over 1,400 companies have contributed to the Linux kernel. Since last year, over 4,300 developers from more than 500 companies have contributed to the kernel. Of these, 1,670 contributed for the first time, or about a third of contributors' -- source: http://www.zdnet.com/article/whos-building-linux-in-2017/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are “Enterprise-Quality” Hard Drives Worth It?
by Lawrence D'Oliveiro 26 Oct '17

26 Oct '17

Another quarter, another report from backups outfit Backblaze on hard disk reliability <https://arstechnica.com/gadgets/2017/10/big-hard-disks-may-be-breaking-the-…>: In aggregate, the company has now accumulated 3.7 million drive days for the consumer disks and 1.4 million for the enterprise ones. Over this usage, the annualized failure rates are 1.1 percent for the consumer disks and 1.2 percent for the enterprise ones. At least for now, then, the enterprise disks aren't doing anything to justify their longer warranty; their reliability is virtually identical.

1 0

How To Protect A Small Organization Against Electronic Adversaries
by Lawrence D'Oliveiro 25 Oct '17

25 Oct '17

About to have a look at the document posted here <https://freedom-to-tinker.com/2017/10/25/howto-protect-your-small-organizat…>. Unfortunately, for a document that’s about security, wget tells me the link is (currently) not secure: WARNING: The certificate of ‘www.cs.rice.edu’ is not trusted. WARNING: The certificate of ‘www.cs.rice.edu’ hasn't got a known issuer. WARNING: The certificate of ‘www.cs.rice.edu’ was signed using an insecure algorithm.

1 0

Why Computing Devices Slow Down Over Time
by rowan schischka 25 Oct '17

25 Oct '17

> So trying to speed things up can make things slower?? Its a repost from another outlet. This is just filler article in the tech section. Stuff has one today about mobile battery advice that contradicts last months article about mobile batteries.

1 0

When You Have To Have An Entire Conference On Software Licensing...
by Lawrence D'Oliveiro 24 Oct '17

24 Oct '17

Choice quotes from <http://www.theregister.co.uk/2017/10/24/oracle_users_meets_behind_closed_do…>: The emphasis on anonymity comes from firms’ fear that vendors are always poised to launch an audit or bump up fees. Sessions will offer advice on ... why customers shouldn’t be too reliant on licensing tools.

1 0

Why Did Ubuntu Drop Unity? Mark Shuttleworth Explains
by Peter Reutemann 24 Oct '17

24 Oct '17

Since we talked about Canonical ditching Mir/Unity on Monday night, here's some more insight from Shuttleworth himself: 'Ubuntu's decision to ditch Unity took many of us by surprise earlier this year. Now Ubuntu founder Mark Shuttleworth shares more details about why Ubuntu chose to drop Unity. From a report: Shuttleworth says he, along with the other 'leads' at Canonical, came to a consensual view that they should put the company on the path to becoming a public company. And to appear attractive to potential investors the company has to focus on its areas of profitability -- something Unity, Ubuntu phone, Unity 8 and convergence were not part of: "[The decision] meant that we couldn't have on our books (effectively) very substantial projects which clearly have no commercial angle to them at all. It doesn't mean that we would consider changing the terms of Ubuntu for example, because it's foundational to everything we do. And we don't have to, effectively," he said. Money may have meant Unity's demise but the wider Ubuntu project is in rude health. as Shuttleworth explains: "One of the things I'm most proud of is in the last 7 years is that Ubuntu itself became completely sustainable. I could get hit by a bus tomorrow and Ubuntu could continue. It's kind of magical, right? Here's a platform that is a world class enterprise platform, that's completely freely available, and yet it is sustainable. Jane Silber is largely to thank for that." While it's all-too-easy for desktop users to focus on, well, the desktop, there is far more to Canonical (the company) than the 6-monthly releases we look forward to. Losing Unity may have been a big blow for desktop users but it helped to balance other parts of the company: "There are huge possibilities for us in the enterprise beyond that, in terms of really defining how cloud infrastructure is built, how cloud applications are operated, and so on. And, in IoT, looking at that next wave of possibility, innovators creating stuff on IoT. And all of that is ample for us to essentially put ourselves on course to IPO around that." Dropping Unity wasn't easy for Mark, though: "We had this big chunk of work, which was Unity, which I really loved. I think the engineering of Unity 8 was pretty spectacularly good, and the deep ideas of how you bring these different form factors together was pretty beautiful.' -- source: https://news.slashdot.org/story/17/10/24/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Install Let's Encrypt and Secure Nginx with SSL/TLS in Debian 9
by Peter Reutemann 24 Oct '17

24 Oct '17

'This tutorial will show you how to install and secure a Nginx web server on Debian 9 with a TLS certificate issued for free by the Let’s Encrypt Certificate Authority. Furthermore, we will configure automatic renewal of Lets’ Encrypt TLS certificates using a cron job before the certificates expire.' -- source: https://www.howtoforge.com/tutorial/install-letsencrypt-and-secure-nginx-in… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Librem 5 Privacy-Focused Linux Phone Crowdfunding Campaign Ends with $2 Million
by Peter Reutemann 24 Oct '17

24 Oct '17

Since we talked about this phone last night... 'Librem 5 was successfully crowdfunded about two weeks ago when it surpassed its goal of $1.5 million, but the campaign continued to run, and now it appears to have gathered half million dollars more, ending with $2 million, which we believe is more than enough to build world's first truly free mobile device. Powered by PureOS, Purism's own GNU/Linux distribution based on the popular Debian GNU/Linux operating system, but focused on offering users a privacy-focused and more secure desktop solution, Librem 5 will be using KDE's Plasma Mobile and GNOME's GNOME Shell user interfaces, along with powerful open source software. During its crowdfunding campaign, Librem 5 saw an amazing feedback from the Open Source community as Purism partnered not only with big names like KDE and GNOME, but also with Nextcloud, which will bring its end-to-end encrypted file sync, sharing and cloud-based storage solution by default to the Linux smartphone.' -- source: http://news.softpedia.com/news/librem-5-privacy-focused-linux-phone-crowdfu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

3 Simple, Excellent Linux Network Monitors
by Peter Reutemann 24 Oct '17

24 Oct '17

'You can learn an amazing amount of information about your network connections with these three glorious Linux networking commands. iftop tracks network connections by process number, Nethogs quickly reveals what is hogging your bandwidth, and vnstat runs as a nice lightweight daemon to record your usage over time.' -- source: https://www.linux.com/learn/intro-to-linux/2017/10/3-simple-excellent-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

4 Reasons Building A Gaming PC Sucks Right Now
by Lawrence D'Oliveiro 23 Oct '17

23 Oct '17

Just saw this video on the current high prices of GPUs, RAM and variable-refresh monitors <https://www.youtube.com/watch?v=Vh8tZ_qkY1o>. What’s surprising to me is the reason why GPU prices are currently high: because they are being snapped up for cryptocurrency mining.

1 0

Why Computing Devices Slow Down Over Time
by Lawrence D'Oliveiro 23 Oct '17

23 Oct '17

Entertaining opinion piece <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11935838>: To make their apps run faster, some designers make them store copies of things in RAM ... Known as cacheing, this makes things work much faster - until your system starts to run out of memory. For cacheing to be effective, the amount of space devoted to it must be carefully managed by the application and the device's operating system. Some app developers don't put the effort that they should into doing this well, and their applications not only slow down over time, but can drag the rest of the system down with them too. So trying to speed things up can make things slower??

1 0

Android getting “DNS over TLS” support to stop ISPs from knowing what websites you visit
by Peter Reutemann 23 Oct '17

23 Oct '17

'DNS (Domain Name Server) is what translates a website address from a URL that you enter to an IP address which your computer actually connects to. For example, when you type “www.xda-developers.com” into your browser, your computer queries a DNS which looks up and returns the IP address “209.58.128.90” to the client. This process is hidden from the user, but every website you visit (so long as it has a human-readable URL) will go through this same process. The problem for those security conscious out there is that these requests are done in plain text through UDP or TCP protocols which are readable by anyone that can see your connection, including your ISP. This is where DNS over TLS comes in.' -- source: https://www.xda-developers.com/android-dns-over-tls-website-privacy/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft Chastises Google Over Chrome Security
by Peter Reutemann 22 Oct '17

22 Oct '17

'In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser. The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it." In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.' -- source: https://it.slashdot.org/story/17/10/22/010235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Upgraded For NetBSD-amd64 with Kernel ASLR Support
by Peter Reutemann 22 Oct '17

22 Oct '17

'24 years after its release, NetBSD is getting a security upgrade -- specifically, Address Space Layout Randomization (ASLR). An anonymous reader writes: Support for Kernel ASLR was added on NetBSD-amd64 a few weeks ago. KASLR basically randomizes the address of the kernel, and makes it harder to exploit several classes of vulnerabilities [including privilege escalations and remote code execution]. It is still a work-in-progress, but it's already fully functional, and can be used following the instructions on this post from the NetBSD blog. It will be available starting from NetBSD 9, but may be backported to NetBSD 8 once it is stabilized. NetBSD says they're the first BSD system to support ASLR.' -- source: https://bsd.slashdot.org/story/17/10/21/0118226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bloody Stupid Linux
by Lawrence D'Oliveiro 21 Oct '17

21 Oct '17

That’s the name of the distro <http://bloodystupid.clockwatching.org/>: Why go to all this trouble? The BSL kernel is basically a life support system for ram and network cards, since it wget's support for everything else on the machine the kernel is very small. The initial aim was to fit it on a single floppy, then PXE booting became attractive, and really, since the kernel doesn't need to support whatever it just booted from in order to have its root filesystem, its very flexible. Yeah, I know an initrd can do the same thing, but its more fun this way. As it stands, BSL makes for an excellent repair system, the framework for a bulk installer, a neat toy, and an alright thin client ( as long as you've got a gob of RAM handy.) OK, so it hasn’t been updated in over a decade. But the mascot image is cute. ;)

1 0

The Ultimate In Terminal Emulators?
by Lawrence D'Oliveiro 20 Oct '17

20 Oct '17

Brian Lunduke continues his Command-Line Week with a look at a couple of quite amazing terminal emulators: <https://www.youtube.com/watch?v=-vm7B6bLbLg>. So you think “command line” and “eye candy” can’t go together?

1 0

Yet another distro - Q4OS - meeting topic
by Ian Young 20 Oct '17

20 Oct '17

Some may be surprised to learn that a few diehards are still running a fork of KDE 3.5 on a Debian Base. The Trinity desktop. Could give it a quick run through on Monday night if there is time. May be of interest to those who wonder sometimes why KDE 3 was dropped once it actually became usable.

3 2

Meet CudaText: A Cross-Platform Open Source Code Editor
by Peter Reutemann 20 Oct '17

20 Oct '17

'CudaText is a cross-platform open source code editor based on Lazarus. It has extensive support for most of the popular programming languages. I cannot call it one of the best open source code editors because it is too early for that. I cannot even call it Notepad++ alternative for Linux because it’s more like a lightweight IDE like Geany. Though the default interface reminds me of Eclipse IDE.' -- source: https://itsfoss.com/cudatext-code-editor/ Great to see that Object Pascal is still thriving, though I haven't programmed in Pascal for years. Lazarus is an IDE for Object Pascal, a free alternative to (originally Borland's) Delphi. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Desktop Recorder App Green Recorder 3.0 Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Green Recorder is a simple desktop recorder for Linux distributions. You can use it to record audio and video on almost every Linux interface. Released under GPL 3, it now also supports Wayland. Green Recorder 3.0 supports avi, mkv, mp4 nut and gif. Wayland’s GNOME session supports only WebM. The user can choose the audio input source from a list as well as can set default values from the preference window.' -- source: https://itsfoss.com/green-recorder-3/ Just tried it and it works! Previously, I had used recordMyDesktop (GTK UI), which only supported Ogg Video. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canada's 'Super Secret Spy Agency' Is Releasing a Malware-Fighting Tool To the Public
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canada's electronic spy agency says it is taking the "unprecedented step" of releasing one of its own cyber defence tools to the public, in a bid to help companies and organizations better defend their computers and networks against malicious threats. The Communications Security Establishment (CSE) rarely goes into detail about its activities -- both offensive and defensive -- and much of what is known about the agency's activities have come from leaked documents obtained by U.S. National Security Agency whistleblower Edward Snowden and published in recent years. But as of late, CSE has acknowledged it needs to do a better job of explaining to Canadians exactly what it does. Today, it is pulling back the curtain on an open-source malware analysis tool called Assemblyline that CSE says is used to protect the Canadian government's sprawling infrastructure each day. "It's a tool that helps our analysts know what to look at, because it's overwhelming for the number of people we have to be able to protect things," Scott Jones, who heads the agency's IT security efforts, said in an interview with CBC News. On the one hand, open sourcing Assemblyline's code is a savvy act of public relations, and Jones readily admits the agency is trying to shed its "super secret spy agency" reputation in the interest of greater transparency.' -- source: https://news.slashdot.org/story/17/10/19/1837236 Let's see, whether anybody finds bits in the code that report home to the agency... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AGM next month
by Peter Reutemann 19 Oct '17

19 Oct '17

Hi everyone The Annual General Meeting (AGM) of the Waikato Linux Users Group Society will be held on November 27th this year. Agenda (preliminary) - President's Report - Treasurer's Report - Election of 2017 Committee - General business - Consumption of pizza https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234897/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 17.10 Artful Aardvark Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canonical has made available the download links for Ubuntu 17.10 "Artful Aardvark". It comes with a range of new features, changes, and improvements including GNOME as the default desktop, Wayland display server by default, Optional X.org server session, Mesa 17.2 or Mesa 17.3, Linux kernel 4.13 or kernel 4.14, new Subiquity server installer, improved hardware support, new Ubuntu Server installer, switch to libinput, an always visible dock using Dash to Dock GNOME Shell extension, and Bluetooth improvements with a new BlueZ among others. ' -- source: https://news.slashdot.org/story/17/10/19/0943200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung To Let Proper Linux Distros Run on Galaxy Smartphones
by Peter Reutemann 19 Oct '17

19 Oct '17

'Samsung has announced it will soon become possible to run actual proper Linux on its Note8, Galaxy S8 and S8+ smartphones -- and even Linux desktops. Yeah, yeah, we know Android is built on Linux, but you know what we mean. Samsung said it's working on an app called "Linux on Galaxy" that will let users "run their preferred Linux distribution on their smartphones utilizing the same Linux kernel that powers the Android OS." "Whenever they need to use a function that is not available on the smartphone OS, users can simply switch to the app and run any program they need to in a Linux OS environment," Samsung says. The app also allows multiple OSes to run on a device. Linux desktops will become available if users plug their phones into the DeX Station, the device that lets a Galaxy 8 run a Samsung-created desktop-like environment when connected to the DeX and an external monitor.' -- source: https://linux.slashdot.org/story/17/10/19/0524234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU: No Encryption Backdoors But, Let's Help Each Other Crack That Crypto
by Peter Reutemann 19 Oct '17

19 Oct '17

'The European Commission has proposed that member states help each other break into encrypted devices by sharing expertise around the bloc. From a report: In an attempt to tackle the rise of citizens using encryption and its effects on solving crimes, the commission decided to sidestep the well-worn, and well-ridiculed, path of demanding decryption backdoors in the stuff we all use. Instead, the plans set out in its antiterrorism measures on Wednesday take a more collegiate approach -- by offering member states more support when they actually get their hands on an encrypted device. "The commission's position is very clear -- we are not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon," security commissioner Julian King told a press briefing. "We're trying to move beyond a sometimes sterile debate between backdoors or no backdoors, and address some of the concrete law enforcement challenges. For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."' -- source: https://yro.slashdot.org/story/17/10/19/1440200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Engineers Explore Ways To Stop In-Browser Cryptocurrency Miners in Chrome
by Peter Reutemann 19 Oct '17

19 Oct '17

'Google Chrome engineers are considering adding a special browser permission that will thwart the rising trend of in-browser cryptocurrency miners. Discussions on the topic of in-browser miners have been going on the Chromium project's bug tracker since mid-September when Coinhive, the first such service, launched. "Here's my current thinking," Ojan Vafai, a Chrome engineering working on the Chromium project, wrote in one of the recent bug reports. "If a site is using more than XX% CPU for more than YY seconds, then we put the page into 'battery saver mode' where we aggressively throttle tasks and show a toast [notification popup] allowing the user to opt-out of battery saver mode. When a battery saver mode tab is backgrounded, we stop running tasks entirely. I think we'll want measurement to figure out what values to use for XX and YY, but we can start with really egregious things like 100% and 60 seconds. I'm effectively suggesting we add a permission here, but it would have unusual triggering conditions [...]. It only triggers when the page is doing a likely bad thing." An earlier suggestion had Google create a blacklist and block the mining code at the browser level. That suggestion was shut down as being too impractical and something better left to extensions.' -- source: https://tech.slashdot.org/story/17/10/19/1618222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Targeted Fuzzing Is Improving Linux Security, Linus Torvalds Says
by Peter Reutemann 19 Oct '17

19 Oct '17

'On the sidelines of announcing the fifth release candidate for the Linux kernel version 4.14, Linus Torvalds said fuzzing, which involves stress testing a system by generating random code to induce errors, is helping the community find and fix a range of security vulnerabilities. He wrote: The other thing perhaps worth mentioning is how much random fuzzing people are doing, and it's finding things. We've always done fuzzing (who remembers the old "crashme" program that just generated random code and jumped to it? We used to do that quite actively very early on), but people have been doing some nice targeted fuzzing of driver subsystems etc, and there's been various fixes (not just this last week either) coming out of those efforts. Very nice to see.' -- source: https://linux.slashdot.org/story/17/10/19/171206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IoT Cybersecurity: What’s Plan B?
by Lawrence D'Oliveiro 19 Oct '17

19 Oct '17

Whither the Internet Of Things? Markets, as we've repeatedly learned over the past century, are terrible mechanisms for improving the safety of products and services. It was true for automobile, food, restaurant, airplane, fire, and financial-instrument safety. The reasons are complicated, but basically, sellers don't compete on safety features because buyers can't efficiently differentiate products based on safety considerations. The race-to-the-bottom mechanism that markets use to minimize prices also minimizes quality. Without government intervention, the IoT remains dangerously insecure. The US government has no appetite for intervention, so we won't see serious safety and security regulations, a new federal agency, or better liability laws. We might have a better chance in the EU. Depending on how the General Data Protection Regulation on data privacy pans out, the EU might pass a similar security law in 5 years. No other country has a large enough market share to make a difference. <https://www.schneier.com/blog/archives/2017/10/iot_cybersecuri.html>

1 0

GPL Abuse In The Linux Kernel
by Lawrence D'Oliveiro 18 Oct '17

18 Oct '17

The questionable legal activities of a former Linux kernel developer <http://www.theregister.co.uk/2017/10/18/linux_kernel_community_enforcement_…> have driven a bunch of senior kernel figures to issue a “Community Enforcement Statement” to try to put a stop to this sort of thing in the future. What’s interesting about this is their admission that the GPL 2.0 has “ambiguities … that no one in our community has ever considered part of compliance”. And to fix it, their Statement “adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified”. Do you remember back when GPL 3.0 came out, and Linus Torvalds and other senior kernel figures issued a statement claiming that they were quite happy with GPL 2.0, they had no intention of moving to GPL 3.0, which he quite publicly loathed? Seems like now they are slowly coming to a realization of the reasons why GPL 3.0 was created in the first place...

