- wlug - list.wlug.org.nz

Firefox 48 Released With Multi-Process Support, Mandatory Add-On Signing
by Peter Reutemann 02 Aug '16

02 Aug '16

'Mozilla on Tuesday released Firefox v48, touted as one of the most important updates the browser has ever received. With the new version, Firefox starts migrating users to using mullti-process threads (e10s, Electrolysis), and it is also the first version to ship with Rust component. In addition, Firefox is now also making add-on signing mandatory. >From a Softpedia article: Announced last year, Electrolysis, e10s, or multi-process support is Firefox's ability to process core browser operations separately from the content viewed on a Web page. Multi-process support allows a page to crash without bringing the entire browser down with it and improves the browser's overall performance. e10s rollout will take place in two phases, first in Firefox 48, and it will finish in Firefox 49, set for release on September 13, 2016. Mandatory add-on signing refers to Firefox preventing users from installing any add-ons that have not been approved by Mozilla's testers. This is something similar to what Chrome employs, but Firefox users have been spoiled all these years, always having the capability of installing any add-on they've desired. Rust is a programming language that's a revamped and improved version of C++ but that protects developers from accidentally including dangerous memory bugs in their code. It achieves this by how the language was constructed and by how developers write the code.' -- source: https://news.slashdot.org/story/16/08/02/1646255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Grabs More Than 2% of Desktop Market Share
by Peter Reutemann 02 Aug '16

02 Aug '16

'W3Counter's stats for June 2016 are in, and Linux desktop accounts for 2.48% of all web visits from tracked websites... (Android is counted separately from "Linux desktop.") Meanwhile, NetMarketShare shows Linux with a 2.02% share of the desktop market. And StatCounter shows a more detailed breakdown of the top 7 operating systems, with Windows 7 at 42.02%, Windows 10 at 21.88%, OSX at 9.94%, Windows 8.1 at 8.66%, Windows XP at 6.5%, and another 4.06% for "Unknown" (which is roughly tied with "Other") -- beating Windows 8.0 at 3.52%. In May they also reported another thought-provoking statistic: that Firefox's browser usage had surpassed that of IE and Edge combined for the first time.' -- source: https://linux.slashdot.org/story/16/07/02/184229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

There Is A Saying In Computer Science ...
by Lawrence D'Oliveiro 01 Aug '16

01 Aug '16

... that any problem can be solved by adding yet another level of indirection. (Might have been Butler Lampson who said that.) What brought that to mind was this report <http://phoronix.com/scan.php?page=news_item&px=Ubuntu-Netplan-YAML-Network> of a new Ubuntu project to add a common front end for generating network confgurations for all the different network-control backends. What, you mean there are setups that don’t use NetworkManager? Or even networkd?

1 0

Seymour Papert Has Died
by Lawrence D'Oliveiro 01 Aug '16

01 Aug '16

I remember I first heard of Seymour Papert when I picked up a copy of his book “Mindstorms” at the University library. This was based around the radical idea that young children could not only learn advanced concepts about mathematics and programming, but they could have fun doing so. For example, to draw a circle, you repeat the following some x number of times: * turn a little bit to one side * move a little bit forward (The larger the “x”, and the correspondingly smaller the “little bit” becomes, the better the approximation to a circle.) This comes straight out of a child’s intuitive idea of how they would walk in a circle (i.e. turtle graphics). But it is also a differential-geometric formulation of a circle! And today I discovered that Papert had suffered a serious traffic injury in Hanoi a decade ago. No word on whether he ever recovered, and now he has passed away, with no mention of the cause. <http://arstechnica.com/business/2016/08/seymour-papert-theorist-behind-one-…>

1 0

Microsoft Brings ChakraCore to Linux and OS X
by Peter Reutemann 01 Aug '16

01 Aug '16

'A few days ago I wrote about Microsoft's revival of Skype for Linux. I called it "a big deal" -- less because of Skype itself and more because it signified Microsoft's recognition that Linux is a platform worth supporting... Now the company has done it again. At Node Summit this week, Microsoft announced the availability of ChakraCore for Linux. ChakraCore is the core part of the Chakra JavaScript engine that powers Microsoft Edge and Universal Windows Platform. With this move, Microsoft is putting one of its core technologies on a competing platform. This, more than any other Linux-friendly move the company has made, is a clear departure from the Microsoft of Gates and Ballmer that used its technologies to lock users into Windows... While Ubuntu is the primary Linux distribution that Microsoft is using to showcase its ChakraCore technologies, the company said that the support should easily translate to other modern Linux distributions. ' -- source: https://apple.slashdot.org/story/16/07/31/151240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Site Checks Your Browser's Fingerprint
by Peter Reutemann 01 Aug '16

01 Aug '16

'"Does your web browser have a unique fingerprint? If so your web browser could be tracked across websites without techniques such as tracking cookies..." warns a new site created by the University of Adelaide and ACEMS, adding "the anonymization aspects of services such as Tor or VPNs could be negated if sites you visit track you using your browser fingerprint."' -- source: https://yro.slashdot.org/story/16/07/31/1357234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Onion Debian Services Are Now Available
by Peter Reutemann 01 Aug '16

01 Aug '16

'"I just set up a lot of Onion Services for many of Debian's static websites," announced Debian sys-admin Peter "weasel" Palfrader on Friday. "You can find the entire list of services on onion.debian.org. More might come in the future.' -- source: https://linux.slashdot.org/story/16/07/31/0017225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Earth-friendly EOMA68 Computing Devices
by Peter Reutemann 01 Aug '16

01 Aug '16

Interesting concept: 'A new crowdfunding campaign by Rhombus Tech "introduces the world's first devices built around the EOMA68 standard," which separates a "modular" CPU board from the rest of the system so that it can be easily used in multiple devices and upgraded more simply. Rhombus Tech is now offering a 15.6-inch laptop, a laser-cut wooden Micro-Desktop housing, and two types of computer cards, both using A20 dual-core ARM Cortex A7 processors. The cards are available with four flavors of the GNU/Linux operating system, and they're hoping to receive RYF certification from the Free Software Foundation. "No proprietary software," explains their campaign's video. "No backdoors. No spyware. No NDAs." They envision a world where users upgrade their computers by simply popping in a new card -- reducing electronic waste -- or print new laptop casings to repair defects or swap in different colors. (And they also hope to eventually see the cards also working with cameras, phones, tablets, and gaming consoles.' -- source: https://news.slashdot.org/story/16/07/31/0323255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting suggestion
by Peter Reutemann 30 Jul '16

30 Jul '16

Hi everyone William suggested a topic for our next meeting in August: "An introduction to Linux - features, history, examples of popular flavors (Debian, Ubuntu, Red Hat etc). Advantages and disadvantages to Windows." Meetup link: http://www.meetup.com/WaikatoLinuxUsersGroup/events/232676239/ He volunteered to cover a bit of the history (if I remember correctly), but we need others as well to fill in the rest! What do you think? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 10

meeting suggestion
by rowan schischka 29 Jul '16

29 Jul '16

When are these meetings and how can i help? -- Kind Regards Rowan Schischka

2 1

Dark Patterns: User Interfaces Designed To Confuse
by Lawrence D'Oliveiro 28 Jul '16

28 Jul '16

Ever come across websites that seem designed to trick you into paying for things you might not want? <http://arstechnica.com/security/2016/07/dark-patterns-are-designed-to-trick…>

1 0

NIST Says Two-Factor Auth Via SMS Is Not A Good Idea
by rowan schischka 26 Jul '16

26 Jul '16

Regarding two factor sms authentication; I wonder if new Zealands mobile providers are able to be tricked into sending out replacement Sim cards

1 0

NIST Says Two-Factor Auth Via SMS Is Not A Good Idea
by Lawrence D'Oliveiro 25 Jul '16

25 Jul '16

The US National Institute for Standards and Technology is updating its Digital Authentication Guideline <http://www.theregister.co.uk/2016/07/24/nist_says_sms_no_good_for_authentic…>. Responding to recent cases where SMS-based two-factor authentication systems were hijacked to rack up charges on premium-rate phone numbers, it is now saying that sending a text message is no longer good enough. At least the service sending the messages needs to be sure they are going to a real mobile phone. Interestingly, it is posting review documents on GitHub, as an addition to the usual publication channels.

1 0

WLUG Library
by Chris O'Halloran 20 Jul '16

20 Jul '16

Hello all, I'm the holder of the WLUG library but as you're aware I haven't brought it along the meeting much. Would anyone care to be the caretaker of it for a while? I can bring it along to next Monday's meeting. Cheers, Chris

1 1

Meeting next Monday
by Peter Reutemann 20 Jul '16

20 Jul '16

Hi everyone We have a meeting schedule for next Monday: "X11, the most common display server on Linux, is showing its age. Newcomers, like Wayland and Mir are trying to address shortcomings and provide a basis for the future. Let's have a look at what each of the display servers' strengths and weaknesses are." We still need volunteers for presenting the Wayland and Mir? Any takers? More details here: http://www.meetup.com/WaikatoLinuxUsersGroup/events/232209899/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fontconfig How-To
by Lawrence D'Oliveiro 18 Jul '16

18 Jul '16

Quite a handy collection of font configuration tips and tricks at the Arch Linux Wiki <https://wiki.archlinux.org/index.php/Font_configuration>. I regularly come across ArchWiki links in online forums these days...