1 0

Ah, The Joys Of Debian Unstable ...
by Lawrence D'Oliveiro 17 Oct '17

17 Oct '17

Did my (roughly) monthly system upgrades over the last couple of days. Debian has changed the default Python version for the “python3” command to 3.6. (And Blender now requires that version for building as well.) Didn’t notice anything broken until today, when I tried to print something on my HP inkjet. Turns out the various HP/CUPS-related packages with version number 3.17 want the system default Python to be 3.5, not 3.6. In situations like these, the first thing I have learned to try is to manually download older versions of packages from <http://ftp.debian.org/debian/> and install them with “dpkg -i”. For reference, these are the packages I downgraded: dpkg -i hplip-data_3.16.11+repack0-3_all.deb dpkg -i libhpmud0_3.16.11+repack0-3_amd64.deb dpkg -i libsane-hpaio_3.16.11+repack0-3_amd64.deb dpkg -i printer-driver-hpcups_3.16.11+repack0-3_amd64.deb dpkg -i hplip_3.16.11+repack0-3_amd64.deb And it worked. My printer now prints again. Presumably this will be sorted out in time for my next upgrade ...

1 3

Unlikely Things Running Linux
by Lawrence D'Oliveiro 16 Oct '17

16 Oct '17

>From the International Space Station and Large Hadron Collider, through self-driving cars, an electric motorbike and a solar-powered surfboard, down to a milking machine, Computer Engineer Barbie and a crockpot, Brian Lunduke presents a quick tour of just some of the unlikely places you will find a computer running Linux <https://www.youtube.com/watch?v=xPbAXKMCDkY>. Complete with a sting in the tail for those who uncritically subscribe to the old “do one thing and do it well” misconception...

1 0

meeting suggestions?
by Peter Reutemann 16 Oct '17

16 Oct '17

Hi everyone Since we had no volunteers for demoing "Sogo Groupware Server" (Roger?), does anybody else have a topic for next Monday's meeting? Ubuntu 17.10 should be out then... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

qTox – An Open Source P2P Instant Messaging and VoIP App
by Peter Reutemann 16 Oct '17

16 Oct '17

'As you probably already know, GNU/Linux has no shortage of VoIP apps. We’ve written on Wire and Discord. And we even compiled a list of The 10 Best Instant Messaging Apps for Linux. Today, we’ve got a new app to add to our list of instant messaging apps and it goes by the name of qTox. qTox is a free and open source p2p instant messaging, audio and video calls app and is (apparently) the most feature-rich Tox client. As a powerful Tox client, it follows Tox’s design guidelines while maintaining a uniform UI/UX across all the major platforms. It is built with privacy as its paramount goal and the team has even made a public statement that user safety is their priority and nothing in the world can change that.' -- source: https://www.fossmint.com/qtox-an-open-source-p2p-instant-messaging-and-voip… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Subsystem for Linux graduates in Windows 10 Fall Creators Update
by Peter Reutemann 16 Oct '17

16 Oct '17

'Interested in running Linux on Windows 10 with Windows Subsystem for Linux (WSL), but nervous about it being both a beta and only available in Windows 10 developer mode? Your worries are over. In the Windows 10 Fall Creators Update (WinFCU) WSL has graduated to being a Windows 10 feature that can be run by any user. Tested for over a year, WSL on WinFCU is bringing many new features to this combination of the Linux Bash shell and Windows. Besides WSL no longer being a beta or requiring users to be in developer mode, the new features include: Install Linux distros via the Windows Store - WSL now runs multiple Linux distros - WSL comes to Windows Server & Microsoft Azure VMs - WSL now supports USB/serial comms - Miscellaneous fixes and improvements Besides Ubuntu, the new WSL-supported Linux distros are SUSE's community openSUSE and its corporate SUSE Linux Enterprise Server (SLES). Fedora and other distros will arrive in the store shortly.' -- source: http://www.zdnet.com/article/windows-subsystem-for-linux-graduates-in-windo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Munich Plans New Vote on Dumping Linux For Windows 10
by Peter Reutemann 16 Oct '17

16 Oct '17

'The city of Munich has suggested it will cost too much to carry on using Linux alongside Windows, despite having spent millions of euros switching PCs to open-source software... "Today, with a Linux client-centric environment, we are often confronted with major difficulties and additional costs when it comes to acquiring and operating professional application software," the city council told the German Federation of Taxpayers. Running Linux will ultimately prove unsustainable, suggests the council, due to the need to also keep a minority of Windows machines to run line-of-business software incompatible with Linux. "In the long term, this situation means that the operation of the non-uniform client landscape can no longer be made cost-efficient"... Since completing the multi-year move to LiMux, a custom-version of the Linux-based OS Ubuntu, the city always kept a smaller number of Windows machines to run incompatible software. As of last year it had about 4,163 Windows-based PCs, compared to about 20,000 Linux-based PCs. The assessment is at odds with a wide-ranging review of the city's IT systems by Accenture last year, which found that most of the problems stem not from the use of open-source software, but from inefficiencies in how Munich co-ordinates the efforts of IT teams scattered throughout different departments. Dr. Florian Roth, leader of the Green Party at Munich City Council, said the review had also not recommended a wholesale shift to Windows. "The Accenture report suggested to run both systems because the complete 'rollback' to Windows and MS Office would mean a waste of experience, technology, work and money," he said... The city's administration is investigating how long it would take and how much it would cost to build a Windows 10 client for use by the city's employees. Once this work is complete, the council will vote again in November on whether this Windows client should replace LiMux across the authority from 2021. A taxpayer's federation post urged "Penguin, adieu!" -- while also admitting that returning to Windows "will devour further tax money in the millions," according to TechRepublic. "The federation's post also makes no mention of the licensing and other savings achieved by switching to LiMux, estimated to stand at about €10m."' -- source: https://linux.slashdot.org/story/17/10/15/2344244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Has Already Fixed the Wi-Fi Attack Vulnerability; Android Will Be Patched Within Weeks
by Peter Reutemann 16 Oct '17

16 Oct '17

'Microsoft says it has already fixed the problem for customers running supported versions of Windows. From a report: "We have released a security update to address this issue," says a Microsoft spokesperson in a statement to The Verge. "Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected." Microsoft is planning to publish details of the update later today. While it looks like Android and Linux devices are affected by the worst part of the vulnerabilities, allowing attackers to manipulate websites, Google has promised a fix for affected devices "in the coming weeks." Google's own Pixel devices will be the first to receive fixes with security patch level of November 6, 2017, but most other handsets are still well behind even the latest updates. Security researchers claim 41 percent of Android devices are vulnerable to an "exceptionally devastating" variant of the Wi-Fi attack that involves manipulating traffic, and it will take time to patch older devices.' -- source: https://mobile.slashdot.org/story/17/10/16/166220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of High-Security Crypto Keys Crippled by Newly Discovered Flaw
by Peter Reutemann 16 Oct '17

16 Oct '17

'Slovak and Czech researchers have found a vulnerability that leaves government and corporate encryption cards vulnerable to hackers to impersonate key owners, inject malicious code into digitally signed software, and decrypt sensitive data, reports ArsTechnica. From the report: The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. On Monday, officials posted this update. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-targeted individuals and organizations.' -- source: https://it.slashdot.org/story/17/10/16/1736252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nobel Prize Winner Argues Tech Companies Should Be Changing The World
by Peter Reutemann 16 Oct '17

16 Oct '17

'Tech companies are competing to serve the wealthy, argues the winner of the 2006 Nobel Peace Prize, complaining there's no "global vision," with big innovations instead "designed and dedicated mostly for commercial successes... while trillions of dollars are invested in developing robotics and artificial intelligence for military and commercial purposes, there is little interest in applying technology to overcome the massive human problems of the world." A genius in the tech industry "can dedicate his work to creating a medical breakthrough that will save thousands of lives -- or he can develop an app that will let people amuse themselves." As an exception, he cites the low-cost Endless computer, which runs Linux and has 50,000 Wikipedia articles pre-installed to enable offline research -- plus more than 100 applications -- for a price of just $79. "One part of Endless's business is operated like a conventional, profit-seeking company, while the other part is a social business that provides underserved populations with educational, health, and creative services they were once denied. Endless is already being shipped around the globe by four of the five largest computer manufacturers. It has become the leading PC platform in Indonesia and much of Southeast Asia. It has also been selected as the standard operating system for the Brazilian Ministry of Education, and in coming months it will be adopted as the primary platform by a number of other Latin American countries." The article is by Muhammad Yunus, who pioneered the concepts of microcredit and microfinance, and is taken from his new book, A World of Three Zeros: The New Economics of Zero Poverty, Zero Unemployment, and Zero Net Carbon Emission' -- source: https://news.slashdot.org/story/17/10/15/1739212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Olimex ships $284 open source Linux laptop kit
by Peter Reutemann 15 Oct '17

15 Oct '17

'Olimex is shipping its open source, Alwinner A64 based Teres-A64 laptop kit, with an 11.6-in LCD, 2GB RAM, 16GB eMMC, 9500mAh battery, and an Ubuntu Mate OS. Back in February, Bulgaria-based Olimex, which is known for its open spec OLinuXino SBCs like the Allwinner A64 based A64-OLinuXino, announced an open source laptop kit based on the same quad-core, Cortex-A53 SoC called the Teres-1. The Ubuntu Mate-supported laptop kit took longer than expected, but it’s finally here as the Teres-A64, selling for 240 Euros ($284) instead of 225 Euros.' -- source: http://linuxgizmos.com/olimex-ships-open-source-linux-laptop-and-tips-new-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 17.10 (Artful Aardvark) Is Now in Final Freeze, Launches October 19
by Peter Reutemann 15 Oct '17

15 Oct '17

'Work on Ubuntu 17.10 begun six months ago, on April 20, when the toolchain was uploaded to the repository, with the main goal of replacing our beloved Unity user interface with the latest GNOME 3 desktop environment. Two Alpha and Beta milestones later, Ubuntu 17.10 is now officially in Final Freeze stage. "As of now, artful has entered the Final Freeze period in preparation for the final release of Ubuntu 17.10 next week," said Adam Conrad, Software Engineer at Canonical, in a mailing list announcement. "The current uploads in the queue will be reviewed and either accepted or rejected as appropriate by pre-freeze standards." Of course, this means that developers won't be able to update any of the packages they maintain, except for those that fix critical bugs affecting the ISO images or the installer. Patches for 0-day security vulnerabilities are also welcome during the Final Freeze stage, which will last until next week, on October 19, 2017.' -- source: http://news.softpedia.com/news/ubuntu-17-10-artful-aardvark-is-now-in-final… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Switch to Xorg from Wayland in Ubuntu 17.10 [Quick Tip]
by Peter Reutemann 15 Oct '17

15 Oct '17

"One of the main new features in Ubuntu 17.10 is the addition of Wayland as the default display server. As more and more Linux distributions are moving away from the legacy X.Org server and Wayland seems to be the top alternative. While Wayland maybe the future, it really is in future. At least for Ubuntu 17.10. The issue here is that a number of Linux desktop applications still depend on X.Org. They don’t support Wayland very well." -- source: https://itsfoss.com/switch-xorg-wayland/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android ransomware "DoubleLocker"
by Eric Light 15 Oct '17

15 Oct '17

Anyone out there still trust Adobe Flash Player? "DoubleLocker can change the device’s PIN, preventing victims from accessing their devices, and also encrypts the data it finds in them – a combination that has not been seen previously in the Android ecosystem. [...] It is distributed mostly as a fake Adobe Flash Player through compromised websites. First, it changes the device’s PIN, effectively blocking the victim from using it. The new PIN is set to a random value which the attackes neither store nor send anywhere, so it’s impossible for the user or a security expert to recover it. After the ransom is paid, the attacker can remotely reset the PIN and unlock the device. Second, DoubleLocker encrypts all files from the device’s primary storage directory. It utilizes the AES encryption algorithm, appending the extension “.cryeye”. “The encryption is implemented properly, which means that, unfortunately, there is no way to recover the files without receiving the encryption key from the attackers,” says Štefanko. https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-m… -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

SUSE Shares Linux-Themed Music Video Parodies
by Peter Reutemann 15 Oct '17

15 Oct '17

'German Linux company SUSE Linux is well-known for its Linux and other open source solutions. It is also known for producing videos for geeks and debuting them at its annual SUSECon conference. This year, in Prague, was no different. The company, which marked its 25th year on 2 September, came up with two videos, one to mark the occasion and the other all about Linux and open source. Both videos are parodies of well-known songs: the video Linus Said is based on "Momma Said", while 25 Years is a parody of "7 Years". Some of the lyrics in both SUSE videos would be meaningless to the average person -- but every word will ring a bell, sometimes a very poignant one, with geeks. And that's the primary audience it targets. The article embeds both videos -- and also links to the music videos they're parodying. And it includes links to SUSE's two previous annual music video parodies -- Uptime Funk (based on Bruno Mars' blockbuster hit "Uptown Funk"), and Can't Stop the SUSE, a parody of Justin Timberlake's "Can't Stop the Feeling".' -- source: https://linux.slashdot.org/story/17/10/15/0137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unpatched Exploit Lets You Clone Key Fobs and Open Subaru Cars
by Peter Reutemann 15 Oct '17

15 Oct '17

'Tom Wimmenhove, a Dutch electronics designer, has discovered a flaw in the key fob system used by several Subaru models, a vulnerability the vendor has not patched and could be abused to hijack cars. The issue is that key fobs for some Subaru cars use sequential codes for locking and unlocking the vehicle, and other operations. These codes -- called rolling codes or hopping code -- should be random, in order to avoid situations when an attacker discovers their sequence and uses the flaw to hijack cars. This is exactly what Wimmenhove did. He created a device that sniffs the code, computes the next rolling code and uses it to unlock cars... The researcher said he reached out to Subaru about his findings. "I did [reach out]. I told them about the vulnerability and shared my code with them," Wimmenhove told BleepingComputer. "They referred me to their 'partnership' page and asked me to fill in a questionnaire. It didn't seem like they really cared and I haven't heard back from them." His Subaru-cracking feat -- documented in a video -- was accomplished using a $25 Raspberry Pi B+ and two dongles, one for wifi ($2) and one for a TV ($8), plus a $1 antenna and a $1 MCX-to-SMA convertor.' -- source: https://tech.slashdot.org/story/17/10/14/230254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Everybody Has To Be A Software Company Now
by Lawrence D'Oliveiro 14 Oct '17

14 Oct '17

Wireless speakers made by Pure no longer work with Apple’s newest phone OS, because it has dropped the ability to run 32-bit apps--everything must now be 64-bit-only <http://www.theregister.co.uk/2017/10/12/ios_11_knackers_neglected_pure_conn…>: Part of the problem, it seems, is Pure's inability to maintain and update its own apps, and it is most likely not alone in this respect: companies that have outsourced their mobile app programming are finding themselves locked out of iOS 11 because they can't get the code or the tools or the people to rebuild their contract-developed software. The iOS App Store shows that the last update to Pure Connect was on June 25, 2015, more than two years ago, so Pure has been without a mobile developer for a while, it seems. More and more consumer products need ongoing software updates now. But the companies selling those products are having trouble getting to grips with that fact.

3 2

Impersonating Password Prompts
by Lawrence D'Oliveiro 13 Oct '17

13 Oct '17

An old problem which never seems to be quite solved: how do you distinguish pieces of software on a platform that have a legitimate need to request a password from you, from those which don’t? <https://www.schneier.com/blog/archives/2017/10/impersonating_i.html>

1 0

XikiHub: The Social Command Line
by Peter Reutemann 13 Oct '17

13 Oct '17

'In 2014, Craig Muth developed an open source alternative shell called Xiki (executable wiki) which combined shell and GUI concepts and tried making the shell console more friendly and powerful. The selection was easier with arrow keys or with mouse clicks and there was the option to create menus to access other tools with ease. And, all of this was made possible for beginners with little to no knowledge about the command line. ' [see archive link here: https://list.waikato.ac.nz/pipermail/wlug/2014-June/012983.html] 'Now, Xiki is going a step further with XikiHub by adding a social element to commands. XikiHub aims to be a social repository where you can discover thousands of examples and interfaces contributed from users all over the world. You can pick up the one you like, create your own and contribute it to the social repository. The idea behind XikiHub is to create a social platform where any Xiki user can share a command he/she created that can be picked up and used by any other user. It will include a quick install step that will provide the option to review before installing a command.' -- source: https://itsfoss.com/xikihub-social-command-line/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Endless OS Is First Linux Distro to Support Flatpak Apps from Flathub by Default
by Peter Reutemann 13 Oct '17

13 Oct '17

'Flatpak has been around for some time now, and it's gaining more and more popularity among GNU/Linux distributions. Endless OS is the latest to announce that it brings support for Flatpak apps, though it's the first to offer support for this universal binary format directly from the Flathub repository, by default. Last month, the Flatpak developers over at Red Hat announced that their Flathub software repository received a modern, web-based frontend, which allows users to easily browse all available Flatpak apps at a glance, and developers to add their own Flatpaks to the list of more than 100 apps.' -- source: http://news.softpedia.com/news/endless-os-is-first-linux-distro-to-enable-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Linux smartphone makes its $1.5 million crowdfunding goal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Hundreds of millions are happy with Android smartphones and iPhones. But there are some users who want the maximum possible control over their smartphones. For those people, Purism now has the funding it needs for its free-software smartphone without a trace of proprietary code or firmware: The Purism Librem 5 smartphone. At first, it appeared Purism wouldn't make its $1.5-million goal. The Librem 5 crowdfunding campaign staggered forward at first. Them, when KDE and then GNOME threw their support behind the project, the project picked up steam.' -- source: http://www.zdnet.com/article/purism-linux-smartphone-makes-its-1-5-million-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

How to test internet speed in Linux terminal
by Peter Reutemann 12 Oct '17

12 Oct '17

'Most of us check the internet bandwidth speed whenever we connect to new network or wifi. So why not our servers! Here is a tutorial which will walk you through to test internet speed in Linux terminal. Everyone of us generally uses Speedtest by Ookla to check internet speed. Its pretty simple process for a desktop. Goto their website and just click GO button. It will scans your location and speed test with nearest server. If you are on mobile, they have their app for you. But if you are on terminal with command line interface things are little different. Lets see how to check internet speed from Linux terminal.' -- source: https://kerneltalks.com/tips-tricks/how-to-test-internet-speed-in-linux-ter… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Europe pledges support for open source government solutions
by Peter Reutemann 12 Oct '17

12 Oct '17

'Estonia has long been the digital envy of many European Union member states. An effective and open policy approach to digital government has yielded extraordinary results—from 90%+ uptake of electronic identification (E-ID) solutions to an open source e-government platform (X-Road) to meet the ever-growing expectations of IT-savvy citizens as well as other countries wanting to pool IT across borders. It was thus fitting that Estonia, the current EU presidency, brought together Ministers from 32 countries (under the umbrellas of the EU and European Free Trade Association) to adopt the Tallinn Declaration on E-Government, creating a renewed political dynamism coupled with legal tools to accelerate the implementation of a range of existing EU policy instruments (e.g., the e-Government Action Plan and ISA² program). Perhaps the most significant development for open source supporters is the explicit recognition of open source software (OSS) as a key driver towards achieving ambitious governmental digitisation goals by 2020.' -- source: https://opensource.com/article/17/10/eu-open-source Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Enable Fractional Scaling in Gnome
by Peter Reutemann 12 Oct '17

12 Oct '17

'Fractional scaling is practically necessary if you’re running a HiDPI display, and you want your desktop to scale uniformly to match your display. It’s always been an issue on Linux, but the latest version of the GNOME desktop has implemented a true fractional scaling feature to keep your desktop looking good. Even though GNOME 3.26 does have fractional scaling support, it wasn’t mature enough to make the release. As a result, it’s still a testing feature that you need to enable yourself.' -- source: https://www.maketecheasier.com/enable-fractional-scaling-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sonos Speakers: Refuse Updates, They Stop Working
by Lawrence D'Oliveiro 12 Oct '17

12 Oct '17

In August, when wireless speaker maker Sonos decided to update its privacy policy to allow it to gather more data on its customers from their devices, it characterized the consequences of refusing to accept the change as being left out of future feature upgrades. ... "If you choose not to provide the functional data, you won't be able to receive software updates," a Sonos spokesperson explained at the time. "It's not like if you don't accept it, we'd be shutting down your device or intentionally bricking it." ... However, the [spokesperson] acknowledged that a few people who have updated their apps, manually or through automatic updates, have ended up with software on their handsets that isn't compatible with their firmware – which did not update because they would not accept the privacy policy change. <http://www.theregister.co.uk/2017/10/11/sonos_privacy_speakers/>

1 0

Adventures In E-Mail
by Lawrence D'Oliveiro 11 Oct '17

11 Oct '17

I am currently messing about with a virtual private server at Rimu Hosting, with a view to have it take over my e-mail serving after Vodafone turns off its provision of that service. Eventually I will have an MX record for my domain pointing at that server, so it will receive all e-mail addressed to me. Next part is, I want to periodically suck all that mail back to my main office machine. Currently I have a cron task that periodically connects to Vodafone’s POP server, fetches all the mail, and delivers it locally. When I try to do the same thing with the VPS, my local Postfix bounces the attempt at local delivery, saying something like <user(a)domain> (expanded from <user>): mail forwarding loop for user(a)domain A bit of hunting around online found this <http://postfix.1071664.n5.nabble.com/What-is-causing-this-mail-forwarding-l…> likely discussion, where the problem seems to be that the incoming message already has a “Delivered-To:” header pointing at my e-mail address, so Postfix concludes that the message is stuck in a forwarding loop, and refuses to pass it on. The exchange ends with this response from Wietse Venema, “Mr Postfix” himself: You can use header_checks to remove the problem header, but I will not help with implementing such iodiocy. Hmm, looking at the local(8) man page, it says In order to stop mail forwarding loops early, the software adds an optional Delivered-To: header with the final envelope recipient address. If mail arrives for a recipient that is already listed in a Delivered-To: header, the message is bounced. The key being that word “optional”. So it looks like I simply have to disable the addition of “Delivered-To:” on the VPS. Stay tuned.

2 3

OpenBSD 6.2 Released
by Peter Reutemann 10 Oct '17

10 Oct '17

'OpenBSD 6.2 has now been released. Some of the new features and systems include improved hardware support, vmm(4)/ vmd(8) improvements, IEEE 802.11 wireless stack improvements, generic network stack improvements, installer improvements, routing daemons and other userland network improvements, security improvements and more.' -- source: https://linux.slashdot.org/story/17/10/09/2029219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Now Has its First Open Source RISC-V Processor
by Peter Reutemann 09 Oct '17

09 Oct '17

'"SiFive has declared that 2018 will be the year of RISC V Linux processors," writes Design News. An anonymous reader quotes their report: When it released its first open-source system on a chip, the Freeform Everywhere 310, last year, Silicon Valley startup SiFive was aiming to push the RISC-V architecture to transform the hardware industry in the way that Linux transformed the software industry. Now the company has delivered further on that promise with the release of the U54-MC Coreplex, the first RISC-V-based chip that supports Linux, Unix, and FreeBSD... This latest development has RISC-V enthusiasts particularly excited because now it opens up a whole new world of use cases for the architecture and paves the way for RISC-V processors to compete with ARM cores and similar offerings in the enterprise and consumer space... "The U54 Coreplexes are great for companies looking to build SoC's around RISC-V," Andrew Waterman co-founder and chief engineer at SiFive, as well as the one of the co-creators of RISC-V, told Design News. "The forthcoming silicon is going to enable much better software development for RISC-V." Waterman said that, while SiFive had developed low-level software such as compilers for RISC-V the company really hopes that the open-source community will be taking a much broader role going forward and really pushing the technology forward. "No matter how big of a role we would want to have we can't make a dent," Waterman said. "But what we can do is make sure the army of engineers out there are empowered." ' -- source: https://hardware.slashdot.org/story/17/10/09/0019212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review by many eyes does not always prevent buggy code
by Peter Reutemann 09 Oct '17

09 Oct '17

'There is a view that because open source software is subject to review by many eyes, all the bugs will be ironed out of it. This is a myth.' -- source: https://opensource.com/article/17/10/many-eyes Even if a project has many contributors, you will get a lot of contributors in areas that are easy to contribute in (eg spelling, expanding documentation, simple additions) and hardly anyone in the difficult areas. The less contributors in an area, the less likely they will overlap and therefore the less code review will happen. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 8

4 Best Modern Open Source Code Editors For Linux
by Peter Reutemann 09 Oct '17

09 Oct '17

According to the author of the article referenced below, these are: - Brackets - Atom - Light Table - Visual Studio Code -- source: https://itsfoss.com/best-modern-open-source-code-editors-for-linux/ No, not trying to start another flame war here. However, it doesn't hurt pointing out alternatives. After all, it is all about choice. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Install Multiple Linux Distributions on One USB
by Peter Reutemann 09 Oct '17

09 Oct '17

'MultiBootUSB is a free and open source cross-platform application which allows you to create a USB drive with multiple Linux distributions. It also supports uninstalling any distribution at any point in time, so you can reclaim space on your drive for another one.' -- source: https://itsfoss.com/multiple-linux-one-usb/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Licensing Pirate Sites
by Lawrence D'Oliveiro 07 Oct '17

07 Oct '17

Fun fact: pirating US-made movies is not a crime in Iran ... provided you have a licence from the Government. So *licensed* pirate sites get to dob in *unlicensed* pirate sites for breaking the law. Got that? <https://www.techdirt.com/articles/20171003/09314138334/iran-cracks-down-mov…>

1 0

How to install Sogo Groupware Server on Debian
by Peter Reutemann 06 Oct '17

06 Oct '17

'Today we talk about Sogo. SOGo is a fully supported and trusted groupware server with a focus on scalability and open standards, is released under the GNU GPL/LGPL v2 and above. SOGo provides a rich AJAX-based Web interface and supports multiple native clients through the use of standard protocols such as CalDAV, CardDAV, and GroupDAV, as well as Microsoft ActiveSync. In this tutorial we'll install on Debian 8, a new version will be available soon.' -- source: https://www.howtoforge.com/tutorial/how-to-install-sogo-on-debian-8/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 6

OpenVPN And systemd Service Templates
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

The OpenVPN package on Debian comes with some systemd .service files to make VPN connections easier to manage. These (all located in /lib/systemd/system/) are named openvpn-client(a).service openvpn-server(a).service openvpn.service openvpn(a).service Note the @-signs in the names of three of them: these indicate “template” services, each of which can be “instantiated” any number of times, to create multiple service “instances”. There seem to be two alternative ways of defining your OpenVPN services here: the first two .service files let you define and manage client-end and server-end connections individually, and require you to start and stop them separately, while the latter two don’t bother distinguishing between client-end and server-end (this is purely up to the respective OpenVPN configurations), they are all defined by instantiating “openvpn(a).service”. The non-template file, “openvpn.service”, can then be used to start and stop all these instances at once. (It could be that the first two represent an older way of managing connections, while the latter two are a newer, unified, more flexible way. But hey...) To illustrate how template instantiations work, I have been setting up a VPN link between a virtual private server at Rimu Hosting and the Internet router machine in my office. The VPS (with the fixed IP address) is the server end, while my office end is the client. On the server, I create a config file named /etc/openvpn/server/office.conf that appropriately defines the server end of the connection. The name “office” now automatically becomes the name of the instance: to start this, I just type systemctl start openvpn-server(a)office and systemd automatically fills in the name “office” in place of the “%i” placeholder in the contents of the openvpn-server(a).service template file, and executes the appropriate openvpn command. (One of the occurrences of %i is in the name of the config file.) At the client end, I create a config file named /etc/openvpn/client/vps.conf that appropriately defines the client end of the connection. Here the instance name is “vps”, so the systemd command to launch openvpn at the client end is systemctl start openvpn-client(a)vps and as before, instances of “%i” in the template are replaced with the instance name, “vps”. (As before, %i is also used to produce the name of the config file.) Of course, manually starting and stopping OpenVPN instances may be fine for testing, but for production use you want this to happen automatically at boot time. Just change the systemctl “start” commands to “enable”, and it’s done.

1 0

Intel Versus AMD
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

Comparing current high-end CPU offerings from the two x86 vendors <https://arstechnica.co.uk/gadgets/2017/09/intel-core-i9-7960x-review/>, it’s clear AMD has bounced back from many years in the “also-ran” back row with its “Ryzen” and “Threadripper” offerings: The difference is that AMD bet on a massively multicore future for consumers and prosumers, designing an architecture with dramatic scaling in mind, when Intel was still umming and ahhing whether to bring six-core chips to the mainstream. So if you make heavy use of multithreaded software, for example 3D rendering, video encoding, or large software builds, then AMD currently has a significant price/performance edge. Interesting that one of the benchmarks is “Blenchmark”, which involves using Blender to render a 3D BMW car model, while another builds Google’s Chromium browser from source.

1 0

How Bulletproof Hosting Works
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

“Bulletproof” hosting providers tout their ability to stay online in spite of the efforts of law enforcement to shut them down. Here is a report <http://www.theregister.co.uk/2017/10/05/bulletproof_hosting/> into some research detailing how they manage to keep operating: One service cited by the work is a cloud proxy network that abuses the services of legitimate providers including AWS and TenCent. The product ... typically costs $250/month/domain and maintains operations by cycling through an enormous number of providers – 230 in just nine days, according to the researchers. ... Another provider ...is still in business despite being raided three times ... Operating out of political hotspots gives some BPH operations another shield against takedown attempts.

1 0

How Do Sysadmins Manage Patches?
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

The infamous Equifax breach (which has compromised the personal information belonging to 140 million Americans) was down to a vulnerability in an application library which had already been discovered and a patch issued months before, but the patch was never applied at the company. Why does this sort of thing keep happening? Here is a research survey <https://freedom-to-tinker.com/2017/10/04/avoid-an-equifax-like-breach-help-…> being undertaken to try to better understand the real-world constraints under which companies operate, with a view to making the software update process more effective (i.e. more likely to be followed).

1 0

HP Shared ArcSight Source Code With Russians
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

Bruce Schneier repeats a point that should be well-known about security and Open Source, but which some still have trouble grasping: This is one of the areas where open-source software has a security edge. If everyone has access to the source code -- and security doesn't depend on its secrecy -- then there's no advantage in getting a copy. As long as companies rely on obscurity for their security, these sorts of attacks are possible and profitable. <https://www.schneier.com/blog/archives/2017/10/hp_shared_arcsi.html>

1 0

Return Of The Algorithm Monster: YouTube Auto-Promoted Conspiracy Theory Videos
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

During the [Wall Street Journal]'s Tuesday test, searches for hot-topic terms like "Las Vegas shooting" and "NFL anthem protest," along with the term "9/11," each brought up top-five video posts, specifically listed in the site's "Top News" box, whose titles and content were loaded with debunked and misleading content. The fifth result for "Las Vegas shooting" was titled "Proof Las Vegas Shooting Was a FALSE FLAG attack—Shooter on 4th Floor" and claimed that multiple shooters had been involved, in spite of Vegas officials stating otherwise. <https://arstechnica.com/gaming/2017/10/return-of-the-algorithm-monster-yout…>

1 0

“Your Account eStatement For February”
by Lawrence D'Oliveiro 05 Oct '17

05 Oct '17

It took me a few seconds to parse this one. Dear Customer Attached is your provisional statement with the new charges. For your security it has been encrypted. This means that you will need a decoder to view your statement. Before you can view your statement, you must Download the attachment and install the decoder. Read that far, and initially thought “for crying out loud, another bloody piece of Windows-only software”. Then a few seconds later, it dawned on me that, while it claimed to come from the right bank, the from-address <JOhnEdwarD011(a)gaea.ocn.ne.jp> couldn’t be that of any bank. It wasn’t until after I’d filed it as a scam that I noticed the most glaring thing: “February”??

1 0

World’s First 14TB Drive
by Lawrence D'Oliveiro 04 Oct '17

04 Oct '17

Western Digital has announced a drive using shingled media recording to push the capacity up to 14TB <http://www.theregister.co.uk/2017/10/03/wdc_14tb_disk_drive_hs14/>. Unfortunately, this recording technique complicates (and slows down) writing, so it is meant for applications where data is read a lot, and updated less frequently.

1 0

Timeshift A System Restore Utility Tool Review
by Peter Reutemann 03 Oct '17

03 Oct '17

'TimeShift is a system restore tool for Linux. It provides functionality that is quite similar to the System Restore feature in Windows or the Time Machine tool in MacOS. TimeShift protects your system by making incremental snapshots of the file system manually or at regular automated intervals. These snapshots can then be restored at a later point to undo all changes to the system and restore it to the previous state. Snapshots are made using rsync and hard-links and the tool shares common files amongst snapshots in order to save disk space' -- source: http://www.linuxandubuntu.com/home/timeshift-a-system-restore-utility-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Quote Of The Week From UK Home Sec Amber Rudd
by Lawrence D'Oliveiro 03 Oct '17

03 Oct '17

"I don't need to understand how encryption works to understand how it's helping – end-to-end encryption – the criminals. I will engage with the security services to find the best way to combat that." <http://www.theregister.co.uk/2017/10/03/amber_rudd_still_does_not_understan…>

1 0

Asciinema – Record Terminal Sessions And Share Them On The Web
by Peter Reutemann 03 Oct '17

03 Oct '17

'I already know about recording the Terminal activities using “script” command in Unix-like systems. Today, I found out yet another similar utility called “asciinema” that can used to record Terminal sessions. Forget about the heavy screen-recording tools and/or apps. Asciinema is a fast, light-weight and open source Terminal recording tool. Unlike “script” command, Asciinema not just records our Terminal activities, but also helps us to share them on the web if necessary. You can share the recordings by copying its URL and sending it to a friend or posting it on a social network. It supports Linux, Mac OS X and *BSD.' -- source: https://www.ostechnix.com/asciinema-record-terminal-sessions-share-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android users rejoice! Linux kernel LTS releases are now good for 6 years
by Peter Reutemann 02 Oct '17

02 Oct '17

'A major change in the maintenance lifecycle of Linux kernels is coming. During a Linaro Connect 2017 presentation on Android's Project Treble, Googler Iliyan Malchev announced that Linux LTS (Long Term Support) kernels were switching from a two-year lifecycle to a whopping six years of support. The free and open source Linux kernel powers most of the devices around us. It's not only present in computers and servers, it also powers most of the ARM devices on earth, so it's present in Android devices, the Internet of things, and almost anything else you can call "smart." Major new versions of the Linux kernel arrive about every 70 days. Not everyone wants to upend their existing system every 70 days to upgrade to the new kernel, though, so to help with this, the Linux kernel has traditionally had a "Long Term Support (LTS)" kernel, which is supported for two years. Rather than do a major kernel bump, devices can keep running an LTS kernel and regularly get bug and security fixes, which aren't as disruptive as full releases.' -- source: https://arstechnica.com/gadgets/2017/09/android-users-rejoice-linux-kernel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User’s Adventures In Linux
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

I helped an elderly friend set up his new PC yesterday. His previous machine, over a decade old, was running Windows XP. I had set up an Ubuntu dual-boot a few years back, and he liked playing the games. But then the Linux boot stopped working--there was a message to the effect “hd0 out of disk”, which sounded like a GRUB problem (“hd0” being a GRUB disk name, not a Linux disk name). I booted up SystemRescueCD, and found that disk space was ample. I did an fsck on the Linux volume, and found no filesystem problems. I ran a badblocks scan, and it reported several bad sectors, though oddly they only seemed to be in the Windows partition (if I interpreted the numbers correctly). Naturally I searched online, but the hits I found for that error message didn’t seem very helpful. Reinstalling GRUB didn’t help, so I concluded there were likely other hardware problems, so time for a new machine. He got an entry-level dual-core AMD box from PBTech--their own house build, in a CoolerMaster case--for well under a grand. Nothing fancy, but good enough for his needs--mainly Web browsing, e-mail, a little bit of word processing, and those games. The PBTech box came without an OS. He could have got Windows 10 for it, but considering he would be facing a learning curve coming from XP regardless, I suggested going 100% Linux for all his daily needs, to see if that would work. He could always spend the $160-odd extra on Windows later if need be. So I set it up with Linux Mint, since that seems to be everybody’s favourite :). He was already using Firefox on Windows, so moving all his Web bookmarks across was easy. The Mint install put an icon for Thunderbird on the desktop by default, so I decided to try that for e-mail. Getting his address book across from Outlook Express was fairly straightforward, once I figured out how to map the exported CSV field names correctly. The mail messages were slightly more fiddly, but I found this extension <https://addons.mozilla.org/en-US/thunderbird/addon/importexporttools/> which directly loads Microsoft’s .dbx files, and that seemed to work OK. Then he wanted to play CDs. When we put in an audio CD, it came up with options to run Banshee (media player) or Brasero (disc burner). The Banshee media player wouldn’t play the CD directly, it insisted on ripping it to the hard drive first. This was not really what he wanted. I had a look round, and found KsCD, which will indeed play audio CDs without trying to rip them to audio files first. As far as I know, this is the only GUI Linux app that can do so. So, day 1 ended on a reasonably successful note. He was already noticing how much faster the new machine was. So we’ll see how it goes from here...

5 13

Well, That’s One Way For A Site To Make Money ...
by Lawrence D'Oliveiro 30 Sep '17

30 Sep '17

Would you let a website run a Bitcoin miner in your browser? <https://www.techdirt.com/articles/20170928/11262538304/showtime-wont-explai…>

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by rowan schischka 29 Sep '17

29 Sep '17

>Does a system of assigning point scores to people make things better ... or worse? Gamifying an internet forum/social media; My experience with stackoverflow is it really rewards people who have a lot of spare time. The problem of measuring work is, the work will be moulded by your method of measurement. Any point/scoring/KPI system results in cheating & corner cutting in some way.