1 0

Report On Open-Source Sustainability
by Lawrence D'Oliveiro 18 Jul '16

18 Jul '16

Fernando Perez, one of the key developers behind Project Jupyter, has posted a link to a long, detailed report on the workings of Open Source <https://groups.google.com/d/msg/jupyter/SnfWgQ1Hx0E/F5936L-CAgAJ>. If you don’t have time to read the whole thing, there is also an “executive summary” in the form of a series of Twitter postings. Summary summary: getting companies to fund Open-Source projects, even ones that they might depend crucially on, is often a matter of luck.

1 0

Ubuntu Linux Forums Hacked -- IP Address, Username, Email of 2M Accounts Compromised
by Peter Reutemann 16 Jul '16

16 Jul '16

'Canonical announced on Friday that Ubuntu forums have been hacked. The company adds that data such as IP address, username, and email address of over two million users have been compromised. BetaNews reports: Keep in mind, this does not mean that the operating system has experienced a vulnerability or weakness. The only thing affected are the online forums that people use to discuss the OS. Still, such a hack is embarrassing as it happened due to Canonical's failure to install a patch. In a blog post, Jane Silber, Chief Executive Officer, Canonical said, "after some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched."' -- source: https://it.slashdot.org/story/16/07/15/1533236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week?
by Lawrence D'Oliveiro 16 Jul '16

16 Jul '16

“People with older PCs upgraded to Windows 10 and held onto them. Microsoft didn’t expect that number to be so high.” <http://www.theregister.co.uk/2016/07/15/one_in_five_consumers_used_free_win…>

1 0

GNU Nano Fork
by rowan schischka 15 Jul '16

15 Jul '16

from the very end of the article posted: "It seems the argument came down to licensing rules, because an idea of moving Nano to Github was incompatible with the GNU license." Can someone please explain this statement to me? I am completely out of the loop in understanding this. -- Kind Regards Rowan Schischka

2 1

Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data
by Lawrence D'Oliveiro 15 Jul '16

15 Jul '16

You may have heard of the ongoing case where the US FBI is demanding Microsoft turn over data held on servers in Ireland. The US Government is claiming that, because the Irish operation is under the control of Microsoft’s headquarters in the US, that it falls under US jurisdiction and so the company can be compelled to turn over the data with nothing more than a warrant issued by a US court. The appeals court has disagreed <https://www.techdirt.com/articles/20160714/10134734971/huge-win-court-says-…>. The peculiar thing is, there are already international arrangements under which the US can ask the Irish Government to request one of their courts to order the surrender of the data. But they don’t seem to want to do that.

3 3

Microsoft Still “Supporting” Windows RT
by Lawrence D'Oliveiro 15 Jul '16

15 Jul '16

Microsoft blocks a “security hole” on Windows RT tablets that might have allowed users to run alternative operating systems <http://www.theregister.co.uk/2016/07/15/windows_fix_closes_rt_unlock_loopho…>.

2 1

New Skype for Linux client released, built on Web technology
by Peter Reutemann 15 Jul '16

15 Jul '16

'A new Skype for Linux client is now available as an alpha. The Skype client for Linux had been long abandoned—it's stuck on version 4.3, compared to version 7 on Windows—but Microsoft has now belatedly recognized that Skype is at its most desirable when it's available on every platform. To that end, it has created an all-new Skype client. In fact, the new client has two versions. There's a Linux app for users of traditional Linux systems. There's also the Skype Web Client, which is supported in Chrome on Linux and Chromebooks running Chrome OS. Whether using the Web or the standalone app, the core code and capabilities are the same: it's using Chrome's WebRTC support to provide a plugin-free, Web-based Skype client.' -- source: http://arstechnica.com/information-technology/2016/07/skype-for-linux-is-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] puppy or qubes
by Michelle 14 Jul '16

14 Jul '16

After my last post, either that night or early next morning I realized I should have said a thank you to some folk. So to all those that shared information in an effort to help me.....Thank you. People at this LUG may indeed be right about puppy, I don't know. Here is an article about that policeman and puppy and banking: www.itnews.com.au/news/nsw-police-don't-use-windows-for-internet-banking-157767 So going off that article it would seem that any live distro that fits on RAM is safe for banking. Now as for Ian. It is intetesting to at least me. Many/most people don't move away from where they were born/bought up in. wwwpewsocialtrends.org/2008/12/17/who-moves-who-stays-put-wheres-home/ So a person could be getting sh*t from someine online that they babysitted. I find that ironic. No I'm not going off that article but rather family happenings bought me to that article. Anyway .....Ian. After Ian had a go at me last month for no reason: list.Waikato ac.nz/pipermail/wlug/2016-June/014171.html (I hope those two last addresses are correct after the effort it takes to type them on this finicky phone) If a person is bought to court, they never wear a shirt saying 'I am guilty'. Usually the jurry/judge has to go off circumstancial evidence. The most important point with Ian is that he had just had a YELLING RANT. Now when someone finishes a yellining rant, are they most likely to go: 1. Now who can I help or 2. Who will I have a go at next?. So anyway I'm having to type this out on my finicky little phone, because I Haven't had the privilege yet of buying a new computer yet that I know will work. So this isn't his entire post:wlug/2016-June/014171. But you can just go to last month if you're interested. So the next point of interest is that the very next thing that he "says to me' after his attack on me last month was this latest.....um stuff. "NOW WHAT ABOUT TRIMMING THOSE POSTS!!! OTHERWISE I MAY BE FORCED TO DIG OUT SOME ARCHAIC INTERNET ETIQUETTE FAQ AND POST IT IN FULL ALL IN CAPS. Just joshing people. But puhleeze???! A word for Michelle and the quest for perfection. Sometimes in this life there is a dichotomy between what we wish for and what we can actually accomplish. Maybe near enough is good enough. Is there actually such a thing as complete security on the internet? Possibly, but probably not for the average citizen. "You have zero privacy anyway. Get over it." Scott McNealy, formerly of Sun Microsystems. Sad but probably true" So about me and my quest for perfection: UN my post this month I said: "Well I give up. I have tried for months and invested dozens of hours to get a machine that runs qubes and it hasn't happened..... If nobody is prepared to do that it is more than fine . I will just buy a computer that runs a windows legacy os." Now I'm sorry, perhaps I missed the part there about "my quest for perfection ." Saying to to someone there "quest for perfection" well, whether that is taken taken as condescending or resemble depends on who said it, how they said it and when they said it.Vin this cade is was by a guy who had just insulted me and had just come of an angry rant! U think there were other things I wanted to mention about Ian but I can't remember. If I am amazingly wrong about Ian's intentions this time then so be it be he completely bought it upon his own head. On 2016-07-06 20:21, Peter Reutemann wrote: >> On Wed, Jul 6, 2016 at 4:46 PM, Michelle <michelle400(a)orcon.net.nz> >> wrote: >>> Puppy was recommended by a police officer. I think he was doing >>> banking for >>> the police maybe? >> >> Don't trust the filth. Surprised they even realize what Linux is. > > Please keep it civil! > > [...] > >>> So unless someone is willing to help in a hands on way, I don't want >>> anymore >>> help. Thanks anyway. >> >> Suggested it before, will suggest one last time. Show up to Te Ata on >> a Monday or Friday morning and someone from there will help. >> >> I'm sorry I couldn't be of more help but I really tried. Now to trim. > > If you read Michelle's emails again, you will see that she is not well > enough to travel. Therefore your offer is not an option. > > Cheers, Peter

3 4

Still life in Puppy take two
by Ian Young 13 Jul '16

13 Jul '16

Oh dear, what an aberrant keystroke will do. Moving on .... While it is probably mandatory to scorn Puppy, and indeed Puppy is but a pale shadow of its former self post the retirement of Barry Kauler, a few steadfast souls continue to produce useful variants Including one called Slacko. http://slacko.eezy.xyz/notes.php http://blog.puppylinux.com/ I am excited to announce the release of Puppy Linux Slacko 6.3.2. It is available in 32 bit and 64 bit versions. This might be called a bugfix release to Slacko 6.3.0 but it is so much more than that! This is the first ever official puppy to support UEFI booting for both for 32 and 64 bit versions and the same ISO image will boot legacy BIOS PCs as well. And there is so much more that is improved, such as the theming, sound detection, firewall, default application management plus our home grown apps such as pMusic. It is still based on upstream 14.1 but has all the latest security and bugfix updates. There is much more going on here than a point release can convey that is why we have given it 2 points! The official release announcement is available for 32 bit and 64 bit. For more information you can visit the release notes page and the download page. I Hope you enjoy using Slacko! Posted on 22 Jun 2016, 21:22 by 01micko

1 0

Still life in Puppy
by Ian Young 13 Jul '16

13 Jul '16

1 0

Firefox Bringing Rust Code Into Production
by Lawrence D'Oliveiro 13 Jul '16

13 Jul '16

<http://phoronix.com/scan.php?page=news_item&px=Firefox-48-First-Rust-Code> Rust is a programming language that is designed to make it harder to commit the kinds of stuffups that lead to crashes and security bugs. So the proof of the pudding will be whether future versions of Firefox will turn out to be more reliable and secure.