1 0

Java Security Plagued By Crappy Docs, Complex APIs, Bad Advice
by Lawrence D'Oliveiro 29 Sep '17

29 Sep '17

... researchers from Virginia Tech contend more care needs to be taken when copying code from accepted Stack Overflow answers, at least in the context of Java. ... they found that many of the answers endorsed by the Stack Overflow community led to insecure code. For example, accepted answers often recommended the use of MD5 and SHA-1 crypto algorithms – despite the fact that they're insecure and should not be used. ... They also observed that in some instances, the higher social reputation of Stack Overflow respondents led to incorrect answers being accepted over more correct fixes offered by individuals with lesser reputation scores. <http://www.theregister.co.uk/2017/09/29/java_security_plagued_stack_overflo…>

2 2

Internet Explorer Bug Leaks Whatever You Type In the Address Bar
by Peter Reutemann 28 Sep '17

28 Sep '17

'The latest version of Internet Explorer has a bug that leaks the addresses, search terms, or any other text typed into the address bar. The flaw was disclosed Tuesday by security researcher Manual Caballero. Ars Technica reports: The bug allows any currently visited website to view any text entered into the address bar as soon as the user hits enter. The technique can expose sensitive information a user didn't intend to be viewed by remote websites, including the Web address the user is about to visit. The hack can also expose search queries, since IE allows them to be typed into the address bar and then retrieved from Bing or other search services. The proof-of-concept makes it transparent that the attacking website is viewing the entered text. The hack, however can easily be modified to make the information theft completely stealthy. A proof-of-concept site shows the exploit in action.' -- source: https://tech.slashdot.org/story/17/09/28/0245228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Pop!_OS Beta Ubuntu-based Linux Distribution Now Available To Download
by Peter Reutemann 28 Sep '17

28 Sep '17

'Next month, a new era of Ubuntu begins. Unity is dead, and GNOME 3 takes over as the default desktop environment. While this change was for the best, it was still shocking for many. For a company like System76, for instance, that sells computers pre-loaded with Ubuntu, this was problematic. Why? Well, the company essentially lost control of the overall user experience by relying on vanilla Ubuntu. It was being forced to follow Canonical's path. To solve this, and regain some control, System76 has been developing its own operating system called 'Pop!_OS.' No, it is not reinventing the wheel here -- it will still use Ubuntu as a base, and GNOME will be the desktop environment. The company is customizing the operating system, however, with things like fonts, themes, and icons, to create something truly unique. This could lead to an improved user experience. Today, the first official beta of the operating system becomes available for download.' -- source: https://linux.slashdot.org/story/17/09/28/190247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World's First Blockchain Smartphone Is In Development
by Peter Reutemann 28 Sep '17

28 Sep '17

'A company called Sirin Labs is developing an open-source smartphone that runs on a fee-less blockchain. "The Finney -- named in honor of bitcoin pioneer Hal Finney -- will be the only smartphone in the world that's fully secure and safe enough to hold cryptographic coins," reports Engadget. The company is launching a crowdsale event this October (date to be confirmed) to support the phone's development. >From the report: According to Sirin, all Finney devices (there's an all-in-one PC coming, too) will form an independent blockchain network powered by IOTA's Tangle technology. The network will operate without centralized backbones or mining centers cluttering up the transaction process, using the SRN token as its default currency (only SRN token holders will be able to purchase the device). And it'll all run on a Sirin operating system specially designed to support blockchain applications such as crypto wallets and secure exchange access. The phone comes with all the bells and whistles you'd expect from a device with a $1,000 price tag, including a 256GB internal memory and 16MP camera, plus a hefty suite of security measures. ' -- source: https://mobile.slashdot.org/story/17/09/27/0749240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Firefox Quantum' Browser Challenges Chrome In Speed
by Peter Reutemann 28 Sep '17

28 Sep '17

'The next version of Firefox, aptly named Firefox Quantum, is getting a big speed boost. "The idea, of course, is that the upcoming version 57 is a quantum leap over predecessors -- or, in the words of Mozilla CEO Chris Beard, a 'big bang,'" reports CNET. While Mozilla stopped short of declaring victory over Chrome, Nick Nguyen, vice president of Firefox product, said Firefox Quantum's page-load speed "is often perceivably faster" while using 30 percent less memory. From the report: The new Firefox revamp includes lots of under-the-covers improvements, like Quantum Flow, which stamps out dozens of performance bugs, and Quantum CSS, aka Stylo, which speeds up website formatting. More obvious from the outside is a new interface called Photon that wipes out Firefox's rounded tabs and adds a "page action" menu into the address bar. It also builds in the Pocket bookmarking service Mozilla acquired and uses it to recommend sites you might be interested in. A screenshot tool generates a website link so you can easily share what you see by email or Twitter. Mozilla even simplified the Firefox logo, a fox wrapping itself around the globe. More improvements are in the pipeline for later Firefox versions, too, including Quantum Render, which should speed up Firefox's ability to paint web pages onto your screen. ' -- source: https://news.slashdot.org/story/17/09/27/0727226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Distrowatch opinion piece about DRM in browsers
by Ian Young 27 Sep '17

27 Sep '17

Some may not have seen an opinion piece in this week's Distrowatch Weekly. Link on front page to article by one Jesse Smith who does most of the reviews on DW. The W3C, encrypted media and software freedom ~ Ian Y

3 2

Manjaro Linux Discontinues 32-bit Support
by Peter Reutemann 26 Sep '17

26 Sep '17

'Recently, Philip, the lead developer of Manjaro Linux, announced that the project would be dropping support for the 32-bit architecture. He said that the reason for the move was “due to the decreasing popularity of i686 among the developers and the community”. While Manjaro 17.0.3 is the last release to have a 32-bit ISO, current 32-bit installs will receive a short window of continued support. During September and October, 32-bit package will continue to be updated. However, starting in November, packages will be limited to 64-bit. After that period, 32-bit installs of Manjaro will essentially be unsupported.' -- source: https://itsfoss.com/manjaro-drops-32-bit-support/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Krita 3.3 Digital Painting App Promises Better HiDPI Support on Linux & Windows
by Peter Reutemann 26 Sep '17

26 Sep '17

'In the release announcement, Krita devs reveal the fact that they were forced to bump the version number from 3.2.x to 3.3.x because the upcoming Krita 3.3 release will be introducing some important changes for Windows platforms, such as support for the Windows 8 event API, thus supporting the n-trig pen in Surface laptops. "Alvin Wong has implemented support for the Windows 8 event API, which means that Krita now supports the n-trig pen in the Surface line of laptops (and similar laptops from Dell, HP and Acer) natively. This is still very new, so you have to enable this in the tablet settings," said the devs.' -- source: http://news.softpedia.com/news/krita-3-3-digital-painting-app-promises-bett… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Clear Linux Project Announces the Next Generation of Intel's Clear Containers
by Peter Reutemann 26 Sep '17

26 Sep '17

Since I mentioned Clear Linux at last night's meeting... 'Rewritten in the Go language, Intel Clear Containers 3.0 introduces support for leveraging code used for namespace-based containers and better integrates into the container ecosystem, allowing support for Docker container engine and Kubernetes. It also improves the compatibility with the POSIX family of standards. "Today’s release presents a generational and architectural shift to utilize virtcontainers, a modular and hypervisor agnostic library for hardware virtualized containers. Clear Containers 3.0 is written in Go language and boasts an OCI compatible runtime implementation (cc-runtime) that works both on top of virtcontainers, and as a platform for deployment," said Amy L Leeland, Technical Program Manager, Intel Corporation. Additionally, this release ships with a new agent based on the libcontainer library that has been designed from the offset to let users apply filters and policies, such as the well-known SELinux and seccomp security facilities found in the Linux kernel, inside the Clear Containers guests.' -- source: http://news.softpedia.com/news/clear-linux-project-announces-the-next-gener… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tiny PocketBeagle is the RPi Zero of the BeagleBone world
by Peter Reutemann 25 Sep '17

25 Sep '17

'BeagleBoard.org’s tiny $25 PocketBeagle is a BeagleBone SBC clone, based on Octavo’s OSD3358-SM SiP module and offering micro-USB, microSD, and 72 I/O pins. BeagleBoard.org has released its smallest BeagleBone variant yet. The COM-like, 56 x 35 x 5mm PocketBeagle is a USB key-fob SBC built on the Octavo Systems OSD335x-SM System-In-Package (SiP) module that was announced earlier this week. Octavo’s 21 x 21mm SiP module, which packs a 1GHz Texas Instruments Sitara AM3358 SoC and nearly all the functions of a BeagleBone Black SBC into a BGA form factor, is 40 percent smaller than the original 27 x 27mm OSD335x.' -- source: http://linuxgizmos.com/tiny-pocketbeagle-is-the-rpi-zero-of-the-beaglebone-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman vs. Canonical's CEO: 'Will Microsoft Love Linux to Death?'
by Peter Reutemann 25 Sep '17

25 Sep '17

' TechRepublic got different answers about Microsoft's new enthusiasm for Linux from Canonical's founder and CEO Mark Shuttleworth, and from Richard Stallman. Stallman "believes that Microsoft's decision to build a Windows Subsystem for Linux (WSL) amounts to an attempt to extinguish software that users are free to run, copy, distribute, study, change and improve." "It certainly looks that way. But it won't be so easy to extinguish us, because our reasons for using and advancing free software are not limited to practical convenience," he said. "We want freedom. As a way to use computers in freedom, Windows is a non-starter..." Stallman remains adamant that the WSL can only help entrench the dominance of proprietary software like Windows, and undermine the use of free software. "That doesn't advance the cause of free software, not one bit," he says... "The aim of the free software movement is to free users from freedom-denying proprietary programs and systems, such as Windows. Making a non-free system, such Windows or MacOS or iOS or ChromeOS or Android, more convenient is a step backward in the campaign for freedom..." For Shuttleworth, Windows' embrace of GNU/Linux is a net positive for open-source software as a whole. "It's not like Microsoft is stealing our toys, it's more that we're sharing them with Microsoft in order to give everyone the best possible experience," he says. "WSL provides users who are well versed in the Windows environment with greater choice and flexibility, while also opening up a whole new potential user base for the open source platform..." Today Shuttleworth takes Microsoft's newfound enthusiasm for GNU/Linux at face value, and says the company has a different ethos to that of the 1990s, a fresh perspective that benefits Microsoft as much as it does open-source software. "Microsoft is a different company now, with a much more balanced view of open and competitive platforms on multiple fronts," he says. "They do a tremendous amount of engineering specifically to accommodate open platforms like Ubuntu on Azure and Hyper-V, and this work is being done in that spirit." The article also points out that Microsoft "does seem to be laying the groundwork for WSL to extend what's possible using a single GNU/Linux distro today, for instance, letting the user chain together commands from different GNU/Linux distros with those from Windows."' -- source: https://linux.slashdot.org/story/17/09/24/2132218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

ARM TrustZone Hacked By Abusing Power Management
by Peter Reutemann 24 Sep '17

24 Sep '17

'Many CPUs these days have DVFS (Dynamic Voltage and Frequency Scaling), which allows the CPU's clockspeed and voltage to vary dynamically depending on whether the CPU is idling or not. By turning the voltage up and down with one thread, researchers were able to flip bits in another thread. By flipping bits when the second thread was verifying the TrustZone key, the researchers were granted permission. If number 'A' is a product of two large prime numbers, you can flip a few bits in 'A' to get a number that is a product of many smaller numbers, and more easily factorable. "As the first work to show the security ramifications of energy management mechanisms," the researchers reported at Usenix, "we urge the community to re-examine these security-oblivious designs."' -- source: https://hardware.slashdot.org/story/17/09/23/2113243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sublime Text 3.0 is Here! See, How to Install it on Linux
by Peter Reutemann 22 Sep '17

22 Sep '17

Not an open-source editor, but still a favorite of a lot of people... 'The stable version of Sublime Text 3.0 has been released with major changes seen in almost every aspect of version 2.0. According to the release statement, “virtually every aspect of the editor has been improved in some way, and even a list of the major changes would be too long.”' -- source: https://itsfoss.com/sublime-text-3-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The CCleaner Malware Fiasco Targeted at Least 20 Specific Tech Firms
by Peter Reutemann 21 Sep '17

21 Sep '17

'Hundreds of thousands of computers getting penetrated by a corrupted version of an ultra-common piece of security software was never going to end well. But now it's becoming clear exactly how bad the results of the recent CCleaner malware outbreak may be. Researchers now believe that the hackers behind it were bent not only on mass infections, but on targeted espionage that tried to gain access to the networks of at least 20 tech firms. Earlier this week, security firms Morphisec and Cisco revealed that CCleaner, a piece of security software distributed by Czech company Avast, had been hijacked by hackers and loaded with a backdoor that evaded the company's security checks. It wound up installed on more than 700,000 computers. On Wednesday, researchers at Cisco's Talos security division revealed that they've now analyzed the hackers' "command-and-control" server to which those malicious versions of CCleaner connected. On that server, they found evidence that the hackers had attempted to filter their collection of backdoored victim machines to find computers inside the networks of 20 tech firms, including Intel, Google, Microsoft, Akamai, Samsung, Sony, VMware, HTC, Linksys, D-Link and Cisco itself. In about half of those cases, says Talos research manager Craig Williams, the hackers successfully found a machine they'd compromised within the company's network, and used their backdoor to infect it with another piece of malware intended to serve as a deeper foothold, one that Cisco now believes was likely intended for industrial espionage.' -- source: https://it.slashdot.org/story/17/09/21/1350214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Researchers Warn that Third-Party GO Keyboard App is Spying on Millions of Android Users
by Peter Reutemann 21 Sep '17

21 Sep '17

'Security researchers from Adguard have issued a warning that the popular GO Keyboard app is spying on users. Produced by Chinese developers GOMO Dev Team, GO Keyboard was found to be transmitting personal information about users back to remote servers, as well as "using a prohibited technique to download dangerous executable code." Adguard made the discovery while conducting research into the traffic consumption and unwanted behavior of various Android keyboards. The AdGuard for Android app makes it possible to see exactly what traffic an app is generating, and it showed that GO Keyboard was making worrying connections, making use of trackers, and sharing personal information. Adguard notes that there are two versions of the keyboard in Google Play which it claims have more than 200 million users in tot' -- source: https://it.slashdot.org/story/17/09/21/1959218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox For iOS Gets Tracking Protection, Firefox Focus For Android Gets Tabs
by Peter Reutemann 21 Sep '17

21 Sep '17

'Mozilla today released Firefox 9.0 for iOS and updated Firefox Focus for Android. The iOS browser is getting tracking protection, improved sync, and iOS 11 compatibility. The Android privacy browser is getting tabs. You can download the former from Apple's App Store and the latter from Google Play. This is the first time Firefox has offered tracking protection on iOS, and Nick Nguyen, vice president of product at Mozilla, notes that it's finally possible "thanks to changes by Apple to enable the option for 3rd party browsers." This essentially means iPhone and iPad users with Firefox and iOS 11 will have automatic ad and content blocking in Private Browsing mode, and the option to turn it on in regular browsing. This is the same feature that's available in Firefox for Android, Windows, Mac, and Linux, as well as the same ad blocking technology used in Firefox Focus for Android and iOS' -- source: https://news.slashdot.org/story/17/09/21/1953205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ISO Rejects NSA Encryption Algorithms
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

From <https://www.schneier.com/blog/archives/2017/09/iso_rejects_nsa.html>: The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It's because the NSA is not trusted to put security ahead of surveillance ... I don't trust the NSA, either. I should point out that SELinux was created by the NSA, too. The difference being that that has been subjected to years of careful independent scrutiny.

1 0

FSF Europe Calls For Taxpayer-Funded Software To Be Licensed For Free Re-use
by Lawrence D'Oliveiro 21 Sep '17

21 Sep '17

There are many things one can say about the US, but they have once nice law, at least at the Federal level--anything that might be copyrightable, that is created with taxpayer funds, is automatically in the public domain. For example, this is why everybody gets to have free use of all that stunning imagery from NASA. It also applies to US-Government-developed software as well. I have often wondered why other governments do not follow the same rule. Here in NZ, as in the UK, there is this weird concept of “Crown copyright”, which means that we, as taxpayers, do not get the use of material developed with our own money, we have to pay for it yet again. The European branch of the Free Software Foundation is calling for software developed with European taxpayer money to be made freely available in the same way <https://www.techdirt.com/articles/20170914/09163238207/free-software-founda…>.

3 4

GNOME Partners With Purism On Librem 5 Linux-based Privacy-focused Smartphone
by Peter Reutemann 20 Sep '17

20 Sep '17

'The Librem 5 smartphone by Purism has a long and difficult road ahead of it. Competing against the likes of Apple and Google on the mobile market has proven to be a death sentence for many platforms -- including Microsoft with its failed Windows 10 Mobile. Luckily, Purism has found itself a new partner on this project -- one of the most important organizations in the Linux community -- The GNOME Foundation. The GNOME Foundation explains, 'The Librem 5 is a hardware platform the Foundation is interested in advancing as a GNOME/GTK phone device. The GNOME Foundation is committed to partnering with Purism to create hackfests, tools, emulators, and build awareness that surround moving GNOME/GTK onto the Librem 5 phone. As part of the collaboration, if the campaign is successful the GNOME Foundation plans to enhance GNOME shell and general performance of the system with Purism to enable features on the Librem 5.'' -- source: https://linux.slashdot.org/story/17/09/20/1723246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Sep '17

20 Sep '17

Hi everyone I might give a quick run down on some security tools next week, depending how much time I have over the weekend (never used any of these apart from ClamAV): - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis Might show off the Pencil Project as well. A volunteer for demoing NixOS? https://nixos.org/ "completely declarative approach to configuration management" "atomic upgrades and rollbacks" Any other cool software that you'd like to demo for a few minutes? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache bug leaks contents of server memory for all to see—Patch now
by Peter Reutemann 20 Sep '17

20 Sep '17

'There's a bug in the widely used Apache Web Server that causes servers to leak pieces of arbitrary memory in a way that could expose passwords or other secrets, a freelance journalist has disclosed. The vulnerability can be triggered by querying a server with what's known as an OPTIONS request. Like the better-known GET and POST requests, OPTIONS is a type of HTTP method that allows users to determine which HTTP requests are supported by the server. Normally, a server will respond with GET, POST, OPTIONS, and any other supported methods. Under certain conditions, however, responses from Apache Web Server include the data stored in computer memory. Patches are available here and here.' -- source: https://arstechnica.com/information-technology/2017/09/apache-bug-leaks-con… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Breaking Your Bubble
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

A class project at Princeton <http://freedom-to-tinker.com/2017/09/19/breaking-your-bubble/>: In the first step, students measured their filter bubble. More specifically, for homework, at three different time points each week, they scrolled through their feeds until they found five political posts (ads included). Then, they coded these posts as either liberal, neutral, or conservative. Students also kept track of how many posts they had to scroll through to get to five posts as a measure of how much political content was in their feed. ... In the second step, the students developed and implemented a procedure to break their bubble. Their goal was to achieve a “balanced diet” of liberal, neutral, and conservative political content that matched the baseline distribution of what is being shared on Facebook ... Followup <http://freedom-to-tinker.com/2017/09/19/what-our-students-found-when-they-t…>: So, were students able to break their bubble? Initially, we expected that because the News Feed algorithm is complicated, it might be hard for students to break out of their bubbles. But we were wrong. The class was able to move to a more balanced diet pretty quickly.

1 0

Speaking Of DRM ...
by Lawrence D'Oliveiro 20 Sep '17

20 Sep '17

... HP has released <https://www.techdirt.com/articles/20170914/11491238210/hp-brings-back-obnox…> firmware updates for several of its OfficeJet Pro range that block their ability to work with third-party ink cartridges.

1 0

Pencil Project
by Peter Reutemann 19 Sep '17

19 Sep '17

So far, I've always used Dia for creating diagrams. However, last night, I came across the "Pencil Project", a cross-platform tool for wire frames. And I think, I may have found a new favorite! Copy/paste of some of the features: 'Easy GUI Prototyping Pencil provides various built-in shapes collection for drawing different types of user interface ranging from desktop to mobile platforms. Starting from 2.0.2, Pencil is shipped with Android and iOS UI stencils pre-installed. This makes it even easier to start protyping apps with a simple installation. Popular drawing features are also implemented in Pencil to simplify the drawing operations. Built-in Shape Collections Starting from 2.0.2 Pencil has even more shape collections included by default. The list of built-in collections now includes general-purpose shapes, flowchart elements, desktop/web UI shapes, Android and iOS GUI shapes. There are also many other collections created by the community and are distributed freely on the Internet. You can easily grab a collection and install it into Pencil with a simple drag-and-drop operation. Diagram Drawing Support Pencil now supports connectors which can be used to "wire" shapes together in a diagram. A collection of flowchart shapes are also available for drawing diagrams. Exporting to Different Output Formats Pencil supports outputing the drawing document into different types of formats. You can have your drawing exported as a set of rasterized PNG files or as a web page that can be delivered to the viewers. Pencil also supports exporting documents into popular formats including OpenOffice/LibreOffice text documents, Inkscape SVG and Adobe PDF. Inter-page linking Elements in a drawing can be linked to a specific page in the same document. This helps user define the UI flow when creating application or website mockups. Linkings defined in a document are converted into HTML hyper-links when the document is exported into web format. This process creates an interactive version of the mockup in which viewers can see a simulated flow when clicking on the UI elements.' -- source: http://pencil.evolus.vn/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Quote Of The Week
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

“These days we hear a lot about luring the young away from happy, fulfilling careers and into the world of programming.” Verity Stob, who else? <http://www.theregister.co.uk/2017/09/19/programming_in_the_middle_ages/>

1 0

Install Ring, a FOSS VOIP Skype alternative
by Peter Reutemann 19 Sep '17

19 Sep '17

'If you ask just about any Linux user, they'll agree that Skype is pretty terrible. There's not a whole lot to like there, especially since the Linux client is just a poorly maintained wrapper for the web app. There have been several attempts to create a free and open source alternative to Skype, but none have been as polished or complete as Ring. ' -- source: https://linuxconfig.org/install-ring-a-foss-voip-skype-alternative -- screenshots: https://ring.cx/en#screenshots Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

EFF resigns from W3C - An open letter to the W3C Director, CEO, team and membership
by Peter Reutemann 19 Sep '17

19 Sep '17

'In 2013, EFF was disappointed to learn that the W3C had taken on the project of standardizing “Encrypted Media Extensions,” an API whose sole function was to provide a first-class role for DRM within the Web browser ecosystem. By doing so, the organization offered the use of its patent pool, its staff support, and its moral authority to the idea that browsers can and should be designed to cede control over key aspects from users to remote parties. [...] We believe they will regret that choice. Today, the W3C bequeaths an legally unauditable attack-surface to browsers used by billions of people. They give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities. They side against the archivists who are scrambling to preserve the public record of our era. The W3C process has been abused by companies that made their fortunes by upsetting the established order, and now, thanks to EME, they’ll be able to ensure no one ever subjects them to the same innovative pressures. [...] We will defend those who are put in harm's way for blowing the whistle on defects in EME implementations. It is a tragedy that we will be doing that without our friends at the W3C, and with the world believing that the pioneers and creators of the web no longer care about these matters. Effective today, EFF is resigning from the W3C.' -- source: https://www.eff.org/deeplinks/2017/09/open-letter-w3c-director-ceo-team-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

A Telemarketer Called My Elevator
by Lawrence D'Oliveiro 19 Sep '17

19 Sep '17

Guy steps into lift, gets spiel from emergency intercom inviting him to “press 1” on nonexistent keypad to sign up. <https://arstechnica.com/gaming/2017/09/a-telemarketer-called-my-elevator/> Me, I blame VoIP ...