1 0

When man-db goes thug ... help?
by Eric Light 12 Jul '16

12 Jul '16

Hi guys Never seen this before, need a hand. Fairly fresh Debian 8 install, fully updated, running as root. root(a)ROOTCA:~/ca# man opensslroot(a)ROOTCA:~/ca# man -kroot(a)ROOTCA:~/ca# which man/usr/bin/manroot(a)ROOTCA:~/ca# man --helproot(a)ROOTCA:~/ca# ... When I execute man, it doesn't give me anything, and just returns me to the command prompt. Not even man --help will return a response. I've purged and reinstalled man-db, ensured that ncurses-base is installed, even checked the size of man (106912 bytes), and checked dmesg for any segfaults... there's just nothing I can find anywhere. Any ideas? Thanks in advance. E-- Securely sent with Tutanota. It's good, you should try it: https://tutanota.com

2 3

Bye-Bye 32 Bits
by Lawrence D'Oliveiro 12 Jul '16

12 Jul '16

Seems like nobody wants to offer 32-bit Linux builds any more... <http://www.theregister.co.uk/2016/07/05/linux_letting_go_32bit_builds_on_th…>

4 4

MIT Says Their Anonymity Network Is More Secure Than Tor
by Peter Reutemann 12 Jul '16

12 Jul '16

'Following the recent vulnerabilities in Tor, researchers at MIT's Computer Science and Artificial Intelligence Laboratory and the Ecole Polytechnique Federale de Lausanne have been working on a new anonymity network that they say is more secure than Tor. While the researchers are planning to present their new system, dubbed Riffle, at the Privacy Enhancing Technologies Symposium later this month, they did say the system uses existing cryptographic techniques, but in new ways. A series of servers are what make up Riffle, each of which "permutes the order in which it receives messages before passing them on to the next," according to a news release. "For instance, messages from senders Alice, Bob, and Carol reach the first server in the order A, B, C, that server would send them to the second server in a different order -- say C, B, A. The second server would permute them before sending them to the third, and so on." Nobody would know which was which by the time they exited the last server. Both Tor and MIT's anonymity network use onion encryption. Riffle uses a technique called verifiable shuffle in addition to onion encryption to thwart tampering and prevent adversaries from infiltrating servers with their own code. Last but not least, it uses authentication encryption to verify the authenticity of an encrypted message. The researchers say their system provides strong security while using bandwidth much more efficiently than similar solutions.' -- source: https://news.slashdot.org/story/16/07/11/2041203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ODF Versus OOXML
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

A summary of links comparing ODF (the file format native to LibreOffice and OpenOffice) with OOXML (as used in Microsoft’s Office suite): <http://courseweb.ischool.illinois.edu/~stanley8/LIS590DPL/standards/docform…>. Another reason why saving LibreOffice documents in MS Office format may cause formatting trouble (besides the usual inconsistencies that happen with MS Office formatting anyway) is that OOXML cannot actually represent all ODF information correctly.

1 0

GNU Nano Fork
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

Some ructions over GNU Nano have led to the creation of yet another tiny text editor <http://www.theregister.co.uk/2016/07/11/in_mourning_for_nano_chap_crafts_1k…>. With regard to this: “Benno also did not want to assign copyright to the FSF for his contributions.” it’s not clear why outfits like the FSF and Ubuntu want you to assign your copyrights to them. The Linux kernel project, for example, doesn’t require it <https://lwn.net/Articles/592503/>.

1 0

HTTPS crypto’s days are numbered. Here’s how Google wants to save it
by Peter Reutemann 09 Jul '16

09 Jul '16

'Like many forms of encryption in use today, HTTPS protections are on the brink of a collapse that could bring down the world as we know it. Hanging in the balance are most encrypted communications sent over the last several decades. On Thursday, Google unveiled an experiment designed to head off, or at least lessen, the catastrophe. In the coming months, Google servers will add a new, experimental cryptographic algorithm to the more established elliptic curve algorithm it has been using for the past few years to help encrypt HTTPS communications. The algorithm—which goes by the wonky name "Ring Learning With Errors"—is a method of exchanging cryptographic keys that's currently considered one of the great new hopes in the age of quantum computing. Like other forms of public key encryption, it allows two parties who have never met to encrypt their communications, making it ideal for Internet usage.' -- source: http://arstechnica.com/security/2016/07/https-crypto-is-on-the-brink-of-col… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mesa 12.0 Released With OpenGL 4.3 Support, Intel Vulkan and More
by Peter Reutemann 09 Jul '16

09 Jul '16

'Mesa3D developers have announced the release of Mesa 12.0. Mesa 12 notably adds open-source OpenGL 4.3 drivers for Intel, Radeon, and NVIDIA on Linux, and it also integrates the previously open-sourced Intel Vulkan graphics API driver. From the Phoronix analysis, "Mesa 12.0 is easily one of the biggest updates to this important open-source user-space OpenGL driver stack in quite some time and will offer much better support and features especially for Intel, Radeon, and NVIDIA open-source Linux desktop users/gamers."' -- source: https://linux.slashdot.org/story/16/07/08/2135213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services
by Peter Reutemann 08 Jul '16

08 Jul '16

'Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: "These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used 'honeypot' .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of 'infowar' weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered)." The Tor project is aware of the attack and is working to redesign its system to try and block it.' -- source: https://yro.slashdot.org/story/16/07/08/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe
by Peter Reutemann 08 Jul '16

08 Jul '16

'Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."' -- source: https://it.slashdot.org/story/16/07/08/145245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android KeyStore Encryption Scheme Broken
by Peter Reutemann 08 Jul '16

08 Jul '16

'The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say.>In an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integrity of keys and could be exploited to allow an attacker to modify stored keys through a forgery attack. KeyStore, which performs key-specific actions through the OpenSSL library, allows Android apps to store and generate their own cryptographic keys. By storing keys in a container, KeyStore makes it more difficult to remove them from the device. Mohamed Sabt and Jacques Traore, two researchers with the French telecom Orange Labs, claim the scheme associated with the system is "non-provably secure," and could have "severe consequences." The two point out in their paper "Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore," that it's the hash-then-encrypt (HtE) authenticated encryption (AE) scheme in cipher block chaining mode (CBC) in KeyStore that fails to guarantee the integrity of keys.' -- source: https://tech.slashdot.org/story/16/07/07/1819233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 million Android phones infected by all-powerful auto-rooting apps
by Peter Reutemann 07 Jul '16

07 Jul '16

"Security experts have documented a disturbing spike in a particularly virulent family of Android malware, with more than 10 million handsets infected and more than 286,000 of them in the US. Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android. The Check Point researchers have dubbed the malware family "HummingBad," but researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices." -- source: http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of systemd In Debian
by Lawrence D'Oliveiro 07 Jul '16

07 Jul '16

Presentation from DebConf, slides and video <http://phoronix.com/scan.php?page=news_item&px=Debian-systemd-Status-2016>.

1 1

Yet Another Next-Generation Filesystem
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

As if btrfs and ZFS aren’t enough, here’s another next-generation filesystem being developed for Linux: <http://phoronix.com/scan.php?page=news_item&px=Bcachefs-Still-Rolling>. It apparently originated from “Bcache”, which was a filesystem developed for use on SSDs.

1 0

32 bit
by Ian Young 06 Jul '16

06 Jul '16

See also Linux Mint 18 in 32-bit version, and Bodhi complete with Enlightenment. NOW WHAT ABOUT TRIMMING THOSE POSTS!!! OTHERWISE I MAY BE FORCED TO DIG OUT SOME ARCHAIC INTERNET ETIQUETTE FAQ AND POST IT IN FULL ALL IN CAPS. Just joshing people. But puhleeze???! A word for Michelle and the quest for perfection. Sometimes in this life there is a dichotomy between what we wish for and what we can actually accomplish. Maybe near enough is good enough. Is there actually such a thing as complete security on the internet? Possibly, but probably not for the average citizen. "You have zero privacy anyway. Get over it." Scott McNealy, formerly of Sun Microsystems. Sad but probably true.

8 14

puppy or qubes
by Michelle 06 Jul '16

06 Jul '16

Well, I give up. I have tried for months and invested dozens of hours to get a machine that runs qubes and it hasn't happened. So would somebody be willing to go into say pb tech with different live puppy's on stick (or DVD) and finding what computers run it. Puppy was the distro I was wanting to run on my brand new computer I bought last year. I have been told that it is hard to find a new computer that won't rtun puppy. My new computer didn't. Hopefully it is just a freak. So if you are prepared to do that, could you then let me know at least two of those computers that should be able to run qubes according to the hardware specifications at the qubes website. If nobody is prepared to do that it is more than fine. I will just buy a computer that runs a windows legacy os.

5 11

post trimming
by Ian Young 06 Jul '16

06 Jul '16

Oh dear, it's a storm of my making, albeit in a teacup. Much of the time posts on wlug are brief and often evoke no responses. As it happens of late there have been some of greater length which have had replies including the full body of all the foregoing, This has lead to my occasional ire as I scroll on ever downwards through the screeds of text previously seen looking for some gem of wisdom only to finally find the dreaded "Me too" or something equally unmemorable. Call me a grinchy grouch but is this sort of thing effective communication? Lies back on the couch .... Let me tell you about my days on dialup when every word cost 10 cents ... have i mentioned my Scottish ancestry? OMG, apologies to all Scots. If you can't say anything nice then say nothing as my old dad (from Glasgow) was wont to say. ~ ttfn Ian Y

1 0

Why Dotfiles Need To Die
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

“Hidden” files and directories are outnumbering non-hidden ones 6:1 in my home directory: ldo(a)theon:~> ls -A ~/ | grep -c '^\.' 215 ldo(a)theon:~> ls -A ~/ | grep -vc '^\.' 35 ldo(a)theon:~> ls -A ~/ | wc -l 250 Quite a few applications are starting to adopt the XDG Base Directory Spec <https://specifications.freedesktop.org/basedir-spec/latest/>, but it just can’t happen fast enough...