1 0

Will Linux Innovation Be Driven By Microsoft?
by Peter Reutemann 18 Sep '17

18 Sep '17

'Adobe's VP of Mobile (and a former intellectual property lawyer) sees "a very possible future where Microsoft doesn't merely accept a peaceful coexistence with Linux, but instead enthusiastically embraces it as a key to its future," noting Microsoft's many Linux kernel developers and arguing it's already innovating around Linux -- especially in the cloud. An anonymous reader quotes InfoWorld: Even seemingly pedestrian work -- like making Docker containers work for Windows, not merely Linux -- is a big deal for enterprises that don't want open source politics infesting their IT. Or how about Hyper-V containers, which marry the high density of containers to the isolation of traditional VMs? That's a really big deal... Microsoft has started hiring Linux kernel developers like Matthew Wilcox, Paul Shilovsky, and (in mid-2016) Stephen Hemminger... Microsoft now employs 12 Linux kernel contributors. As for what these engineers are doing, Linux kernel maintainer Greg Kroah-Hartman says, "Microsoft now has developers contributing to various core areas of the kernel (memory management, core data structures, networking infrastructure), the CIFS filesystem, and of course many contributions to make Linux work better on its Hyper-V systems." In sum, the Linux Foundation's Jim Zemlin declares, "It is accurate to say they are a core contributor," with the likelihood that Hemminger's and others' contributions will move Microsoft out of the kernel contribution basement into the upper echelons. The article concludes that "Pigs, in other words, do fly. Microsoft, while maintaining its commitment to Windows, has made the necessary steps to not merely run on Linux but to help shape the future of Linux."' -- source: https://linux.slashdot.org/story/17/09/16/2335251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Ad Industry “Deeply Concerned” About Safari’s New Ad-Tracking Restrictions
by Lawrence D'Oliveiro 17 Sep '17

17 Sep '17

Some have called for the total abolition of access to third-party cookies altogether. Apple’s new version of Safari doesn’t go this far, only imposing a 24-hour limit on their usability. But this is already enough to get the ad agencies up in arms. <https://arstechnica.com/tech-policy/2017/09/ad-industry-deeply-concerned-ab…>

1 0

'Bashware' Attacks Exploit Windows 10's Subsystem for Linux
by Peter Reutemann 17 Sep '17

17 Sep '17

'While many people welcomed the arrival of Windows Subsystem for Linux (WSL) in Windows 10, it has been found to be a potential security issue. A new technique known as a Bashware has been discovered by security researchers that makes it possible for malware to use the Linux shell to bypass security software. While administrator access is needed to execute a Bashware attack, this is fairly easily obtained, and the technique can be used to disguise malicious operations from antivirus software and other security tools. Researchers from Check Point Research point out that the danger stems from the fact that "existing security solutions are still not adapted to monitor processes of Linux executables running on Windows."' -- source: https://tech.slashdot.org/story/17/09/16/041251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber’s “Greyball” Regulator-Evading System
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

We reported back in May that the Justice Department had commenced a criminal investigation into Uber's use of a software tool that helped drivers evade picking up local officials in places where the service had not been approved. ... The Greyball software employs a dozen data points on a new user in a given market, including whether a rider's Uber app is opened repeatedly in or around municipal offices, which credit card is linked to the account, and any publicly available information about the new user on social media. If the data suggests the new user is a regulator in a market where Uber is not permitted, the company would present that user with false information about where Uber rides are. <https://arstechnica.com/tech-policy/2017/09/heres-a-real-life-slimy-example…>

1 0

Quantum Computers Calculate Minimum-Energy State of Three Simple Molecules
by Lawrence D'Oliveiro 16 Sep '17

16 Sep '17

From <https://arstechnica.com/science/2017/09/quantum-computers-reach-deeper-find…>: Every time we discuss quantum computers, the headline tends to be that someone, somewhere is going to use the quantum to break your encryption and steal your student loan. If only that were true. But it is probably more realistic to think about quantum computers being used to solve quantum problems. ... However, for lithium hydride and beryllium hydride, the solutions are less accurate. The researchers believe that the falling accuracy is not due to the simplifications but hap[p]ens because the qubits do not stay sufficiently coherent during the calculation. In other words, quantum computers are the modern-day equivalent of analog computers, not digital ones: just like in the early days of mechanical- and electronic-based analog machines, they can give answers more quickly, but with less accuracy than, a digital one.

2 8

Azure Confidential Computing Will Keep Data Secret, Even From Microsoft
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

From <https://arstechnica.com/gadgets/2017/09/azure-confidential-computing-will-k…>: The SGX mode uses processor features to carve out a TEE within a regular process—no virtual machines necessary. The processor itself will encrypt and decrypt data from memory, such that the data is only decrypted when it's within the processor itself. With this mode, even Hyper-V's security isn't important; the only thing that an application has to trust is the processor and its implementation of SGX. With SGX enclaves, nobody—not even Microsoft—can see the data in the TEE. So we only have to trust Intel...

1 0

The Big List Of Naughty Strings
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

The Big List of Naughty Strings is an evolving list of strings which have a high probability of causing issues when used as user-input data. This is intended for use in helping both automated and manual QA testing; useful for whenever your QA engineer walks into a bar. <https://github.com/minimaxir/big-list-of-naughty-strings> The “walks into a bar” reference is to this <http://www.sempf.net/post/On-Testing1>: QA Engineer walks into a bar. Orders a beer. Orders 0 beers. Orders 999999999 beers. Orders a lizard. Orders -1 beers. Orders a sfdeljknesv. Because that’s what testing is all about...

3 2

Python Explosion Blamed On Pandas
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

Not content to bait developers by declaring that Python is the fastest-growing major programming language, coding community site Stack Overflow has revealed the reason for its metastasis. ... Programmers love pandas. <http://www.theregister.co.uk/2017/09/14/python_explosion_blamed_on_pandas/>

2 2

The Community bash Style Guide
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

A collection of dos and don’ts for writing bash scripts: <https://github.com/azet/community_bash_style_guide>. Some tips are not bash-specific, but are about external commands usable with any shell: e.g. awk, sed, grep, pgrep, xargs. Also some builtins should be available with any POSIX-compliant shell, e.g. getopts, printf. Most surprising bit of information: that someone has written a “ctypes” (foreign-function interface) addon for bash <https://github.com/taviso/ctypes.sh>.

1 0

Yellow Rebrands, Celebrates Turnaround
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

The former Yellow Pages Group is getting over a rough patch by finding new business opportunities: Its work with SMEs, however, was the focus [acting CEO] Linton said, with companies able to use Yellow to set up a basic website, through to advertising, adding on e-commerce solutions, booking widgets and other add-on products for an additional regular cost. Yellow is also one of New Zealand's largest resellers of Google Adwords - helping boost customer profile online. ... “Almost 50 per cent of small businesses have no digital presence so you can't even find them on Google.” <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11922410>

1 0

Free Software, Open Access, And Open Science Groups Join Fight Against EU Copyright Directive's Terrible Ideas
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

>From an item by the always-excellent Glyn Moody <https://www.techdirt.com/articles/20170912/08434938194/free-software-open-a…>: The problem they identified is that widely-used version control systems (VCS) like GitHub seem to meet the definition of "information society services" laid down by the proposed EU Copyright Directive, and as such would be required to filter all uploads to block copyright infringements. Moreover, as the white paper points out, developer Web sites would not only be held responsible for any material uploaded by users without permission of the copyright holders, but would also seem liable for illegitimate distributions of derivative works in violation of the applicable license. At which I can hear groups affiliated with Big Content™ responding “Yeah? So?”. Sites like YouTube are full of user-generated content, too (what is YouTube most famous for showing? Cat videos!), but that hasn’t stopped them being forced into granting special privileges to major film studios and the like <https://www.techdirt.com/search-g.php?num=20&q=youtube+dmca&search=Search>. If software is not the same as videos, pictures or music, why should the same principles of copyright apply to it?

1 0

Backdoor Found In WordPress Plugin With More Than 200, 000 Installations
by Peter Reutemann 14 Sep '17

14 Sep '17

'According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200,000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it's unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version -- v2.6.0 -- on June 21' -- source: https://it.slashdot.org/story/17/09/13/2152234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software In Use At Animation College
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Seeing their ads in various places prompted me to check out their site. There is a list of software that they use in their Bachelor of Animation degree here <http://www.animationcollege.co.nz/bachelor-of-animation/bachelor-faq/>, but it’s just a table of product logos, no names. Interesting to see one open-source product in that list, namely Audacity. Also note that “GitKraken”, which appears to be a GUI for the Git version-control system. I wonder how they use it in studio workflows? Purely to keep track of a linear sequence of revisions of assets? Because I can’t imagine that branching and merging would work very well with binary (e.g. still-image, audio, video) files. The faux-chemical symbols are all Adobe products, I believe; but I can’t find anything at Adobe’s site that has the “An” logo. My best guess for the product denoted by “xN” is this company <http://www.realityvirtual.co/>. And that purple one that looks like a purple pixelated landslide, I can’t identify at all.

1 0

Hacking Voice Assistant Systems With Inaudible Voice Commands
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Turns out that all the major voice assistants -- Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa -- listen at audio frequencies the human ear can't hear. Which means somebody could send commands to your device that you have no idea about. <https://www.schneier.com/blog/archives/2017/09/hacking_voice_a.html>

1 0

AT HOP: Pitfalls In Electronic Transaction Systems
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

There seems to be a subtle issue with topping up the balance on AT HOP cards used by Auckland Transport: you actually have to use the card somewhere within 60 days of the topup, otherwise the deposit will get taken out again. It appears this has to do with the terminals having to be refreshed daily with their own copies of details about valid cards, and these uploads only include active cards. But try explaining that to the customers... <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11921624>

2 1

Researchers Catch Microsoft Zero-Day Used To Install Government Spyware
by Peter Reutemann 13 Sep '17

13 Sep '17

'Government hackers were using a previously-unknown vulnerability in Microsoft's .NET Framework, a development platform for building apps, to hack targets and infect them with spyware, according to security firm FireEye. The firm revealed the espionage campaign on Tuesday, on the same day Microsoft patched the vulnerability. According to FireEye, the bug, which until today was a zero-day, was being used by a customer of FinFisher, a company that sells surveillance and hacking technologies to governments around the world. The hackers sent a malicious Word RTF document to a "Russian speaker," according to Ben Read, FireEye's manager of cyber espionage research. The document was programmed to take advantage of the recently-patched vulnerability to install FinSpy, spyware designed by FinFisher. The spyware masqueraded as an image file called "left.jpg," according to FireEye.' -- source: https://it.slashdot.org/story/17/09/12/2022235 For Windows, there seems to be Detekt (written in Python) which can detect some versions of FinSpy apparently: https://www.kubuntuforums.net/archive/index.php/t-66896.html Maybe we should finally look at demoing some security tools at the next meeting? - ClamAV - Sophos scanner - Chkrootkit - Rkhunter - Lynis - ... (other suggestions?) In other words, I'd need volunteers to do a short show and tell. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Only Safe Email is Text-Only Email
by Peter Reutemann 13 Sep '17

13 Sep '17

'Sergey Bratus, Research Associate Professor of Computer Science, Dartmouth College, and Anna Shubina, Post-doctoral Associate in Computer Science, Dartmouth College write: The real issue is that today's web-based email systems are electronic minefields filled with demands and enticements to click and engage in an increasingly responsive and interactive online experience. It's not just Gmail, Yahoo mail and similar services: Desktop-computer-based email programs like Outlook display messages in the same unsafe way. Simply put, safe email is plain-text email -- showing only the plain words of the message exactly as they arrived, without embedded links or images. Webmail is convenient for advertisers (and lets you write good-looking emails with images and nice fonts), but carries with it unnecessary -- and serious -- danger, because a webpage (or an email) can easily show one thing but do another. Returning email to its origins in plain text may seem radical, but it provides radically better security. Even the federal government's top cybersecurity experts have come to the startling, but important, conclusion that any person, organization or government serious about web security should return to plain-text email (PDF).' -- source: https://yro.slashdot.org/story/17/09/12/0436206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices
by Peter Reutemann 13 Sep '17

13 Sep '17

'Security researchers have discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. Researchers say the vulnerabilities are undetectable and unstoppable by traditional security solutions. No user interaction is needed for an attacker to use the BleuBorne flaws, nor does the attacker need to pair with a target device. They affect the Bluetooth implementations in Android, iOS, Microsoft, and Linux, impacting almost all Bluetooth device types, from smartphones to laptops, and from IoT devices to smart cars. Furthermore, the vulnerabilities can be concocted into a self-spreading BlueTooth worm that could wreak havoc inside a company's network or even across the world. "These vulnerabilities are the most serious Bluetooth vulnerabilities identified to date," an Armis spokesperson told Bleeping Computer via email. "Previously identified flaws found in Bluetooth were primarily at the protocol level," he added. "These new vulnerabilities are at the implementation level, bypassing the various authentication mechanisms, and enabling a complete takeover of the target device." Consumers are recommended to disable Bluetooth unless you need to use it, but then turn it off immediately. When a patch or update is issued and installed on your device, you should be able to turn Bluetooth back on and leave it on safely. The BlueBorne Android App on the Google Play Store will be able to determine if a user's Android device is vulnerable. A technical report on the BlueBorne flaws is available here (PDF).' -- source: https://mobile.slashdot.org/story/17/09/12/2030213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 13 Sep '17

13 Sep '17

Let's keep it on the list, thanks gb. noun: snark; 1. snide and sharply critical comments. I called out your behaviour for what it was, and I would have done so in-person too. I'm not singling you out, either - I did the same with someone else in July. The entire community suffers when that type of behaviour goes unaddressed - and it's the community's job to speak up if we want to protect the high standards we've enjoyed for the last fifteen years. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Wed, 13 Sep 2017, at 10:59, gb wrote: > On the contrary, I was merely pointing out that insulting people on a > public forum is not something you would do to their faces. > > On Tue, 2017-09-12 at 15:02 +1200, Eric Light wrote: > > Did.... You actually just threaten me? > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 14:39, gb wrote: > > > > > > "snark" ... "being a dick" ... would you like to say that to my face? > > > > > > > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > > > but I'm in this group for interesting news, tips, guidance, etc. > > > > > > > > The diversity of information here is one of the reasons that I've been > > > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > > > aren't Linux-specific, for example. That only adds to the benefit that > > > > we get as a group. > > > > > > > > Lawrence's post is fascinating, and could be the starting point for an > > > > interesting discussion if we could go ahead and not be dicks - either to > > > > the poster, or about the content. > > > > > > > > E > > > > > > > > -------------------------------------------- > > > > Q: Why is this email five sentences or less? > > > > A: http://five.sentenc.es > > > > > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > > > owns a Tesla in Waikato? (I doubt it). > > > > > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > > > supply, shall I share them here too? > > > > > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > > > is initially available for use by customers, offering the > > > > > > additional capacity as a subsequent software update. > > > > > > > > > > > > ... > > > > > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > > > capacity available even to Floridians who hadn't paid for the > > > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > > > of Hurricane Irma. > > > > > > > > > > > > ... > > > > > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > > > season is over. > > > > > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > > > _______________________________________________ > > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > > > > _______________________________________________ > > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > > > . > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

“Mr Inkscape” Explains How To Pronounce His Name
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

In the comments to an article on an “Inkscape hackfest” from earlier this year, I asked, and he answered <http://libregraphicsworld.org/blog/entry/inkscape-hackfest-planned-for-late…>.

1 0

Bruce Schneier On Securing A Raspberry π
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Make magazine has an article about securing it. Reading it, I am struck by how much work it is to secure. I fear that this is beyond the capabilities of most tinkerers, and the result will be even more insecure IoT devices. <https://www.schneier.com/blog/archives/2017/09/securing_a_rasp.html>

1 0

mailing list etiquette
by Peter Reutemann 12 Sep '17

12 Sep '17

Hi everyone In light of recent events, a little refresher on the mailing list etiquette seems to be appropriate. You can find it here: https://list.waikato.ac.nz/mailman/listinfo/wlug Yes, there are topics which can kick off a flame war (vi/emacs, systemd). Some things are like politics or religion and cannot be discussed objectively. But calling other people names and/or posting snide, demeaning or threatening comments (on- or off-list) is below this list. I usually have a very hands-off approach to moderation, considering that we are all (or at least most of us are) adults and should know what is considered acceptable social behavior. However, if inciting behavior should continue, I reserve my right to ban people from this list. Last but not least: if you don't like the actual content being posted here, no one forces you to be a member of this mailing list. Simply unsubscribe. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Eric Light 12 Sep '17

12 Sep '17

Did.... You actually just threaten me? E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es On Tue, 12 Sep 2017, at 14:39, gb wrote: > > "snark" ... "being a dick" ... would you like to say that to my face? > > > On Tue, 2017-09-12 at 14:04 +1200, Eric Light wrote: > > Is that snark really necessary, gb? I'm not sure about the rest of us, > > but I'm in this group for interesting news, tips, guidance, etc. > > > > The diversity of information here is one of the reasons that I've been > > on the list for almost a decade. I'm sure a full 30% of Peter's posts > > aren't Linux-specific, for example. That only adds to the benefit that > > we get as a group. > > > > Lawrence's post is fascinating, and could be the starting point for an > > interesting discussion if we could go ahead and not be dicks - either to > > the poster, or about the content. > > > > E > > > > -------------------------------------------- > > Q: Why is this email five sentences or less? > > A: http://five.sentenc.es > > > > On Tue, 12 Sep 2017, at 12:51, gb wrote: > > > Well that's got zero to do with linux, or Waikato ... unless someone > > > owns a Tesla in Waikato? (I doubt it). > > > > > > I've got some cool anecdotes on crappy things banks do with our money > > > supply, shall I share them here too? > > > > > > On Tue, 2017-09-12 at 12:02 +1200, Lawrence D'Oliveiro wrote: > > > > Tesla sometimes sells cars with more hardware battery capacity than > > > > is initially available for use by customers, offering the > > > > additional capacity as a subsequent software update. > > > > > > > > ... > > > > > > > > But last week, Tesla decided to temporarily make this extra > > > > capacity available even to Floridians who hadn't paid for the > > > > upgrade to ensure they had enough range to get out of Florida ahead > > > > of Hurricane Irma. > > > > > > > > ... > > > > > > > > Presumably, their vehicles will get a downgrade once hurricane > > > > season is over. > > > > > > > > <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…> > > > > _______________________________________________ > > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > _______________________________________________ > > > wlug mailing list | wlug(a)list.waikato.ac.nz > > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > _______________________________________________ > > wlug mailing list | wlug(a)list.waikato.ac.nz > > Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug > > > > .

1 0

Tesla Remotely Extends The Range Of Some Cars To Help With Hurricane Irma
by Lawrence D'Oliveiro 12 Sep '17

12 Sep '17

Tesla sometimes sells cars with more hardware battery capacity than is initially available for use by customers, offering the additional capacity as a subsequent software update. ... But last week, Tesla decided to temporarily make this extra capacity available even to Floridians who hadn't paid for the upgrade to ensure they had enough range to get out of Florida ahead of Hurricane Irma. ... Presumably, their vehicles will get a downgrade once hurricane season is over. <https://arstechnica.com/cars/2017/09/tesla-remotely-extends-the-range-of-so…>

3 2

Google Chrome Will Soon Detect Man-in-the-Middle Attacks
by Peter Reutemann 10 Sep '17

10 Sep '17

'Google Chrome 63 will include a new security feature that will detect when third-party software is performing a Man-in-the-Middle (MitM) attack that hijacks the user's Internet connection.... Most MitM toolkits fail to correctly rewrite the user's encrypted connections, causing SSL errors that Chrome will detect. The new Chrome 63 feature is in the form of a new warning screen. This new error will appear whenever Chrome detects a large number of SSL connection errors in a short timespan, a sign that someone is trying -- and failing -- to intercept the user's web traffic. This includes both malware and legitimate applications, such as antivirus and firewall applications. The new Chrome error won't show up for all antivirus and firewall software, but only for those that do not rewrite SSL connections in a proper way, resulting in SSL errors. Chrome 63 is set for release on December 5, but users can already test it by enabling it in the Google Chrome dev branch' -- source: https://it.slashdot.org/story/17/09/10/1928232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OBS Studio – Record and Live Stream Videos from Linux Desktop
by Peter Reutemann 10 Sep '17

10 Sep '17

'OBS Studio is a free and open source cross-platform app with which you can create video records of your desktop screen and also live stream directly. You can use it to conveniently share your gaming, art, entertainment activities with Twitch.tv, YouTube, Hitbox.tv, DailyMotion, Connectcast.tv, CyberGame.tv, CashPlay.tv along with custom streaming servers free of charge! It comes with many in-house features that allow you to produce professional videos e.g. Studio Mode lets you live preview and adjust your scenes and sources before making them available for public viewing; you can choose to set any combo of hotkeys to start/stop streams or recordings, switch between scenes, mute audio sources, e.t.c.' -- source: https://www.fossmint.com/obs-studio-record-and-live-stream-videos-from-linu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Document Liberation Project Announces Initial QuarkXPress Support
by Lawrence D'Oliveiro 10 Sep '17

10 Sep '17

Libre Graphics World may not update very often, but its articles are usually worth reading. Like this one <http://libregraphicsworld.org/blog/entry/document-liberation-project-announ…>: Initially, Scribus was pretty much modeled after QuarkXPress, and the two projects still share some similarities. Early in the history of Scribus, it made a lot of sense to introduce support for QXP files. Users got mad with Quark's continuous quirks and bad user support, they would jump ship at the very next opportunity. Paul Johnson, former Scribus contributor, actually started working on support for QXP files in 2004. But after he had posted to a public mailing list about his progress, he reportedly received a cease and desist letter from Quark. Scribus was nowhere near its current fame at the time, and even now it would not be able to handle legal expenses (save for a theoretical FSF intervention). Back then Paul just stopped working on that project. The good news is, Quark no longer seems to be in a position to be such a bully.

1 0

Vodafone Ending Its E-Mail Service
by Lawrence D'Oliveiro 08 Sep '17

08 Sep '17

Vodafone will no longer be offering e-mail service to its customers after November <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11919531>. It doesn’t seem to have notified some of its customers; certainly I didn’t receive any notification. Of course, I just have to figure out where to get a new server to handle my existing address. The real headache is for those who have been using the ISP’s domain for their address; that has been a bad idea for the last 20 years.

2 1

How to hurricane-proof a Web server
by Peter Reutemann 08 Sep '17

08 Sep '17

'I had enough to worry about as Hurricane Harvey plowed into the Texas Gulf Coast on the night of August 25 and delivered a category 4 punch to the nearby city of Rockport. But I simultaneously faced a different kind of storm: an unexpected surge of traffic hitting the Space City Weather Web server. This was the first of what would turn into several very long and restless nights.' -- source: https://arstechnica.com/information-technology/2017/09/how-to-hurricane-pro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to use speedtest on a Linux server to check, store and report internet speeds graphically
by Peter Reutemann 08 Sep '17

08 Sep '17

'Following on from a set of problems of poor broadband connectivity I was experiencing I decided that I wanted to monitor the Mbps speed I was getting from my provider on a regular basis. I was seeing especially poor figures when trying to download files in the evening, with much faster speeds achieved very early in the morning. I have a Linux Debian server sitting in a corner, which is my test and development machine for ISPConfig-hosted websites, as well as some Let's Encrypt code I like to play around with, so I looked for some software that would enable bandwidth testing, runnable from a linux command line, which could form the basis of an automated shell script system to produce the raw data I needed. I wanted to store the data in a SQL database to make querying simple (I could then easily gather more data and just extract a smaller subset for time periods I was interested in) and to have a web front-end that could produce a simple chart to visualise the data and help highlight the connectivity issues.' -- source: https://www.howtoforge.com/tutorial/how-to-use-speedtest-on-a-linux-server-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Eats Up Mobile Data Even When On Wi-Fi
by Peter Reutemann 07 Sep '17

07 Sep '17

'An apparent bug with Android Oreo has been discovered which means Google's mobile operating system could be munching its way through your data allowance, even if you're connected to a wireless network. A thread on Reddit highlighted the issue, with many people pointing out that it could prove expensive for anyone not using an unlimited data plan. Google is apparently aware of the problem and is working on a patch, but in the meantime Oreo users are being warned to consider disabling mobile data when they are at home or using a wireless connection elsewhere.' -- source: https://it.slashdot.org/story/17/09/06/2240208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.13 Officially Released
by Peter Reutemann 06 Sep '17

06 Sep '17

'As expected, the Linux 4.13 kernel series was made official this past weekend by none other than its creator, Linus Torvalds, which urges all Linux users to start migrating to this version as soon as possible. Work on Linux kernel 4.13 started in mid-July with the first Release Candidate (RC) milestone, which already gave us a glimpse of the new features coming to this major kernel branch. There are, of course, numerous improvements and support for new hardware through updated drivers and core components. Highlights of Linux kernel 4.13 include Intel's Cannon Lake and Coffee Lake CPUs, support for non-blocking buffered I/O operations to improve asynchronous I/O support, support for "lifetime hints" in the block layers and the virtual filesystem, AppArmor enhancements, and better power management. There's also AMD Raven Ridge support implemented in the AMDGPU graphics driver, which received numerous improvements, support for five-level page tables was added in the s390 architecture, and the structure randomization plugin was added as part of the build system.' -- source: https://linux.slashdot.org/story/17/09/05/1637226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Use Aircrack-ng To Test Your WiFi Password
by Peter Reutemann 05 Sep '17

05 Sep '17

'Most people have terrible passwords, and WiFi is no exception. Your WiFi password is your primary line of defense against unwanted access to your network. That access can result in a whole host of other nasty things because an attacker can monitor the traffic on your network and even gain direct access to your computers. The best way to prevent such an intrusion is to use the same tools an attacker would to test the security of your WiFi password. [...] Remember this process should only ever be used to test your own security. Using it on someone else's network is illegal.' -- source: https://linuxconfig.org/use-aircrack-ng-to-test-your-wifi-password Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Geo – A Simple BASH Utility To Get Network And Geolocation Details
by Peter Reutemann 05 Sep '17

05 Sep '17

'A while ago, we wrote a blog post about “Bash-Snippets”, a set of BASH scripts for heavy command-line users. Those scripts consists of many useful utilities such as crypt, geo, cheat, weather, ytview and more. Using bash-Snippets, you can install all utilities or a particular one. In this brief guide, we are going to discuss about only one utility in the Bash-Snippets called “Geo”. It is used to display wan, lan, router, dns, mac address, and geolocation output, with clean stdout for piping.' -- source: https://www.ostechnix.com/geo-simple-bash-utility-get-network-geolocation-d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Finally Killed Sun
by Peter Reutemann 05 Sep '17

05 Sep '17

'The news from the ex-Sun community jungle drums is that the January rumours were true and Oracle laid off the core talent of the Solaris and SPARC teams on Friday (perhaps hoping to get the news lost in the Labor Day weekend). With 90% gone according to Bryan Cantrill that surely has to mean either a skeleton-staffed maintenance-only future for the product range, especially with Solaris 12 cancelled, or an attempt to force Solaris workloads onto Oracle’s SPARC Cloud offering. A classic Oracle “silent EOL”, no matter what they claim as they satisfy their contractual commitments to Fujitsu and others. ' -- source: https://meshedinsights.com/2017/09/03/oracle-finally-killed-sun/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.3 to Launch with Revamped Backup Tool, Window Progress, and More
by Peter Reutemann 05 Sep '17

05 Sep '17

'Last month, we reported that development of Linux Mint 18.3 kicked off with HybridSleep support for the Cinnamon desktop environment, HiDPI support and GTK3 porting for the Software Sources tool, as well as the revamp of the Software Manager graphical package manager, which was also ported to latest GTK+ 3 technologies. And now, the Linux Mint creator reveals the fact that Linux Mint 18.3 will be shipping with a revamped Backup Tool that won't require root anymore, offers a much easier to use interface that no longer requires you to select the type or source of a backup, and it's capable of backing up your entire Home directory. The tool will restore files in their initial location, with the same permissions and timestamps.' -- source: http://news.softpedia.com/news/linux-mint-18-3-to-launch-with-revamped-back… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

To Linux Mint KDE 18.2… and back
by Peter Reutemann 05 Sep '17

05 Sep '17

'Linux Mint KDE is just one of several flavours of Linux Mint, and obviously not the flagship of this distribution. However, I liked that distribution in my test of the Live version of Linux Mint KDE 18.2. I liked it so much that I decided to give it a go in installed mode. How was that? Let’s check.' -- source: http://linuxblog.darkduck.com/2017/09/to-linux-mint-kde-182-and-back.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities Discovered In Mobile Bootloaders of Major Vendors
by Peter Reutemann 05 Sep '17

05 Sep '17

'Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."' -- source: https://mobile.slashdot.org/story/17/09/05/0257221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android One Is Anything But Dead, Google Reaffirms With Xiaomi Mi A1
by Peter Reutemann 05 Sep '17

05 Sep '17

'Google executives shared the stage with Xiaomi chiefs at a media event in New Delhi on Tuesday as the Chinese phone maker unveiled its "new flagship" Mi A1 smartphone. Google's presence at the event was essential. Xiaomi's Mi A1 is the latest phone to be launched under Google's Android One program, a three-year-old initiative from Google, which in the past year has been presumed dead by many. It's anything but that, Google executives said. The Xiaomi Mi A1 smartphone features a 5.5-inch full-HD (1080x1920 pixels) display. It also offers a duo of 12-megapixel rear cameras, one with telephoto capability and 2X optical zoom feature. On the front, for the selfie enthusiasts is a 5-megapixel shooter. The dual-SIM capable Mi A1 smartphone houses a Snapdragon 625 octa-core SoC, 4GB of RAM, 64GB internal storage, IR blaster, a 3080mAh battery, a fingerprint scanner, modems for 4G LTE bands in its gold- and black-coloured thin, full-metal unibody form factor. It is priced at $235, and will be available in dozens of markets including Mexico, India, Indonesia, Russia, and Singapore.' -- source: https://tech.slashdot.org/story/17/09/05/1014235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With Android Oreo, Google Is Introducing Linux Kernel Requirements
by Peter Reutemann 05 Sep '17

05 Sep '17

'As is easy to tell by comparing versions of Android from different handset manufacturers, developers are -- broadly speaking -- free to do whatever they want with Android, but with Oreo, one aspect of this is changing. Google is introducing a new requirement that OEMs must meet certain requirements when choosing the Linux kernel they use. Until now, as pointed out by XDA Developers, OEMs have been free to use whatever Linux kernel they wanted to create their own version of Android. Of course, their builds still had to pass Google's other tests, but the kernel number itself was not an issue. Moving forward, Android devices running Oreo must use at least kernel 3.18, but there are more specific requirements to meet as well. Google explains on the Android Source page: "Android O mandates a minimum kernel version and kernel configuration and checks them both in VTS as well as during an OTA. Android device kernels must enable the kernel .config support along with the option to read the kernel configuration at runtime through procfs."' -- source: https://linux.slashdot.org/story/17/09/03/1653227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

78 Open Source Replacements for Expensive Applications
by Peter Reutemann 04 Sep '17

04 Sep '17

'Back when Datamation first started making lists of open source software that could replace expensive proprietary applications, most commercial software came in a box and required a flat fee for purchase. These days, with the advent of cloud computing and software as a service, most applications require a regular monthly or yearly subscription. Those subscriptions make it seem like software has become more affordable. After all, $10 or $20 a month doesn't seem like a lot. But when you add up those repeating fees, users often pay more under the new subscription plans than they did under the old flat-fee arrangements. If you use a lot of different applications, those fees can quickly add up. And it can be particularly hard to justify the expense for a piece of software that you only use once in a while. Open source software offers an alternative to paying those high fees. And in many cases, the open source options are as good as or better than the comparable commercial, proprietary solutions. In fact, in the most recent BlackDuck Future of Open Source Survey, the top reasons why people said they use open source software were because of the features, freedom from vendor lock-in and the quality of the solutions. Price and total cost of ownership weren't even on the list. In other words, people are using open source because the software is so good, and the fact that it is free is just a side benefit. The list below includes a variety of open source software for home users, SMBs and large enterprises. All of these applications can replace commercial products that can carry high prices. Even if buyers choose to purchase support or other services for their open source software, the open source options are generally much more affordable than the comparable proprietary solutions.' -- source: http://www.datamation.com/open-source/78-open-source-replacements-for-expen… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost-OT: Linux Comic
by Lawrence D'Oliveiro 02 Sep '17

02 Sep '17

There is this peculiar subgenre of art featuring characters called “OS-tans”. These are personifications of operating systems. I’m not sure how their characters and adventures relate to the OSes for which they are named, but anyway here is one about a character named Linux: <https://bellacielo.deviantart.com/gallery/33067628/Linux-Comic-Complete>.

1 0

The Most Epic Tech-Support Call In History
by Lawrence D'Oliveiro 02 Sep '17

02 Sep '17

Scott Manley tells the story <https://www.youtube.com/watch?v=wSSmNUl9Snw> of how the Apollo 14 mission was saved by a truly remarkable bit of computer hacking. You might be thinking: “Have you tried turning it off and on again?” Apollo 10 did that. And there were the computer crashes (“1202 alarm” and “1201 alarm”) during the Apollo 11 landing. But 14 was being stymied by an intermittently-shorting abort switch: if that triggered at the wrong time, the mission was over. And the software couldn’t be reprogrammed, since it was all woven (literally) into ROM. So a bright young guy named Don Eyles was woken up in the middle of the night, and over the space of a couple of hours he put together a sequence of manual patches to the writable memory to temporarily disable the abort switch at crucial moments, with further patches necessary to deal with the consequences of this elsewhere in the code. The astronauts had to follow the instructions and key in the numbers exactly as given. (Upload? What upload?) This included having to manually crank the descent engine up to full thrust at the right time, because the automatic program for doing so would not be working. Anyway, as history records, they successfully made it down to the lunar surface, and back home again. Mission accomplished.

1 0

711 million email addresses ensnared in "largest" spambot
by Peter Reutemann 30 Aug '17

30 Aug '17

'A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.' -- source: http://www.zdnet.com/article/onliner-spambot-largest-ever-malware-campaign-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

scrollbars: click to scroll
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone Here's one for us old-fogies that don't like the new fandangled behavior of scrollbars, moving to where you click instead of scrolling (drives me nuts when scrolling through posts). For GTK do the following: - Create ~/.config/gtk-3.0/settings.ini - add the following content [Settings] gtk-primary-button-warps-slider = false --source: https://unix.stackexchange.com/a/306340 For Firefox itself do this: - go to about:config - right-click and select "New" of type "Integer" - use "ui.scrollToClick" as name and enter value "0" -- source: https://unix.stackexchange.com/a/276016 And, if you want your top/bottom buttons on the scrollbar back, have a look here: https://linuxnorth.wordpress.com/2014/06/01/vertical-scroll-bars-in-linux-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

On Internet Privacy, Be Very Afraid
by Peter Reutemann 29 Aug '17

29 Aug '17

'Cybersecurity expert and Berkman Klein fellow Bruce Schneier talked to the Gazette about what consumers can do to protect themselves from government and corporate surveillance. From the interview: GAZETTE: After whistleblower Edward Snowden's revelations concerning the National Security Agency's (NSA) mass surveillance operation in 2013, how much has the government landscape in this field changed? SCHNEIER: Snowden's revelations made people aware of what was happening, but little changed as a result. The USA Freedom Act resulted in some minor changes in one particular government data-collection program. The NSA's data collection hasn't changed; the laws limiting what the NSA can do haven't changed; the technology that permits them to do it hasn't changed. It's pretty much the same. GAZETTE: Should consumers be alarmed by this? SCHNEIER: People should be alarmed, both as consumers and as citizens. But today, what we care about is very dependent on what is in the news at the moment, and right now surveillance is not in the news. It was not an issue in the 2016 election, and by and large isn't something that legislators are willing to make a stand on. Snowden told his story, Congress passed a new law in response, and people moved on. GAZETTE: What about corporate surveillance? How pervasive is it? SCHNEIER: Surveillance is the business model of the internet. Everyone is under constant surveillance by many companies, ranging from social networks like Facebook to cellphone providers. This data is collected, compiled, analyzed, and used to try to sell us stuff. Personalized advertising is how these companies make money, and is why so much of the internet is free to users. We're the product, not the customer.' -- source: https://yro.slashdot.org/story/17/08/29/1725246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Ryzen Running Stable On Linux, Threadripper Builds Kernel In 36 Seconds
by Peter Reutemann 29 Aug '17

29 Aug '17

'After AMD confirmed the a "performance marginality problem" affecting some Ryzen Linux users, RMAs are being issued and replacement Ryzen processors arriving for affected opensource fans. Phoronix has been able to confirm that the new Ryzen CPUs are running stable without the segmentation fault problem that would occur under very heavy workloads. They have also been able to test now the Ryzen Threadripper 1950X. The Threadripper 1950X on Linux is unaffected by any issues unless you count the lack of a thermal reporting driver. With the 32 threads under Linux they have been able to build the Linux kernel in just about a half minute.' -- source: https://linux.slashdot.org/story/17/08/29/184243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocurrencies And Autonomous Weapons
by Lawrence D'Oliveiro 29 Aug '17

29 Aug '17

Al Jazeer’s “Counting The Cost” economics program this week <http://www.aljazeera.com/programmes/countingthecost/2017/08/cryptocurrencie…> talks, among other things, a bit about: * Cryptocurrencies (e.g. Bitcoin) -- is it too early to start regulating them? Start worrying about their use for illegal activities? Start investing in them? * Autonomous military weaponry -- should we start banning the creation of weapons that can take their own decision to shoot to kill? Or is more research needed? By the way, mentioned in passing in the latter segment is that Samsung-made autonomous guns are already deployed along South Korea’s border with its northern neighbour.