1 0

Any Old Machines Going Spare?
by Lawrence D'Oliveiro 06 Jul '16

06 Jul '16

Te Whare O Te Ata (the Fairfield community centre) has a group of four public-access machines that are not getting any younger. Does anybody have any machines they don’t need any more, that they could donate as (slightly) newer replacements? I think all of us who volunteer there are on this list, so I think you might as well respond to the list, at least to begin with. Then we can take it from there. Thanks for any help.

3 3

Linux Mint 18 “Sarah” released!
by Peter Reutemann 05 Jul '16

05 Jul '16

Already happened on June 30th, but here it is anyway... Announcement for MATE: http://blog.linuxmint.com/?p=3052 And for Cinnamon: http://blog.linuxmint.com/?p=3051 Just installed MATE version, replacing my Ubuntu MATE edition. Gone is my disappearing mouse cursor when suspending, feels much snappier, better touchpad support too. At least 2 thumbs up! ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

32 bits
by Ian Young 05 Jul '16

05 Jul '16

Arch and Manjaro have 32 bit options. Slackware 14.2 just released is available for 32 bit. Porteus has a fresh release pending for 32. The recent Fedora 24 has 32 bit iso. So it's not over yet. One snag however is hardware limitations on 32 bit machines. It may be possible to run a current browser on less than 2 gigs of RAM but I find it is not enjoyable. So it partly depends on what one wants to do iwth that golden oldie.

1 0

Fwd: [NZOSS OpenChat] GovHack
by Peter Reutemann 04 Jul '16

04 Jul '16

Apologies for cross-posting, but some people on this mailing list might be interested in this. Cheers, Peter ---------- Forwarded message ---------- From: DL Neil <NZOSS(a)etelligence.info> Date: Tue, Jul 5, 2016 at 7:03 AM Subject: [NZOSS OpenChat] GovHack To: NZOSS Open Discussion List <openchat(a)groups.nzoss.org.nz> Noticed this public invitation of likely interest to mash-up artists and OpenData enthusiasts: GovHack is all about bringing together coders, artists, storytellers, observers, communicators and more, from the private, public, NGO and academic sectors. While the group of people is diverse, we’re united in a single purpose – working with government data to innovate and create. What is GovHack, anyway? It’s not about “cracking” government – it’s about bringing together the power of open data and all of us to build a better democracy and a more open government and society. Watch this short video to find out more :) This year, New Zealand’s second (ever) GovHack event will be taking place across the country over the weekend of 29 – 31 July, in: Whangarei Auckland Hamilton Hawke’s Bay Whanganui Wellington Christchurch Queenstown Dunedin. ... http://govhack.org.nz/ -- Regards, =dn ―― View topic http://groups.nzoss.org.nz/r/topic/1mbHiTI4H5e8TQrmYTPFL4 Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 18 'Sarah' Released, Supports Generic GTK X-Apps
by Peter Reutemann 03 Jul '16

03 Jul '16

'The Linux Mint team announced the immediate availability of their latest release, Mint 18 "Sarah," in Cinnamon and MATE flavors. These follow on the heels of their respective beta versions, which have been out for nearly a month. "Linux Mint 18 is a long-term support release which will be supported until 2021," the team announces on MATE's "new features" page, adding they've improved their update manager, included support for the Debian syntax of "apt", and are working on the "X-Apps" project to "produce generic applications for traditional GTK desktop environments...to replace applications which no longer integrate properly outside of a particular environment."' -- source: https://linux.slashdot.org/story/16/07/02/2045249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Council CIO - suit required
by Ian Young 29 Jun '16

29 Jun '16

I fear no ordinary mortal could hope for a job such as this -- only for people from suitland who can spout the appropriate babble and appear to have a suitable track record in positions of such awesomeness. This is the world of the 'solutions provider' and they always provide a Windows solution. After all, why not go with what you know? And then there is the investment by many IT people in gaining industry qualifications around aspects of Microsoft technology. It would be sad to see that go to waste. It's a mindset thing. And let's not forget that for most people (aside from a minority of Appleheads) Windows is computers, or Windows is always on such computers as they use. Then there are the computer makers who still provide the industry standard, ie Windows. (Behind the scenes MS is still twisting arms there as far as I know). Perhaps this being broken down somewhat in recent times by the advent of tablets & smartphones but I think in large part real work is still done on a Windows box. Hard to see how this can ever change without some as yet unforeseen paradigm shift. So much for the business world and governmental organisations; things are perhaps a bit different in academia especially in fields such as computer science. However the desktop for most users is still always Windows so far as I have seen. Those crazy academics have to be given some choice but IT staff generally prefer to provide a standardised Windows image. Yes, it's a Windows world. Luckily Linux is still around for those who can't get with the programme. Personally I find the latest versions of desktop Windows unusable. If Windows 8 and 10 are the answer it must have been a most peculiar question imho. But I digress. Should HCC ever adopt Linux I will eat my hat - or be astounded at any rate.

2 1

A ZFS developer’s analysis of the good and bad in Apple’s new APFS file system
by Peter Reutemann 28 Jun '16

28 Jun '16

"Adam Leventhal: Apple announced a new file system that will make its way into all of its OS variants (macOS, tvOS, iOS, watchOS) in the coming years. Media coverage to this point has been mostly breathless elongations of Apple's developer documentation. With a dearth of detail I decided to attend the presentation and Q&A with the APFS team at WWDC. Dominic Giampaolo and Eric Tamura, two members of the APFS team, gave an overview to a packed room; along with other members of the team, they patiently answered questions later in the day. With those data points and some first-hand usage I wanted to provide an overview and analysis both as a user of Apple-ecosystem products and as a long-time operating system and file system developer." -- source: http://arstechnica.com/apple/2016/06/a-zfs-developers-analysis-of-the-good-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

Re: [wlug] Hamilton City Council - CIO position
by rowan schischka 28 Jun '16

28 Jun '16

>You can apply for the position via the council web-site<http://%20 https://hamilton.careercentre.net.nz/job/chief-information-officer-cio-/ham…>. It is also advertised on seek< http://www.seek.co.nz/job/31234386?pos=12&type=standard&engineConfig=&userq… >. Im applying but doubt ill get it. whoever gets that contract i'd like to put my hand forward to help. -- Kind Regards Rowan Schischka

1 0

Re: [wlug] wlug Digest, Vol 300, Issue 19
by Wayne Luxton 27 Jun '16

27 Jun '16

On 25/06/16 12:00, wlug-request(a)list.waikato.ac.nz wrote: > Send wlug mailing list submissions to > wlug(a)list.waikato.ac.nz > > To subscribe or unsubscribe via the World Wide Web, visit > https://list.waikato.ac.nz/mailman/listinfo/wlug > or, via email, send a message with subject or body 'help' to > wlug-request(a)list.waikato.ac.nz > > You can reach the person managing the list at > wlug-owner(a)list.waikato.ac.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of wlug digest..." > > > Today's Topics: > > 1. a Debian-based OS for Nexus 5 phone (Ian Young) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Jun 2016 03:12:45 +0000 > From: Ian Young <gnomician(a)gmail.com> > To: wlug <wlug(a)list.waikato.ac.nz> > Subject: [wlug] a Debian-based OS for Nexus 5 phone > Message-ID: > <CA+e9D2Ev-OSuWxA98heFdjbERzTJYgZbiFRAuiepOVS9FURZNw(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Came upon this today - mentioned on Barry Kauler's blog (the Puppy Linux guy). > > ' have previously posted about MaruOS:" > http://barryk.org/news/?viewDetailed=00363 > > > http://maruos.com/#/ > > > ------------------------------ > > _______________________________________________ > wlug mailing list > wlug(a)list.waikato.ac.nz > https://list.waikato.ac.nz/mailman/listinfo/wlug > > > End of wlug Digest, Vol 300, Issue 19 > ************************************* > Find this is brilliant news as have nexus 5 and was getting frustrated and scratchy about android and what they keep wanting or advertising. Something to do to keep my Parkinson's brain in action. Would like to compare notes with any other local enthusiast -looking to create an intergrated work system with production of posters. Wayne - thanks you guys I am not very active now days but keeping up with threads helps me check out what I need and widen potential

1 0

Ubuntu-Based Peppermint 7 Released
by Peter Reutemann 26 Jun '16

26 Jun '16

'Softpedia reports on the newest version of Peppermint OS, "a lightweight, stable, elegant, and fast computer operating system based on GNU/Linux and Open Source technologies." An anonymous Slashdot reader quotes their report: It's a bit earlier than expected, but the Peppermint OS 7 GNU/Linux distribution has been officially unveiled...based on the Ubuntu 16.04 LTS (Xenial Xerus) operating system [with] a lot of packages from the Ubuntu 16.04 LTS distro, which means that it will also be a long-term support release.... "Along with the shift to the 16.04 (Xenial) code base, Peppermint 7 continues our policy of choosing the best components from other desktop environments, wherever that may be, and integrating them into a cohesive whole with our own software," reads today's announcement. "Team Peppermint" says they're switching to Firefox as their default browser for site-specific browser functionality (similar to Chrome's -app mode) after Google dropped their 32-bit version of Chrome and moved to PPAPI plugins "which effectively ends Flash support in 32-bit Chromium"... But you can also still choose Chrome or Chromium for site-specific browsing (and the OS comes in 32-bit and 64-bit editions).' -- source: https://news.slashdot.org/story/16/06/25/216216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

a Debian-based OS for Nexus 5 phone
by Ian Young 24 Jun '16

24 Jun '16

Came upon this today - mentioned on Barry Kauler's blog (the Puppy Linux guy). ' have previously posted about MaruOS:" http://barryk.org/news/?viewDetailed=00363 http://maruos.com/#/

1 0

KDE Developers Have Been Working On Improved Windows Support
by Lawrence D'Oliveiro 22 Jun '16

22 Jun '16

<http://phoronix.com/scan.php?page=news_item&px=KDE-Windows-Improvements>: “... they've abandoned the concept of having a single KDE installer for Windows, but work on individual programs (and installers) for Windows has continued. Single application installers are their path forward for shipping KDE programs on Windows...” Also in the reader comments, Krita lead Boudewijn Rempt writes about whether more Windows users leads to more Windows developers contributing <https://www.phoronix.com/forums/forum/software/desktop-linux/879128-kde-dev…>: “... I've certainly had half a dozen Windows developers come to the #krita irc channel asking how to build Krita on Windows so they could help out hacking. The problem is that setting up a build environment on WIndows is really hard, and in fact, we build the Windows binaries on Linux... So they need extraordinary perseverance to start contributing or use a Linux VM. That's really something we should improve on next, but I have no idea how to make it any eas[i]er anymore.”

1 0

WLUG meeting next Monday
by Peter Reutemann 22 Jun '16

22 Jun '16

Hi there We have a meeting next Monday: 'systemd', which has replaced SYSTEMV 'init' in nearly ALL current Linux distributions, seems to go against the fundamental philosophy of Linux/Unix - Doug Mcllroy, the inventor of Unix pipes, summarized the Unix/Linux philosophy as follows: "This is the Unix philosophy: Write programs that do one thing and do it well..." systemd has a 'finger-in-all-pies' approach & seems quite complex. Let's discuss pros and cons of systemd. http://www.meetup.com/WaikatoLinuxUsersGroup/events/231330392/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Linux’s RPM/deb split could be replaced by Flatpak vs. snap
by Peter Reutemann 21 Jun '16

21 Jun '16

'Linux developers are going to have more than one choice for building secure, cross-distribution applications. Ubuntu's "snap" applications recently went cross-platform, having been ported to other Linux distros including Debian, Arch, Fedora, and Gentoo. The goal is to simplify packaging of applications. Instead of building a deb package for Ubuntu and an RPM for Fedora, a developer could package the application as a snap and have it installed on just about any Linux distribution. But Linux is always about choice, and snap isn't the only contender to replace traditional packaging systems. Today, the developers of Flatpak (previously called xdg-app) announced general availability for several major Linux distributions, with a pointer to instructions for installing on Arch, Debian, Fedora, Mageia, and Ubuntu.' -- source: http://arstechnica.com/information-technology/2016/06/here-comes-flatpak-a-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft: Nearly One In Three Azure Virtual Machines Now Are Running Linux
by Peter Reutemann 21 Jun '16

21 Jun '16

"Microsoft's self-professed Linux love is helping the company in the cloud. During his keynote at DockerCon 2016 in Seattle today, Azure Chief Technology Officer Mark Russinovich showed off some of the new and upcoming ways Microsoft is adding more container support to its cloud and server products. He also revealed a couple of new interesting datapoints. In the past year, Russinovich said, Microsoft has gone from one in four of its Azure virtual machines running Linux to nearly one in three. The other two-thirds of Azure customers are running Windows Server in their virtual machines. Russinovich showed off the promised Windows Server support that officials said would be coming at some point to the company's Azure Container Service (ACS). Microsoft made Azure Container Service generally available in April 2016, but for Linux containers only. Last year, company execs said Microsoft also would bring Windows Server support to ACS." -- source: https://linux.slashdot.org/story/16/06/21/1754243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New World’s Fastest: 10-Million Core Supercomputer
by Lawrence D'Oliveiro 21 Jun '16

21 Jun '16

<http://arstechnica.com/information-technology/2016/06/10-million-core-super…> Not Intel-compatible, uses a home-grown 64-bit RISC chip architecture. According to this <http://www.nextplatform.com/2016/06/20/look-inside-chinas-chart-topping-new…>, it achieves 3 times the power efficiency of the x86 machines near the current top of the supercomputing league. According to the Ars article, the previous supercomputer king of the hill, “Tianhe-2 had been the world's fastest in six consecutive rankings, which are released twice a year”. So I think the record for staying the longest at the top still remains with the old NEC Earth Simulator, which was number one for maybe two years.

1 1

Unprotected NFC Tags in MacDonald’s NZ & Australia Restaurants
by Lawrence D'Oliveiro 20 Jun '16

20 Jun '16

Anybody could store any URL into these tags. Would customers who see these pop up on their phones think it was a legitimate MacDonald’s promotion and go to those sites? <http://www.theregister.co.uk/2016/06/20/filetophish_insecure_nfc_tag_relics…>

1 0

New 'Hardened' Tor Browser Protects Users From FBI Hacking
by Peter Reutemann 20 Jun '16

20 Jun '16

'According to a new paper, security researchers are now working closely with the Tor Project to create a "hardened" version of the Tor Browser, implementing new anti-hacking techniques which could dramatically improve the anonymity of users and further frustrate the efforts of law enforcement... "Our solution significantly improves security over standard address space layout randomization (ASLR) techniques currently used by Firefox and other mainstream browsers," the researchers write in their paper, whose findings will be presented in July at the Privacy Enhancing Technologies Symposium in Darmstadt, Germany. The researchers say Tor is currently field-testing their solution for an upcoming "hardened" release, making it harder for agencies like the FBI to crack the browser's security, according to Motherboard. "[W]hile that defensive advantage may not last for too long, it shows that some in the academic research community are still intent on patching the holes that their peers are helping government hackers exploit."' -- source: https://yro.slashdot.org/story/16/06/19/2249239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Under new management, SourceForge moves to put badness in past
by Peter Reutemann 19 Jun '16

19 Jun '16

"It has been six months since the company formerly known as Dice (DHI Group) sold off Slashdot Media—the business unit that runs Slashdot and SourceForge—to BIZX, LLC, a San Diego-based digital media company. Since then, the new management has been moving to erase some of the mistakes made under the previous regime—mistakes that led to the site becoming a bit of a pariah among open source and free software developers." -- source: http://arstechnica.com/information-technology/2016/06/under-new-management-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora QA Lead Pans Canonical 'Propaganda' On Snap Apps
by Peter Reutemann 18 Jun '16

18 Jun '16

'...and how it's going to unite all distributions and kill apt and rpm! This is, to put it diplomatically, a heaping pile of steaming bullshit... The press release and the stories together give you the strong impression that this thing called Snappy is going to be the cross-distribution future of application delivery, and it's all ready for use today and lots of major distributions are buying into it... The stories have headlines like "Adios apt and yum? Ubuntu's snap apps are coming to distros everywhere" and "Snap Packages Become Universal Binary Format for All GNU/Linux Distributions"... Now, does Snappy actually have the cross-distribution buy-in that the press release claims (but never outright states) that it has? No... The sum total of communication between Canonical and Fedora before the release of this press release was that they mailed us asking about the process of packaging snappy for Fedora, and we told them about the main packaging process and COPR. They certainly did not in any way inform Fedora that they were going to send out a press release strongly implying that Fedora, along with every other distro in the world, was now a happy traveler on the Snappy bandwagon... They just decided to send out a wildly misleading press release and actively encourage the specialist press to report that Snappy was all set to take over the world and everyone was super happy with that.' -- source: https://linux.slashdot.org/story/16/06/18/1550249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Biggest Maker of Raspberry Pis Has Been Acquired For $871 Million
by Peter Reutemann 14 Jun '16

14 Jun '16

'The biggest manufacturer of the Raspberry Pi minicomputer, Premier Farnell, has been acquired by Swiss industrial component supplier Daetwyler Holding AG for roughly $871 million. According to Bloomberg, the deal will reportedly help both companies compete better in the components market. "By combining forces, we significantly increase our competitiveness and extend our product range," Daetwyler Chairman Ulrich said in a statement, "facilitating a one-stop shopping experience for our wide range of customers from a multitude of industries." Premier Farnell is one of the only companies with a license to design and distribute Raspberry Pis. The Wall Street Journal says the Raspberry Pi devices are a big part of the company's business, as the division in charge of the Pi raked in 16 percent of the company's total revenue last year.' -- source: https://news.slashdot.org/story/16/06/14/2044241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adios apt and yum? Ubuntu’s snap apps are coming to distros everywhere
by Peter Reutemann 14 Jun '16

14 Jun '16

'Ubuntu's "snappy" new way of packaging applications is no longer exclusive to Ubuntu. Canonical today is announcing that snapd, the tool that allows snap packages to be installed on Ubuntu, has been ported to other Linux distributions including Debian, Arch, Fedora, and Gentoo, among others.' -- source: http://arstechnica.com/information-technology/2016/06/goodbye-apt-and-yum-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Email Addresses Accidentally Disclosed By Let's Encrypt Anonymous
by Peter Reutemann 12 Jun '16