1 0

Addendum to last night's presentation on RPi projects
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone This was the other sensor project that I came across, using multiple arduino sensors to monitor humidity/temperature, collecting them with a RF receiver (though I wouldn't use xively.com to collect the data): https://computers.tutsplus.com/tutorials/building-a-wireless-sensor-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the NSA Identified Satoshi Nakamoto
by Peter Reutemann 29 Aug '17

29 Aug '17

'The 'creator' of Bitcoin, Satoshi Nakamoto, is the world's most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi's real name. In fact, DHS will not publicly confirm that even THEY know the billionaire's identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him -- his own words. Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. According to my source, the NSA was able to the use the 'writer invariant' method of stylometry to compare Satoshi's 'known' writings with trillions of writing samples from people across the globe. By taking Satoshi's texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a 'fingerprint' for anything written by Satoshi that could easily be compared to any other writing. The NSA then took bulk emails and texts collected from their mass surveillance efforts. First through PRISM and then through MUSCULAR, the NSA was able to place trillions of writings from more than a billion people in the same plane as Satoshi's writings to find his true identity. The effort took less than a month and resulted in positive match' -- source: https://tech.slashdot.org/story/17/08/28/1725232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Year After Mirai: DVR Torture Chamber Test Shows Two Minutes Between Exploits
by Peter Reutemann 29 Aug '17

29 Aug '17

'Over two days, the Internet Storm Center connected a default configured DVR to the internet, and rebooted it every 5 minutes in order to allow as many bots as possible to infect it. They detected about one successful attack (using the correct password xc3511) every 2 minutes. Most of the attackers were well known vulnerable devices. A year later, what used to be known as the "Mirai" botnet has branched out into many different variants. But it looks like much hyped "destructive" variants like Brickerbot had little or no impact.' -- source: https://it.slashdot.org/story/17/08/28/1812242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of 1st-known Android DDoS malware infects phones in 100 countries
by Peter Reutemann 29 Aug '17

29 Aug '17

'Last year, a series of record-setting attacks hitting sites including KrebsOnSecurity and a French Web host underscored a new threat that had previously gone overlooked: millions of Internet-connected digital video recorders and similar devices that could easily be wrangled into botnets that challenged the resources of even large security services. Now, for one of the first times, researchers are reporting a new platform recently used to wage powerful denial-of-service attacks that were distributed among hundreds of thousands of poorly secured devices: Google's Android operating system for phones and tablets. The botnet was made up of some 300 apps available in the official Google Play market. Once installed, they surreptitiously conscripted devices into a malicious network that sent junk traffic to certain websites with the goal of causing them to go offline or become unresponsive.' -- source: https://arstechnica.com/information-technology/2017/08/first-known-android-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Scan Your Linux Computer for Viruses and Rootkits
by rowan schischka 28 Aug '17

28 Aug '17

>Any volunteers? Especially people that have used one of these tools before. Unfortunately I am not in Hamilton atm, but if i was I would demonstrate an automated way to scan and alert the user. The tools are very straight forward to use. The hardest part I had was setting up local mail and sending a report to gmail without gmail marking it as spam.

1 0

Raspberry Pi - Raspbian released based on Debian 9 - Stretch
by Ian Stewart 27 Aug '17

27 Aug '17

Raspbian, the main distro for the Raspberry Pi, has now been released based on Debian 9 (Stretch). While this provides the benefits and enhancements of a more recent Linux release, another benefit is the updated products available in the Debian repository. You can download Raspian from https://www.raspberrypi.org/downloads/raspbian/ Raspbian Stretch with desktop Image with desktop based on Debian Stretch Version: August 2017 Release date: 2017-08-16 Kernel version: 4.9 Release notes: 2017-08-16: * Based on Raspbian Stretch (Debian version 9) * Version 60 of Chromium browser included * Version 3.0.1 of Sonic Pi included * Version 6.1.1 of RealVNC included * Version 0.17.4 of NodeRED included * Bluetooth audio routed via ALSA rather than Pulseaudio * SenseHAT extension added to Scratch 2 * Various desktop applications modified to prompt for sudo password if needed * lxinput control options for mouse speed simplified * lxpanel plugins moved into separate packages * Wireless firmware for Pi 3 and Pi 0W modified to address Broadpwn exploit * Latest kernel and firmware * Various small tweaks, bug fixes and theme modifications cheers, Ian.

2 1

How to Scan Your Linux Computer for Viruses and Rootkits
by Peter Reutemann 27 Aug '17

27 Aug '17

'Are you worried that your Linux computer may be infected with malware? Have you ever checked? While Linux systems tend to be less susceptible to malware than Windows, they can still be infected. Many times they’re less obviously compromised, too. There are a handful of excellent open-source tools to help you check if your Linux system has been the victim of malware. While no software is perfect, these three have a solid reputation and can be trusted to find most known threats.' -- source: https://www.maketecheasier.com/scan-linux-for-viruses-and-rootkits/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

A New Non-Money Oriented Crowdsourcing Platform Based On Code Contributions
by Peter Reutemann 27 Aug '17

27 Aug '17

An anonymous reader shares a new crowdfunding site built on open source principles to "remove the money element from project creation" so creators "don't have to take extreme actions such as quitting their jobs or compromising on their ideas because of investor demands. Because of the nature of crowdsourcer.io projects, project creators can remain as ambitious as funded projects and get all the contributors they need to make their idea a reality." >From the site: Crowdsourcer.io is an alternative crowd sourcing platform that allows developers and designers alike to create or join in on software related projects, build up their contribution and earn an income from the final product. Think of Crowdsourcer.io as something between open source software creation and Kickstarter start ups, a new crowd sourcing alternative, in its purest form" The site's creator recently answered questions on Reddit, saying they'd spent years fine-tuning the idea, and writing that "It's really focussed on people who don't want to quit their job to form their own software company, and don't want to become embroiled in debt or other financing." A note at the bottom of the site adds that "Crowdsourcer.io is young. We want your ideas!" -- source: https://developers.slashdot.org/story/17/08/27/0639253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

screen with a scrollbuffer / scroll wheel support
by Peter Reutemann 25 Aug '17

25 Aug '17

Hi everyone Finally figured out (well, by that I mean googled) how to change the scrollbuffer for screen sessions (running + default setting): https://stackoverflow.com/questions/8760346/how-do-i-increase-the-scrollbac… And how to get the mouse scroll wheel working (works on mate-terminal): https://stackoverflow.com/questions/359109/using-the-scrollwheel-in-gnu-scr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux expr command tutorial for beginners (with examples)
by Peter Reutemann 25 Aug '17

25 Aug '17

'Sometimes, while working on the command line (especially when dealing with a shell script), you may find yourself in a situation where you have to perform actions like searching for a substring in a string, finding its index, as well as other things like performing comparisons and arithmetic operations. For those who aren't in the know, there exists a command line utility - dubbed expr - that lets you do all this. In this tutorial, we will discuss the basics of this command along with some of the features it provides.' -- source: https://www.howtoforge.com/linux-expr-command/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Touch-panel PCs run Raspbian on Raspberry Pi CM3
by Peter Reutemann 25 Aug '17

25 Aug '17

'Comfile has launched two IP65 protected, resistive touch panel PCs with 7- and 10.2-inch 800 x 480 displays, built around the Raspberry Pi Compute Module 3. In February, Saelig Co. announced distribution of Janz Tec’s Raspberry Pi 3-based emPC-A/RPI3 industrial controller. Now, Saelig has launched North American distribution of Korea-based Comfile’s ComfilePi line of touch panel computers built around the Raspberry Pi Compute Module 3 (CM3) computer-on-module version of the Raspberry Pi 3.' -- source: http://linuxgizmos.com/touch-panel-pcs-run-raspbian-on-raspberry-pi-cm3/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Help Purism Build the Secure Open Source Linux-based Librem 5 Smartphone
by Peter Reutemann 24 Aug '17

24 Aug '17

'Thankfully, consumers are starting to wake up and become more aware of security and privacy, and some companies, such as Purism, are designing products to safeguard users. The company's laptops, for instance, run an open source Linux-based operating system, called "PureOS" with a focus on privacy. These machines even have hardware "kill switches" so you can physically disconnect a webcam or Wi-Fi card. Today, Purism announces that it is taking those same design philosophies and using them to build a new $599 smartphone called Librem 5. The planned phone will use the GNOME desktop environment and PureOS by default, but users can install different distros too. Sound good? Well you can help the company build it through crowdfunding. "Purism, the social purpose corporation which designs and produces popular privacy conscious hardware and software, has revealed its plans to build the world's first encrypted, open platform smartphone that will empower users to protect their digital identity in an increasingly unsafe mobile world. After 18 months of R&D to test hardware specifications and engage with one of the largest phone fabricators, Purism is opening a self-hosted crowdfunding campaign to gauge demand for the initial fabrication order and add the features most important to users," says Puris' -- source: https://linux.slashdot.org/story/17/08/24/147204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft .NET Core 2.0 For Linux Released; Redhat Will Bundle Microsoft's .NET
by Peter Reutemann 24 Aug '17

24 Aug '17

'Microsoft recently released Visual Studio 15.3 for Windows and Visual Studio 7.1 for Mac with .NET core 2.0. In addition to porting Microsoft Code and SQL Server to Linux, they have ported .NET. Redhat will bundle .NET in their software offerings instead of relying on Mono. .NET core is Microsoft's open-source .NET platform which is not based off Mono and available for Linux, Mac, and Windows here.' -- source: https://tech.slashdot.org/story/17/08/23/2046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Spyware backdoor prompts Google to pull 500 apps with >100m downloads
by Peter Reutemann 23 Aug '17

23 Aug '17

'At least 500 apps collectively downloaded more than 100 million times from Google's official Play Market contained a secret backdoor that allowed developers to install a range of spyware at any time, researchers said Monday. The apps contained a software development kit called Igexin, which makes it easier for apps to connect to ad networks and deliver ads that are targeted to the specific interests of end users. Once an app using a malicious version of Igexin was installed on a phone, the developer kit could update the app to include spyware at any time, with no warning. The most serious spyware installed on phones were packages that stole call histories, including the time a call was made, the number that placed the call, and whether the call went through. Other stolen data included GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps.' -- source: https://arstechnica.com/information-technology/2017/08/500-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky Versus The Newspapers
by Lawrence D'Oliveiro 22 Aug '17

22 Aug '17

Sky TV, in its latest annual report, is blaming its poor performance on “piracy”, specifically “the newspaper industry”. [CEO John] Fellet, in the company's annual report, said media outlets were taking clips from "the best parts" of Sky sport content and placing them on their websites without permission. Fair Dealing provisions in the Copyright Act allow news outlets to use a copyrighted work in the context of reporting current events. <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11908731>

1 0

Moreutils – A Collection Of More Useful Unix Utilities
by Peter Reutemann 22 Aug '17

22 Aug '17

'We all know about GNU core utilities that comes pre-installed with all Unix-like operating systems. These are the basic file, shell and text manipulation utilities of the GNU operating system. The GNU core utilities contains the commands, such as cat, ls, rm, mkdir, rmdir, touch, tail, wc and many more, for doing the day-to-day operations. Since these commands are part of Core Utilities, you don’t have to manually install them. Among these utilities, there are also some other useful collection of Unix utilities which are not included in any Unix-like operating systems. Meet moreutilis, a growing collection of the unix tools. The moreutils can be installed on GNU/Linux, and various Unix flavours such as FreeBSD, openBSD and Mac OS.' -- source: https://www.ostechnix.com/moreutils-collection-useful-unix-utilities/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Solus 3 Released
by Peter Reutemann 21 Aug '17

21 Aug '17

'The Solus Project is proud to announce the availability of Solus 3, the latest release of its Linux-based operating system, which builds on its curated rolling release model. Solus offers users a free and modern alternative to commercial operating systems and provides users a safe and reliable vehicle to guide, guard and enable the user's journey through a shifting tech world to their destination and beyond.' -- source: http://www.linuxandubuntu.com/home/solus-3-released-here-is-whats-new-in-so… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TheSSS (The Smallest Server Suite) 22.2 Debuts
by Peter Reutemann 21 Aug '17

21 Aug '17

'4MLinux developer Zbigniew Konojacki informs Softpedia on Sunday about the release and general availability of TheSSS (The Smallest Server Suite) 22.2 independently-developed, 4MLinux-based server-oriented GNU/Linux distribution. [...] Those unfamiliar with TheSSS (The Smallest Server Suite) will be glad to learn that the project provides them with a live server suite that lets them run a full-featured Linux server without installing any package on their computer, directly from the bootable medium. TheSSS is a lightweight and fast server solution, and it's free.' -- source: http://news.softpedia.com/news/thesss-the-smallest-server-suite-22-2-debuts… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fdisk Versus parted
by Lawrence D'Oliveiro 21 Aug '17

21 Aug '17

When the first hard drives appeared that were bigger than the 2TiB limit that the MBR partition format could cope with, it seemed like the only tool available that could manage partitions in the new GPT format was GNU parted. So you had to say goodbye to the old fdisk and sfdisk utilities, and learn a new way of setting things up. Well, it turns out that the old programs have been updated with new features, and they can now cope with setting up and using GPT-partitioned disks just fine. I particularly like the “sfdisk -d” command, which dumps out the partition table in a detailed format that can be backed up and then used for restoration later, if the disk’s partition table should somehow get corrupted. As far as I could see, parted never gave the exact numbers, down to the sector, that were necessary for this. Also, in the past day, two problems with parted have manifested themselves acutely to me: * All partitioning changes are made immediately, unlike fdisk. * Also unlike fdisk, it didn’t seem to notice if you were clobbering existing partitions, and would happily overwrite them. Each of these (mis)features might seem bad enough on its own, but putting them together is a recipe for woe. So in future, I think I am going to abandon parted and go back to fdisk and sfdisk.

2 3

postmarketOS Pursues A Linux-Based, LTS OS For Android Phones
by Peter Reutemann 20 Aug '17

20 Aug '17

'Buy an iPhone and you might get 4-5 years of official software updates. Android phones typically get 1-3 years of updates... if they get any updates at all. But there are ways to breathe new life into some older Android phones. If you can unlock the bootloader, you may be able to install a custom ROM like LineageOS and get unofficial software updates for a few more years. The folks behind postmarketOS want to go even further: they're developing a Linux-based alternative to Android with the goal of providing up to 10 years of support for old smartphones... Right now postmarketOS is a touch-friendly operating system based on Alpine Linux that runs on a handful of devices including the Samsung Galaxy Nexus, Google Nexus 4, 5, and 7 (2012), and several other Samsung, HTC, LG, Motorola, and Sony smartphones. There are also ports for some non-Android phones such as the Nokia N900 and work-in-progress builds for the BlackBerry Bolt Touch 9900 and Jolla Phone. Note that when I say the operating system runs on those devices, I basically mean it boots. Some phones only have network access via a USB cable, for instance. None of the devices can actually be used to make phone calls. But here's the cool thing: the developers are hoping to create a single kernel that works with all supported devices, which means that postmarketOS would work a lot like a desktop operating system, allowing you to install the same OS on any smartphone with the proper hardware. One postmarketOS developer complains that Android's architecture "is based on forking (one might as well say copy-pasting) the entire code-base for each and every device and Android version. And then working on that independent, basically instantly incompatible version. Especially adding device-specific drivers plays an important role... Here is the solution: Bend an existing Linux distribution to run on smartphones. Apply all necessary changes as small patches and upstream them, where it makes sense."' -- source: https://linux.slashdot.org/story/17/08/19/2359258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intro To SELinux
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this video recently <https://www.youtube.com/watch?v=cNoVgDqqJmM> from the Red Hat Summit a couple of years ago, which gives a simplified intro to Security-Enhanced Linux (SELinux), which is a set of high-security “mandatory access control” features added to the Linux kernel. There are still some people who get conniptions when they hear that SELinux was originally created by the US National Security Agency. But the code has been through a lot of independent peer review in the time (close to two decades) since then, so rest assured you can have high confidence in it. But it can be a very complex and intimidating piece of software: particularly if you get something wrong and then some service gets denied access to some file or other for mysterious reasons that you cannot fathom. Luckily, there are tools available to help you diagnose such problems. The video talks only about RHEL, but I think those tools are not distro-specific. For a start, SELinux can be set in one of three operating modes: “enabled” (actively blocking/enabling access according to set policy); “disabled” (not active), and “permissive” (where it logs only the actions it would take, without actually blocking any access). The last one is particularly useful for seeing what you would need to fix before you actually enable SELinux, before anything actually breaks. Related to this, each system log message denying access to something also shows a command that you can use to get more detailed information about why that access was blocked, and various things you might do to enable it if that’s what you want. RHEL itself allows you to set two levels of operation of SELinux: “targeted” mode (where a particular critical set of services is controlled by SELinux, while every thing else operates as though it were not there) and “multi-level/multi-category” mode, which is the one that probably justifies the reputation of SELinux for being complex and intimidating, and which is likely only of interest to certain Government employees who don’t like to talk about their job. And which is not addressed in the talk: it only describes “targeted” operation. The video goes step-by-step through a couple of scenarios with using SELinux to control the behaviour of Apache: granting users the ability to set up their own “public_html” directories, and moving a web page created by a staffer into the server area. It shows the mistakes you might make, how they manifest themselves in the logs, and how you correct them. He makes it seem so simple, you feel tempted to actually try SELinux for yourself. Go watch the video.

1 0

Intro To systemd
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this YouTube video recently <https://www.youtube.com/watch?v=S9YmaNuvw5U> from the Red Hat Summit a couple of years ago, which gives a good intro to systemd, with Lennart Poettering as co-presenter. The video explains what a “service” is, and compares how much simpler it is to define a service (usually just a few lines of declarative config) versus the hundreds of lines of shell script it typically takes to set things up under the ancient sysvinit system. Not only that, but it is possible to customize the standard service definitions without having to copy and paste the entire existing definition file: you just create a few lines of additional/overriding definition in a “drop-in” file that you place in /etc, that matches the name of the original service definition. There is even a command, “systemd-delta”, which lets you immediately see all the places where your entire systemwide configuration has been so customized. Lennart mentions that speeding up boot was never a specific design goal, it just naturally came out of the parallelization of service startup. Because systemd lets you think in terms of “services” rather than “processes”, it achieves something that was difficult to ensure before, namely reliable shutdown of a service. Consider Apache, which typically spawns a whole lot of processes, and then if you run CGI scripts, they require additional processes. Nevertheless, shutting down httpd.service with systemd will ensure that all those processes are terminated. Another important feature of systemd is the logging. Here again systemd had a goal of achieving something that was difficult before, namely capturing all log messages from the earliest possible stages of the boot process, including the initrd stage. And also because the systemd journal mechanism has access to kernel information about the processes doing the logging, it can include information in the log entries that those processes cannot forge. Me, I like the fact that the log timestamps are stored in UTC, so you can display them in whatever timezone you wish. There is more, of course: “slices” are how systemd is able to strictly limit the resource usage of services (important to the RHEL-using, Java-suffering audience), and “sockets” are how the functionality of inetd/xinetd is carried over to the systemd world, so that services can be started on demand, instead of having to run all the time. Watch the video to learn more.