12 Jun '16

'"Let's Encrypt, the certificate authority best known for offering free SSL/TLS certificates, has reported that it accidentally disclosed thousands of user email addresses due to a bug with an automated emailing system." Executive Director Josh Aas posted this announcement: On June 11 2016 (UTC), we started sending an email to all active subscribers who provided an email address, informing them of an update to our subscriber agreement. This was done via an automated system which contained a bug that mistakenly prepended between 0 and 7,618 other email addresses to the body of the email... The problem was noticed and the system was stopped after 7,618 out of approximately 383,000 emails (1.9%) were sent. Each email mistakenly contained the email addresses from the emails sent prior to it, so earlier emails contained fewer addresses than later ones. We take our relationship with our users very seriously and apologize for the error... If you received one of these emails we ask that you not post lists of email addresses publicly.' -- source: http://m.slashdot.org/story/312355 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

1 0

Trimming etc continued
by Michelle 11 Jun '16

11 Jun '16

I am posting this here under a new heading because it's late and I can't seem to figure out how to send a reply to the mailing list without also sending it to the person who posted it. Or is that what is supposed to happen? Eric, thanks for reposting that for me and for your continued input. Wolf, I appreciate all that info. You've both sent me so much information I'm gonna take a little while to look at it. Paul, apology accepted, it's hard to know on the internet sometimes what's meant. Michelle

2 2

Attention: HAL 9000 Owners
by Lawrence D'Oliveiro 11 Jun '16

11 Jun '16

We have just received word of an important new book: *Programming Instructions for the HAL 9000 Computer*, revised edition. The new edition of the HAL 9000 handbook has been updated to incorporate improvements suggested by this versatile machine’s surviving users. In particular, the manufacturers suggest that priority be given to the retrofitting of small explosive charges at strategic points in the central memory unit. Authorized by Arthur C Clarke Chief Semantic Controls Engineer Colombo SRI LANKA (Found in the December 1978 issue of BYTE Magazine, downloaded from archive.org.)

1 0

Firefox Finally Confirms 'Largest Change Ever' Featuring Electrolysis In v48
by Peter Reutemann 09 Jun '16

09 Jun '16

'With Electrolysis, Firefox can use child processes for content (tabs), media playback and legacy plug-ins. This is some way short of Google Chrome, which uses a different process for each tab. However, the result is that Chrome is a huge resource hog: Chrome uses roughly twice as much memory as Firefox on Windows and Linux. Eric Rahm has run some browser tests with Electrolysis, and says: "Overall we see a 10-20 percent increase in memory usage for the 1 content process case (which is what we plan on shipping initially). This seems like a fair trade-off for potential security and performance benefits." With 8 content processes, Rahm says: "we see roughly a doubling of memory usage on the TabsOpenSettled measurement. It's a bit worse on Windows, a bit better on OS X, but it's not 8 times worse."' -- source: https://news.slashdot.org/story/16/06/08/1635231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

The Web's Creator Thinks We Need a New One That Governments Can't Control
by Peter Reutemann 09 Jun '16

09 Jun '16

'The web has created millions of jobs, impacted nearly every industry, connected people, and arguably made the world a better place. But the person who started it all isn't exactly pleased with the way things have turned out to be. Sir Tim Berners-Lee, who invented the World Wide Web, believes that the way it works in the present day "completely undermines the spirit of helping people create." The Next Web reports: "Edward Snowden showed we've inadvertently built the world's largest surveillance network with the web," said Brewster Kahle, who heads up Internet Archive. And he's not wrong: governments across the globe keep an eye on what their citizens are accessing online and some censor content on the Web in an effort to control what they think. To that end, Berners-Lee, Kahle and other pioneers of the modern Web are brainstorming ideas for a new kind of information network that can't be controlled by governments or powered by megacorporations like Amazon and Google.' -- source: https://tech.slashdot.org/story/16/06/08/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Re: [wlug] TRIMMING POSTS -- PLEASE ???!!!
by Eric Light 07 Jun '16

07 Jun '16

(Michelle you sent this to me directly, but I believe you intended to send it to the whole mailing list, so I'll include that here. I've left the history included, in spite of Ian's entreaties otherwise, for the benefit of those who want to see what I'm replying to) Ah, I understand a bit better now. By and large, Linux is relatively untouched by garden variety malware. However, your browser (cross-platform, JavaScripty, etc) can still fall prey to security issues, which sounds the case here. I note you said you were running NoScript, so it comes as a surprise, but I suppose they're always thinking up new avenues. That said, I don't think the Oprah thing is related to your missing files! I can't say what happened, but its vanishingly unlikely that a browser hijack could have deleted files on a LINUX system... On Windows, sure, but to perform that action on a Linux pc, the malware would need to be designed FOR Linux - and that's particularly unlikely. Okay so we've established that you want privacy, but overall you want a system where you can easily recover from corruption... Is that correct? I'm sticking with my recommendation for Debian - probably Linux Mint Debian Edition, because it's:- got a solid base (Debian) - got a wide user base (thus lots of testing) - got a lovely UI (Cinnamon) - specifically designed to be easy to use On top of this, you can install Sophos Antivirus for Linux... It's free, and it has some of the highest detection rates in the industry (note, solving a problem that barely even exists in a Linux environment, but which you may have encountered nonetheless). Since your threat profile sounds like browser-based malware, it might be worth looking into specifically sandboxing your browser. I know Chrome already does sandboxing between tabs and threads, so that might already be in place, but it sounds plausible. Alternatively, putting your /home partition on a filesystem that supports snapshots might be a good idea... Maybe ZFS? That sounds like a good solution to me, but I'll have to defer to the wizards in the group. ☺ Good luck!Eric -- Securely sent with Tutanota. It's good, you should try it: https://tutanota.com 7. Jun 2016 20:08 by michelle400(a)orcon.net.nz: > > Woops. Sorry. I used the wrong term, I used BUG when I should have used > MALWARE. Biological viruses are bugs and so instead of the term malware, > I've used bug for viruses, trojans etc.....So in other words I think I > caught some malware on my Toshiba despite those safety measures. And I > think the safest thing for a non computer expert like myself to do to keep > it from happening again is to install the safest and secure distros that > I've heard of. (I'm now not sure whether that person I mentioned was > talking about bug(s) or malware). > > William, thanks for looking out for me back there. > > Eric, thank you for going out of your way to make me feel better. You're a > clss act. I couldn't figure out why you were recommending a very stable > distro, and then I got it - I used the wrong term. Thanks again for your > input. > > > > On 2016-06-07 16:25, Eric Light wrote: >> Hi Michelle, >> >> I'm sorry that you feel you've been maligned and attacked. We do try >> hard to make this a safe forum for everyone. For what it's worth, most >> of us here ARE a bit batty, each in our own way. >> >> Security and safety, along with reliability and usability, are also >> the reasons I use Linux. You're in good company there. >> >> I feel that Whonix+Qubes is over-engineering. I haven't had any >> responses to my email last night re TAILS+grsecurity (ALSO >> over-engineering), but TAILS' lack of persistence makes it a drag for >> day-to-day use; Whonix sacrifices some security for usability there. >> >> What problem are you trying to solve? What is your threat profile that >> you're trying to defend yourself against? If you're just trying to >> avoid bugs in your distro, you could just go with Debian Stable, which >> will give you a reliable, secure, and well-known system, with very few >> "tricky bits". >> >> E >> >> -- >> Securely sent with Tutanota. It's good, you should try it: >> https://tutanota.com>> [1] >> >> 7. Jun 2016 15:43 by >> michelle400(a)orcon.net.nz>> : >> >>> Well when I looked at the mailing list page today I was totally >>> shocked to find I'd been maligned and attacked. I know that that >>> happens on other forums (yes I realize this is a mailing list) but I >>> didn't think it would happen here. I guess that I just got schooled. >>> >>> Perhaps I should say a few things. The only reason for me choosing >>> Linux over windows is security and safety. It may be different for >>> computer experts, but that's it for me. >>> >>> So anyway I have Mint on my Toshiba and some months back I clicked >>> to a page with info on Oprah Winfrey. The site then clicked on and >>> off and on and off etc. I closed the page and opened history. Here >>> the site was listed maybe 25 to 50 times. Then say that day or the >>> next, my most used folder disappeared from it's space. I found it in >>> the thrash. And that happened with maybe another couple of folders. >>> Someone said that Mint had had problems with a bug/bugs this >>> year/last year? >>> >>> So anyway I presume that I caught a bug and that it's still there. >>> (Don't worry,the emails I send on this phone and not the Toshiba). >>> This happened inspite of the fact that I use Mozilla, adblock and >>> NoScript, although they may not have been up to date. Computer >>> experts, if their machine gets infected may be able to debug it and >>> be confident that it's clear, but I can't. I figure the best way to >>> protect myself from now on is to have the safest set up from the >>> start. And from a bit of research I did on the net it appears that >>> that maybe Whonix and Qubes. >>> >>> On 2016-06-07 06:53, Paul Wilson wrote:I would be trending to a tent >>> inside a faraday cage, at least 50kms >>> from the nearest populated town. :p >>> >>> Sent from my iPhone >>> >>> On 6/06/2016, at 11:41 PM, Eric Light <>>> eric(a)ericlight.com>>> > wrote: >>> YES I FIND THIS MUCH LESS ANNOYING, THANKS WILLIAM �� >>> >>> Battiness aside, I suspect the answer to Michelle's problem isn't >>> Whonix on Qubes on an old laptop. It sounds like excessive >>> engineering for no good reason. Did anyone else have similar >>> thoughts? >>> >>> If I were going full-on paranoia mode, I'd be running TAILS, >>> probably with a grsecurity-patched kernel, and probably through an >>> offshore VPN. What do you guys think? >>> >>> E >>> >>> -- >>> Securely sent with Tutanota. It's good, you should try it: >>> https://tutanota.com>>> [1] [2] >>> >>> 6. Jun 2016 23:32 by >>> will(a)artcontrol.me>>> : >>> IS THIS BETTER? >>> _______________________________________________ >>> wlug mailing list | >>> wlug(a)list.waikato.ac.nz >>> Unsubscribe: >>> https://list.waikato.ac.nz/mailman/listinfo/wlug>>> [2] >>> [1] >>> _______________________________________________ >>> wlug mailing list | >>> wlug(a)list.waikato.ac.nz >>> Unsubscribe: >>> https://list.waikato.ac.nz/mailman/listinfo/wlug>>> [2] >>> [1] >> >> Links: >> ------ >> [1] >> https://list.waikato.ac.nz/mailman/listinfo/wlug>> [2] >> [2] >> https://tutanota.com>> [1] >> >> _______________________________________________ >> wlug mailing list | >> wlug(a)list.waikato.ac.nz >> Unsubscribe: >> https://list.waikato.ac.nz/mailman/listinfo/wlug>> [2] >> _______________________________________________ >> wlug mailing list | >> wlug(a)list.waikato.ac.nz >> Unsubscribe: >> https://list.waikato.ac.nz/mailman/listinfo/wlug>> [2] >> >> Links: >> ------ >> [1] >> https://tutanota.com >> [2] >> https://list.waikato.ac.nz/mailman/listinfo/wlug