1 0

Do not rely on journald to continue logging after a stop+start
by Bryan Baldwin 18 Aug '17

18 Aug '17

Whilst investigating a problem where services logging to sterr go silent after journald is stopped and started, but not when "restarted", Evgeny Vereshchagin suggests not relying on journald. In spite of its man page, it seems that "restart" isn't quite the same thing as stop+start to journald. Vereshchagin also confirms that is isn't currently possible to prevent a manual stop without also preventing a "restart", and that these shortcomings in using journald should get added to the documentation. https://github.com/systemd/systemd/issues/6620#issuecomment-322718725

1 0

Mageia 6: is it the rise of Phoenix?
by Peter Reutemann 18 Aug '17

18 Aug '17

'There is no secret that I always preferred distributions with the DEB package format. However, there is an exception. Mageia was the distribution that I ran for quite long time on various laptops. Unfortunately, the issues with outdated packages made me leave this distribution behind some time ago. Just as a reminder, Mageia is an off-spring from the famous Mandriva family that survived when the Mandriva tree crashed. And to fill out the whole forest, OpenMandriva is another off-spring, and my recent test showed that it is far below the mother quality. Coming back to Mageia, it has been a long time since the previous version of this operating system was released. Mageia 5.0 was the “most recent release” for 1.5 years, and 5.1 was merely an update to it. Mageia 6 was released just few weeks ago, in July 2017. It is a good time to check it out now.' -- source: http://linuxblog.darkduck.com/2017/08/mageia-6-is-it-rise-of-phoenix.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How To List The Dependencies Of A Package In Linux
by Peter Reutemann 17 Aug '17

17 Aug '17

'The other day I was trying to figure out if there is any easy way to find or list the dependencies of a package in Linux. I have been using Linux as my primary OS for few years now, yet I couldn’t how to find the dependencies for a certain package. Fortunately, I found a workaround after a few google searches and wanted to share it with our readers. So, here you go.' -- source: https://www.ostechnix.com/list-dependencies-package-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When The Cookie Meets The Blockchain
by Lawrence D'Oliveiro 17 Aug '17

17 Aug '17

Cryptocurrencies like Bitcoin are supposed to allow for completely anonymous financial transactions. However, if you use them at an online shopping site, such places often have enough tracking information in place to link you to a particular currency transaction anyway. <http://freedom-to-tinker.com/2017/08/17/when-the-cookie-meets-the-blockchai…>

2 2

Learn the basics of the ZSH shell
by Peter Reutemann 17 Aug '17

17 Aug '17

'Bash isn't bad. It gets the job done just fine, but have you ever considered what it'd be like if Bash had some extra features to make it more convenient to work with? That's more-or-less what ZSH is. It includes all of the features that you'd expect from Bash, but it also has some really nice additions to make your life easier. Actually, you'll be amazed at how much easier they make working in the command line. ' -- source: https://linuxconfig.org/learn-the-basics-of-the-zsh-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to secure your LAMP server
by Peter Reutemann 17 Aug '17

17 Aug '17

'The LAMP stack which stands for Linux, Apache, MySQL/MariaDB and PHP/Python/Perl is a very popular combination of free and open-source software used to run millions of websites today. Although many opt for the much efficient LEMP stack based on Nginx instead of Apache, there are still a significant number of users that choose LAMP for their projects. In fact, more than 30% of the active websites today run on top of LAMP. The stack is considered as reliable and very suitable for running high-performance high-availability web applications. In this tutorial we are going to show you how to secure the LAMP stack on your Linux VPS.' -- source: https://www.rosehosting.com/blog/how-to-secure-your-lamp-server/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email Provider ProtonMail Says It Hacked Back, Then Walks Claim Back
by Peter Reutemann 17 Aug '17

17 Aug '17

'On Wednesday, encrypted email provider ProtonMail claimed it had hacked someone who was impersonating its service in phishing emails, and the company then swiftly deleted the tweet. Early Wednesday morning, the security researcher known as x0rz tweeted out a series of screenshots allegedly showing someone sending emails that directed targets to a fake ProtonMail login screen. "You have an overdue invoice," the message read. In response, ProtonMail said it had taken action. "We also hacked the phishing site so the link is down now," ProtonMail tweeted. Depending on the context and what exactly the retaliating organization did, hacking back can be illegal. Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation. A recently proposed bill would attempt to legalize the practice. ProtonMail swiftly deleted its tweet, but not before x0rz could grab and subsequently tweet a screenshot. x0rz then deleted his own tweet at the request of ProtonMail.' -- source: https://it.slashdot.org/story/17/08/16/2021257/email-provider-protonmail-sa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: System76’s Galago Pro solves “just works” Linux’s Goldilocks problem
by Peter Reutemann 16 Aug '17

16 Aug '17

'In recent years, the PC industry has finally spawned a few manufacturers offering up machines with Linux pre-installed to eliminate this issue. By this point, I've tested most of them around Ars: Dell's XPS and Precision lines both have Linux-friendly offerings, and dedicated Linux manufacturers like System76 have long offered decent hardware with Linux pre-installed. In all this testing, I've yet to encounter a driver problem, which is the real benefit of a machine with Linux pre-installed. (Though to be fair, I could say the same for the Lenovo x240 that serves as my daily driver.) Still, finding the perfect Linux laptop has always been and remains something of a Goldilocks problem: this one is too big, this one is too underpowered, this one has too little RAM, this one lacks a big SSD, and so on. Generally speaking, if you want power and storage you're going to end up with something too big to comfortably throw in a bag and carry all day. The Dell Precision 7520 and the System76 Oryx Pro are good examples of this. [...] What Linux users like myself have long wanted is a laptop with roughly the form factor and weight of a Macbook pro, but with the option to get 32GB of RAM or 3TB of storage. This is the mythical unicorn of pre-built Linux machines, a laptop that is both reasonably lightweight and powerful. And that, my fellow Linux users, is refreshingly what System76 has managed to deliver with its new Galago Pro laptop.' -- source: https://arstechnica.com/gadgets/2017/08/review-system76s-galago-pro-solves-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSource.com Test-Drives Linux Distros From 1993 To 2003
by Peter Reutemann 14 Aug '17

14 Aug '17

'A unique trait of open source is that it's never truly EOL (End of Life). The disc images mostly remain online, and their licenses don't expire, so going back and installing an old version of Linux in a virtual machine and getting a precise picture of what progress Linux has made over the years is relatively simple... Whether you're new to Linux, or whether you're such an old hand that most of these screenshots have been more biographical than historical, it's good to be able to look back at how one of the largest open source projects in the world has developed. More importantly, it's exciting to think of where Linux is headed and how we can all be a part of that, starting now, and for years to come. The article looks at seven distros -- Slackware 1.01 (1993), Debian 0.91 (1994), Jurix/S.u.S.E. (1996), SUSE 5.1 (1998), Red Hat 6.0 (1999), Mandrake 8.0 (2001), and Fedora 1 (2003). Click through for some of the highlights.' -- source: https://linux.slashdot.org/story/17/08/12/0341251 Cheers, Pete -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Clamping Down On VPNs
by Lawrence D'Oliveiro 12 Aug '17

12 Aug '17

“The Listening Post” on Al Jazeera this week <http://www.aljazeera.com/programmes/listeningpost/2017/08/great-firewall-up…> talks among other things about the attempts by China and other countries to clamp down on their citizens’ access to virtual private networks. While these have many legitimate “non-political” applications (particularly for business), they can also be used to bypass state censorship. China, as you may know, has the most advanced system for restricting access within its borders to sources of content outside them that the state has deemed undesirable. The plan for ensuring that this clampdown on VPNs is done in a way that doesn’t hurt its own business interests is to license VPN providers within the country, and make sure they allow state monitoring, and do not give access to “undesirable” sites. Apple, for one, has acquiesced to China’s demands and removed VPN apps from its Iphone app store within the PRC. However, as one of those interviewed in the piece points out, on the Android side there are 400 different app stores accessible within China, and it would be quite another matter to make sure they all comply with the new law.

1 0

That Reminds Me ...
by Lawrence D'Oliveiro 10 Aug '17

10 Aug '17

... I finally got around to writing up some notes on the tips I presented for accessing the systemd journal at that talk last year <https://github.com/WLUG/meetings/tree/master/2016/2016-06-27>.

6 11

A look at OpenSUSE based Gecko Linux
by Peter Reutemann 10 Aug '17

10 Aug '17

'I was sitting at home writing future articles for Ghacks and I decided on a spur of the moment whim that I wanted to try out a distribution I had never touched before. I’ve tried countless systems over the years, from the typical Ubuntu and Debian based systems, to Arch based systems like Manjaro, even Gentoo based systems like Sabayon. However, I was thinking about it and OpenSUSE used to be one of my favourite distributions to use but I’ve never actually sat down and tried a respin of an OpenSUSE based system; so I started digging around into what some popular ones were...And Gecko Linux caught my eye.' -- source: https://www.ghacks.net/2017/08/06/a-look-at-opensuse-based-gecko-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

exa a modern replacement for ls written in rust for Linux/Unix
by Peter Reutemann 09 Aug '17

09 Aug '17

'ls is a command to show files in Linux and Unix-like operating systems. A ls command first appeared in a version of AT&T UNIX as well as in Multics. BSD and GNU Coreutils package provides the ls command with minor syntax changes. There is now third alternative named exa. It is a modern replacement for ls. The exa uses colors for information by default, helping you distinguish between many types of files, such as whether you are the owner, or in the owning group. It also has extra features not present in the original ls, such as viewing the Git status for a directory or recursing into directories with a tree view. The exa command written in Rust, so it’s small, fast, and portable.' -- source: https://www.cyberciti.biz/open-source/command-line-hacks/exa-a-modern-repla… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 55 Arrives With WebVR on Windows, Performance Panel, and Click-to-Play Flash
by Peter Reutemann 08 Aug '17

08 Aug '17

'Mozilla today made available a new update to Firefox for Windows to introduce support for WebVR, that the company says, will enable desktop VR users to dive into web-based experiences with ease. Firefox 55 also includes performance panel, faster startup when restoring multiple tabs, a quicker way to search across various search engines, and click-to-play Flash by default. From a report: WebVR is an experimental JavaScript API that provides support for virtual reality devices, such as the HTC Vive, Oculus Rift, and Google Cardboard. As its name implies, the technology is meant for browsers. If you find a web game or app that supports VR, just click the VR goggles icon visible on the web page to experience it using your VR headset. WebVR supports navigating and controlling VR experiences with handset controllers or your movements in physical space. [...] Firefox 55 also allows users to adjust the number of processes and how much resources they want to allocate to any of them. This setting is at the bottom of the General section in Options. In fact, if your computer has more than 8GB of RAM, Mozilla recommends "bumping up the number of content processes that Firefox uses" because it will make Firefox faster, though at the expense of using more memory. In its own tests on Windows 10, the company found that Firefox uses less memory than Chrome, even with eight content processes running.' -- source: https://tech.slashdot.org/story/17/08/08/143246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla’s new file-transfer service isn’t perfect, but it’s drop-dead easy
by Peter Reutemann 07 Aug '17

07 Aug '17

'Mozilla is testing a new service that makes it dead simple and quick for people to semi-securely share files with anyone on the Internet. Send, as the service is called, allows senders to encrypt any 1-gigabyte or less file and upload it to a Mozilla server. The service then creates a link with a long, complex string of letters in it that's required to download and decrypt the file. Mozilla will automatically delete the encrypted file as soon as it's downloaded or within 24 hours of being uploaded, even if no one has downloaded it.' -- source: https://arstechnica.com/information-technology/2017/08/mozillas-new-file-tr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSSL Support In Debian Unstable Drops TLS 1.0/1.1 Support
by Peter Reutemann 07 Aug '17

07 Aug '17

'Debian Linux "sid" is deprecating TLS 1.0 Encryption. A new version of OpenSSL has been uploaded to Debian Linux unstable. This version disables the TLS 1.0 and 1.1 protocol. This currently leaves TLS 1.2 as the only supported SSL/TLS protocol version. This will likely break certain things that for whatever reason still don't support TLS 1.2. I strongly suggest that if it's not supported that you add support for it, or get the other side to add support for it. OpenSSL made a release 5 years ago that supported TLS 1.2. The current support of the server side seems to be around 90%. I hope that by the time Buster releases the support for TLS 1.2 will be high enough that I don't need to enable them again. This move caused some concern among Debian users and sysadmins. If you are running Debian Unstable on server tons of stuff is going to broken cryptographically. Not to mention legacy hardware and firmware that still uses TLS 1.0. On the client side (i.e. your users), you need to use the latest version of a browser such as Chrome/Chromium and Firefox. The Older version of Android (e.g. Android v5.x and earlier) do not support TLS 1.2. You need to use minimum iOS 5 for TLS 1.2 support. Same goes with SMTP/mail servers, desktop email clients, FTP clients and more. All of them using old outdated crypto. This move will also affect for Android 4.3 users or stock MS-Windows 7/IE users (which has TLS 1.2 switched off in Internet Options.) Not to mention all the mail servers out there running outdated crypto.' -- source: https://linux.slashdot.org/story/17/08/07/1823244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME's Text Editor gedit 'No Longer Maintained', Needs New Developers
by Peter Reutemann 06 Aug '17

06 Aug '17

'AmiMoJo brings news about gedit, the default text editor for GNOME: In a post to the gedit mailing list, Sébastien Wilmet states that gedit is no longer maintained and asks "any developer interested to take over the maintenance of gedit?" Just in case you were considering it, he warns "BTW while the gedit core is written in C (with a bit of Objective-C for Mac OS X support), some plugins are written in Vala or Python. If you take over gedit maintenance, you'll need to deal with four programming languages (without counting the build system). The Python code is not compiled, so when doing refactorings in gedit core, good luck to port all the plugins (the Python code is also less "greppable" than C). At least with Vala there is a compiler, even if I would not recommend Vala." Sébastien's comments were surrounded by a <rant-on-languages> tag, but they're still crying out for some serious discussion. Any Slashdot readers want to share their own insights on Python, some fond thoughts on gedit, or suggestions for maintaining a great piece of open source software?' -- source: https://tech.slashdot.org/story/17/08/05/025227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Red Hat Acquires Data-Cleaning Company Permabit
by Peter Reutemann 06 Aug '17

06 Aug '17

'Business software company Red Hat said on Monday that it is acquiring the technology assets of Permabit, a small company that specializes in cleaning up corporate data to make storage more efficient and data access faster. Terms of the deal were not disclosed but a Red Hat spokesman said 16 people from Permabit will be joining that company... While the conventional wisdom is that data storage is cheap, it is not free. And with companies turning to more expensive flash storage, it saves money to remove redundant data, said Richard Fichera, vice president and principal analyst at Forrester Research... Red Hat, which sells a version of the Linux operating system used by many Fortune 500 companies, also offers its own storage software. And, it wants to become a more formidable challenger in data storage, a goal that can be furthered by buying Permabit's technology, Fichera said. Slashdot reader See Attached points out that this week Red Hat also released RHEL 7.4, which introduces support for Network Bound Disk Encryption (NBDE) and system protection against intrusive USB devices.' -- source: https://linux.slashdot.org/story/17/08/05/0453223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Hardeners Grsecurity Sue Open Source's Bruce Perens
by Peter Reutemann 06 Aug '17

06 Aug '17

'In late June, noted open-source programmer Bruce Perens [a longtime Slashdot reader] warned that using Grsecurity's Linux kernel security could invite legal trouble. "As a customer, it's my opinion that you would be subject to both contributory infringement and breach of contract by employing this product in conjunction with the Linux kernel under the no-redistribution policy currently employed by Grsecurity," Perens wrote on his blog. The following month, Perens was invited to court. Grsecurity sued the open-source doyen, his web host, and as-yet-unidentified defendants who may have helped him draft that post, for defamation and business interference. Grsecurity offers Linux kernel security patches on a paid-for subscription basis. The software hardens kernel defenses through checks for common errors like memory overflows. Perens, meanwhile, is known for using the Debian Free Software Guidelines to draft the Open Source Definition, with the help of others. Grsecurity used to allow others to redistribute its patches, but the biz ended that practice for stable releases two years ago and for test patches in April this year. It offers its GPLv2 licensed software through a subscription agreement. The agreement says that customers who redistribute the code -- a right under the GPLv2 license -- will no longer be customers and will lose the right to distribute subsequent versions of the software. According to Perens, "GPL version 2 section 6 explicitly prohibits the addition of terms such as this redistribution prohibition." A legal complaint (PDF) filed on behalf of Grsecurity in San Francisco, California, insists the company's software complies with the GPLv2. Grsecurity's agreement, the lawsuit states, only applies to future patches, which have yet to be developed. Perens isn't arguing that the GPLv2 applies to unreleased software. Rather, he asserts the GPLv2, under section 6, specifically forbids the addition of contractual terms.' -- source: https://yro.slashdot.org/story/17/08/04/2233239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Browser Extensions Are Undermining Privacy
by Peter Reutemann 06 Aug '17

06 Aug '17

'pizzutz writes: Chrome's popular Web Developer plugin was briefly hijacked on Wednesday when an attacker gained control of the author's Google account and released a new version (0.49) which injected ads into web pages of more than a million users who downloaded the update. The version was quickly replaced with an uncompromised version (0.5) and all users are urged to update immediately. Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts. Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."' -- source: https://yro.slashdot.org/story/17/08/05/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows console is getting a new, easier to read color scheme
by Lawrence D'Oliveiro 03 Aug '17

03 Aug '17

“Even with this work, the Windows console is still weak compared to its counterparts in macOS and Linux. In Windows, the operating systems-supplied console windows are closely tied to the command-line applications that use them; it's impossible to create a command-line application that isn't attached to a Windows console window. Linux and macOS offer a separation between the software that's displaying the console apps and the console apps themselves. Those operating systems have a built-in default console, but unlike Windows, they don't have to use it; third-party software can fill the same role. “Attractive, modern terminal applications like iTerm on macOS and Unix stalwarts such as screen (which enables multiple command-line shells to share a single console window) take advantage of this extensibility. Neither kind of application can be readily developed for command-line apps on Windows, and while people have tried to work around Windows' limitations (for example, by hiding the Windows built-in console windows off-screen somewhere), the results are imperfect. We're told that there are plans in store to finally address this weakness of Windows, though what the solution will be is at present unknown.” <https://arstechnica.com/gadgets/2017/08/the-windows-console-is-getting-a-ne…>

1 0

Systemd wins top gong for 'lamest vendor' in Pwnie security awards
by Bryan Baldwin 30 Jul '17

30 Jul '17

The lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement. Nomination Submission: Awarded to the vendor who mis-handled a security vulnerability most spectacularly. SystemD bugs 5998, 6225, 6214, 5144, 6237 Credit: Lennart Poettering Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie! https://pwnies.com/nominations/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/

3 2

Trust Me, I’m A Random-Number Generator
by Lawrence D'Oliveiro 30 Jul '17

30 Jul '17

SK Telecom has created a “quantum random number generator” chip <https://www.theregister.co.uk/2017/07/26/sk_telecom_makes_light_of_random_n…>. Seems like slapping the label “quantum” on anything is enough to make people believe you know what you are talking about. Random-number generators are notorious for being easily subverted. And hearing things like “SK Telecom hasn't specified what kind [of quantum noise source they are using]” is not exactly reassuring. You can never be sure your random numbers are truly random. But you try to stack the deck as much in your favour as you can. The Linux kernel mixes in several sources of entropy to feed /dev/random (and from there, /dev/urandom), in the hope that, as long as one of them remains unsubverted (intentionally or otherwise), the output can be trusted. This is also the principle behind the Fortuna PRNG <https://en.wikipedia.org/wiki/Fortuna_(PRNG)>, which well-known computer security guru Bruce Schneier had a hand in.

2 3

Anti-systemd Trolls
by Lawrence D'Oliveiro 27 Jul '17

27 Jul '17

I keep wondering about these random names who pop up with all the badmouthing every time somebody mentions something about systemd. I don’t recall any faces at WLUG meetings that go with them. Who are you and where do you come from? Do you people have any interest in the Waikato Linux User Group at all, or are you just here to shoot your mouths off?

4 9

Some Low-Cost Android Phones Come at a Price -- Your Privacy
by Peter Reutemann 27 Jul '17

27 Jul '17

'At $60, the BLU R1 HD is the top-selling phone on Amazon. Last November, researchers caught it secretly sending private data to China. Shanghai Adups Technology, the group behind the spying software on the BLU R1 HD, called it a mistake. But analysts at Kryptowire found the software provider is still making the same "mistake" on other phones. At the Black Hat security conference in Las Vegas on Wednesday, researchers from Kryptowire, a security firm, revealed that Adups' software is still sending a device's data to the company's server in Shanghai without alerting people. But now, it's being more secretive about it. "They replaced them with nicer versions," Ryan Johnson, a research engineer and co-founder at Kryptowire, said. "I have captured the network traffic of them using the Command and Control channel when they did it." An Adups spokeswoman said that it had resolved the issues in 2016 and that the issues "are not existing anymore." Kryptowire said it has observed the company sending data without telling users on at least three different phones.' -- source: https://it.slashdot.org/story/17/07/26/187258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0