1 0

TRIMMING POSTS -- PLEASE ???!!!
by Ian Young 07 Jun '16

07 Jun '16

The saga of 'Michelle' (iirc) and her Linux problems is no doubt fascinating but could we possibly stop wasting bandwidth by broadcasting the entire sorry saga time and time again ... just asking. Aside from any other considerations it makes it difficult to determine whether there is any new data on the case. Far be it from me to speculate on whether the poster is just a wee bit batty .....

7 7

I can pay 150 if somone is willing to help me out with setting up a computer
by Michelle 05 Jun '16

05 Jun '16

Hi, My name's Michelle. I've been using Linux on and off for the last few years. I'm looking for someone who would help me set up a computer with linux on it. I rang round all? or most the PB tech stores, they didn't have anyone who was up to the task. I rang a store where a guy was into Linux but they're too busy. I sent an email to a guy involved with one of the distros I want but even though it's on the web to contact him to pay for help he hasn't got back to me. A man kindly pointed out to me two computers from PB tech that he says will work but as you can see from the post I've had some trouble with computers not working or not working properly and I want to pay some money for someone to try the distros and experience that it works on a computer for sure. I had a Dell on which I set up Puppy with no problem whatsoever. The computer died and so then I took the puppy distro and the other disto I'd bought (can't remember what) and tried to install them on 2 older computers I had but it didn't work. I don't know why, maybe it was because one of the distros was on a USB drive and not compatible or maybe both computer hard drives were stuffed? After that I bought a mini-pc (I think it was supposed to run linux) but it didn't work at all. Then I bought a tablet but after a month or two it stopped working or pretty much? Stopped working. So I just used a phone for about a year and last year bought a brand new Toshiba laptop. The problem with this was two fold: 1. It was a laptop. 2. It was a Toshiba (oh how I hate Toshiba) I had known that not all computers were readily compatible with linux but after my easy experience with the Dell I wasn't too concerned. I bought two linux distros on different media and hoped/assumed? that something would work – it didn't. I bought another say 2 or 3 distros and managed to get the Mint to install on this Toshiba. It wasn't until after this annoying endeavor that I found out online that: -⁠ laptops are less compatible than desktops with linux and that - Toshiba out of the maybe top 6 or 8 computer manufacturers is consistantly about the least compatible with linux ( I HATE TOSHIBA) I don't happen to have a few spear thousand dollars sitting around to enable me to buy a computer and try and set it up with the distros I want, find it dosen't work, buy another computer, find it doesn't work, buy another and finally find one that works with the distros I want. So I am sending this message and hoping someone can help me set up a computer with the two linux distros I want. I don't know how that would work. Maybe someone is about to buy a new computer and can try these distros before they put theirs on, maybe someone has a partition on their computer that is spare and can try it there, maybe they own a computer shop or work in a computer shop or at a university or polytech with computers or computer parts around. So for anyone who may be willing to help me here is what I would like: - I'm up for paying up to 700 but would prefer to just pay say 400 or 500. - a desktop (not the modern ones that are a computer plus other thing/s but just a computer -⁠ not a toshiba -⁠ Whonix to run on top of Qubes. Whonix is great for anonimity and Qubes is designed for security/⁠safety. - I have a DrayTek vigor 120 modem. I connect it via DSL. When looking into whonix I read that it is complex to configure and setup, so I was hoping that you might have such a modem or access to one and set it up with whonix and then tell me how you did it. - I don't want the computer to come with wifi or bluetooth or any similar thing. I don't want it just not running, I don't want it there at all. - I'm wanting to install 3 old encyclopedias. I was reading about the new versions online and people were recommending old ones. I've bought Encarta 2004, 2001 and Encyclopaedia Britannica '98. To run them on I've bought Windows 98 second edition and Windows NT (first edition?). If you have or could borrow these windows OS could you see if you could get them running in whonix or qubes? - One or both of the encyclopedias need 2 DVD players so I'd like at least 2 DVD players with one being a recorder. - I'm not looking for a high end computer. As long as it will play youtube, that's fast enough. BUT I would appreciate hearing any recommendation about if I just add such and such for $100 or $150 it would go much faster. I'd like 500GB hard drive at least and I've been recommended to get 8GB RAM at least. I wouldn't buy the computer off you but rather if you could tell me what computer/computer parts worked, I'd pay up to $150 for the info. If 10 different people told me what worked of course I couldn't pay 10 different people $150. So to prevent two or more different people working on it at the same time, if you are willing to help me out could you please let me know and I could post a message just asking that no one else start working on it. It would be nice to have a choice of say two or three computers. So perhaps someone could say there is this computer or that one and I could ask you to try installing Whonix and Qubes on one of them. Or maybe there was a choice of two computers in parts and I could be told the parts of one computer and the other and I could choose the parts for one. It doesn't have to be brand new. As long as I can still buy it or the parts new it could be up to two years old. Thank you to anyone willing to help Michelle Gorringe.

3 4

Op-ed: Oracle attorney says Google’s court victory might kill the GPL
by Peter Reutemann 03 Jun '16

03 Jun '16

"The developer community may be celebrating today what it perceives as a victory in Oracle v. Google. Google won a verdict that an unauthorized, commercial, competitive, harmful use of software in billions of products is fair use. No copyright expert would have ever predicted such a use would be considered fair. Before celebrating, developers should take a closer look. Not only will creators everywhere suffer from this decision if it remains intact, but the free software movement itself now faces substantial jeopardy." -- source: http://arstechnica.com/tech-policy/2016/05/op-ed-oracle-attorney-says-googl… Interesting article, I have to say. The verdict might throw a spanner in what is considered "derivative work" in terms of GPL code. Companies using GPL libraries will no longer have to open-source their code, as it is simple considered fair use? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 8

Linux Kernel 4.6.1 Released; Some Users Report Boot Issue
by Peter Reutemann 02 Jun '16

02 Jun '16

'Linux kernel 4.6.1 is already here, only two weeks after the official launch of the Linux 4.6 kernel series. For those not in the loop, Linux 4.6 branch is the latest and most advanced kernel branch available right now for GNU/Linux operating systems, but it looks like its adoption is a little slow at the moment. "I'm announcing the release of the 4.6.1 kernel. All users of the 4.6 kernel series must upgrade," says Greg Kroah-Hartman. "The updated 4.6.y git tree can be browsed at the normal kernel.org git web browser."' 'Several folks on the web have reported a regression in the latest Linux kernels, starting with 4.6.1 and including the 4.7 beta that prevents booting and drops to busybox, at least the one supplied by the Ubuntu PPA. The boot sequence ends with "address family not supported by protocol: error getting socket" and then, "error initializing udev control socket" (screenshot here).' -- source: https://linux.slashdot.org/story/16/06/02/1717235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BBC Micro:Bit Learn-To-Code Device Up For Public Pre-Order In UK
by Peter Reutemann 02 Jun '16

02 Jun '16

'A tiny programmable board designed as part of an educational initiative for UK kids to learn programming skills and originally distributed by the public service broadcaster, the BBC, to one million schoolchildren is now up for public pre-order. The micro:bit is available for public pre-order in the UK, via Element14's website, with delivery slated for July. Although at this point it's being sold in minimum quantities of 90 for resellers (such as Microsoft) to then sell on to individuals. So consumers will have a bit longer to wait to be able to buy a device just for themselves. Prices start at 12.99 Pound ($19) for a single BBC micro:bit; 14.99 Pound for a starter kit which includes a BBC micro:bit, mini USB, battery pack and four project ideas; and 140 Pound for a 'BBC micro:bit Club' pack, which includes 10 devices and "everything needed to get a coding club started". The intention with the micro:bit project -- part of the BBC's wider 'Make it Digital' initiative to inspire "a new generation to get creative with coding, programming and digital technology" -- was always to open up the distribution of the device after the initial giveaway.' -- source: https://hardware.slashdot.org/story/16/06/01/1548252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tor Browser 6.0: Ditches SHA-1 Support, Uses DuckDuckGo For Default Search Results
by Peter Reutemann 01 Jun '16

01 Jun '16

"The version 6.0 of Tor Browser, a free software for enabling anonymous communication, is now available to download. The new version introduces several changes, including disabling SHA-1 support, and removing Mac Gatekeeper issue. Another big change is that Tor now uses DuckDuckGo for search results by default. The Tor Project, people behind Tor, add that the "updater is not relying on the signature alone, but is checking the hash of the downloaded update file as well before applying it." More details on NetworkWorld." -- source: https://tech.slashdot.org/story/16/05/31/1643234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Issue with systemd
by Ian Young 30 May '16

30 May '16

>From this week's Distrowatch. Could be a problem in some circumstances. The systemd project tends to stir up debate with each new feature it implements. One of the most recent changes to systemd (available in version 230), forces user processes to terminate when the user logs out. On some systems, such behaviour makes sense and effectively cleans up misbehaving processes when the user leaves. However, many administrators and developers rely on processes continuing to run to perform tests, backups or other tasks after they log off. Guus Sliepen summed up the concerns of the latter group quite nicely in a Debian bug report: It is now indeed the case that any background processes that were still running are killed automatically when the user logs out of a session, whether it was a desktop session, a VT session, or when you SSHed into a machine. Now you can no longer expect a long running background processes to continue after logging out. I believe this breaks the expectations of many users. For example, you can no longer start a screen or tmux session, log out, and expect to come back to it. For this reason, I think it is a bad decision on the part of the systemd maintainers to enable this feature by default, and it should rather be disabled by default in Debian." A similar discussion is taking place on a Fedora mailing list. The new default systemd behaviour can be disabled (either by distributions or system administrators) by editing the logind configuration file.

4 3

Re: [wlug] Issue with systemd
by Andrew Crosby 30 May '16

30 May '16

To my mind, this seems like a useful feature. Odd choice to have it turned on by default though given the historic convention. Cheers Andrew On 30 May 2016 22:47, "Michael Cree" <mcree(a)orcon.net.nz> wrote: On Mon, May 30, 2016 at 10:22:13AM +0000, Ian Young wrote: > It is now indeed the case that any background processes > that were still running are killed automatically when the user logs > out of a session, whether it was a desktop session, a VT session, or > when you SSHed into a machine. Now you can no longer expect a long > running background processes to continue after logging out. I believe > this breaks the expectations of many users. Yes, it breaks the well established practice that the controlling terminal sends all its child processes a HUP signal on logout, and that the default signal handler will kill such processes, and if the process wants to remain running it therefore establishes a signal handler to properly receive and handle the HUP signal so that it is not terminated. If processes are not being terminated on logout when they should be, then it is the non-terminating processes fault as the process has taken action to set up a non-default signal hangler to receive the HUP signal to achieve this effect. It is most certainly not the responsibility of systemd to kill processes on logout! With these critical and non-sensical changes to system behaviour that is well without the established remit of the init process the systemd developers are fast losing what little respect I might have had for them. Cheers Michael. _______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

1 0

Apropos...
by Lawrence D'Oliveiro 30 May '16

30 May '16

<https://twitter.com/nicholasbishop/status/737014814342533121/photo/1>

1 0

Whom to contact for a public mirror for a Linux distribution?
by Michael Doerner - Technologywise 26 May '16

26 May '16

Hi all I am involved with a Linux distribution called "Koozali SME server" (https://wiki.contribs.org/Main_Page) Unfortunately we lost our mirror in NZ (Oceania) due to very sad circumstances and I am looking whether there is a chance to add that distro to one of the existing public mirrors. I am following the Wiki http://wiki.wlug.org.nz/NewZealandLinuxMirrors and would like to ask at University of Canterbury (Hm, there is a directory on their mirror server called "contrib" and I wonder whether there was something planned at some time ago). If someone here knows how to get in contact (email?) with an admin person there, I would appreciate any hint. Thanks Michael Doerner

1 0

Google to bring official Android support to the Raspberry Pi 3
by Peter Reutemann 26 May '16

26 May '16

"The Raspberry Pi 3 is not hurting for operating system choices. The tiny ARM computer is supported by several Linux distributions and even has a version of Windows 10 IoT core available. Now, it looks like the Pi is about to get official support for one of the most popular operating systems out there: Android. In Google's Android Open Source Project (AOSP) repository, a new device tree recently popped up for the Raspberry Pi 3." -- source: http://arstechnica.com/gadgets/2016/05/google-to-bring-official-android-sup… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Behold, The Raspberry π Citrix Client
by Lawrence D'Oliveiro 25 May '16

25 May '16

Citrix have unveiled their new desktop thin client built around a Raspberry π 3 <http://www.theregister.co.uk/2016/05/24/citrix_bakes_up_raspberry_pi_client/>, for USD89. "In classic disruptive fashion, the Raspberry Pi has already taken a significant share of the education PC market with over 8 million devices shipped," Citrix VP of emerging solutions Chris Fleck said...

1 0

live edition of forthcoming Slackware release
by Ian Young 25 May '16

25 May '16

Anyone who takes an interest in Slackware may like to check out a live version recently made available. Mentioned in this week's Distrowatch Weekly. Link to project blog below. http://alien.slackbook.org/blog/stable-1-0-0-release-of-liveslak/

1 0

Fwd: Bruce Gilbert suggested a new Meetup for WLUG - Waikato Linux Users Group
by Peter Reutemann 25 May '16

25 May '16

What do you guys think of the topic below for the next meeting? Personally, I'm just a Linux user, so not really qualified to discuss the topic. However, I'd be still keen to hear about. Cheers, Peter ---------- Forwarded message ---------- This Meetup will be announced to the group if 3 people say they're going. Or you can announce it now. Bruce Gilbert suggested a new Meetup. What: Talk about Linux/Unix philosophy & 'systemd'. When: This Meetup needs a date Where: This Meetup needs a location 'systemd', which has replaced SYSTEMV 'init' in nearly ALL current Linux distributions, seems to go against the fundamental philosophy of Linux/Unix. It has a 'finger-in-all-pies' approach & is, I believe, unnecessarily complex? Click here to check out this Meetup: http://www.meetup.com/WaikatoLinuxUsersGroup/events/231330392/

1 0

Norton Bans kernel.org
by Lawrence D'Oliveiro 24 May '16

24 May '16

The screenshot from the original report <http://www.theregister.co.uk/2016/05/24/norton_bans_kernel_dot_org/> shows “Computer Threats: 4” from the kernel.org site. Though it seems, since the report, Norton have fixed it to show no threats any more.

1 0

Meetings tonight?
by Chris McClimans 24 May '16

24 May '16

Meetup.com doesn't show anything scheduled

2 1

Supercomputing Is Hard, Reproducibility Is Harder
by Lawrence D'Oliveiro 23 May '16

23 May '16

<http://www.theregister.co.uk/2016/05/23/the_underbelly_of_simulation_scienc…> Their next step, to make the work easier for other researchers to replicate their results, was a replication study on other packages... That's where things got painful, they write: to get where they expected to get needed “three years of dedicated work that encountered a dozen ways that things can go wrong, conquered one after another, to arrive finally at (approximately) the same findings and a whole new understanding of what it means to do “reproducible research” in computational fluid dynamics.”

1 0

Oracle v. Google draws to a close, jury sent home until next week
by Peter Reutemann 19 May '16

19 May '16

"Presentation of evidence in the Oracle v. Google trial ended today, and US District Judge William Alsup has sent the jury home for a long weekend. On Monday, the jury members will come back to hear closing arguments and begin their deliberations." More information on the trial can be found here: http://arstechnica.com/tech-policy/2016/05/oracle-v-google-draws-to-a-close… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ongoing Collapse In PC Sales
by Lawrence D'Oliveiro 18 May '16

18 May '16

PC unit shipments are down by a third on volumes of just a few years ago, while revenues have shrunk even more <http://www.theregister.co.uk/2016/05/18/pcmarket2016q1/>. Not sure if that includes tablets: not that it would probably help, nowadays...

1 0

200GB MicroSD for $120nzd
by Chris McClimans 18 May '16

18 May '16

Not bad: http://www.amazon.com/SanDisk-Ultra-200GB-Micro-SDSDQUAN-200G-G4A/dp/B00V62… and they get cheaper as you get smaller, less than half that for 128GB. -chris

1 0

Google Dorking
by Lawrence D'Oliveiro 17 May '16

17 May '16

Fun search terms for finding documents that should never have been made public: <http://arstechnica.com/security/2016/05/google-dorking-when-pii-and-exploit…>.

1 0

Raspberry Pi Zero gains camera support, keeps the $5 price
by Peter Reutemann 17 May '16

17 May '16

"When the Raspberry Pi Foundation launched the credit-card sized Zero, it stressed that the DIY computing board would not be as capable as the rest of the Pi family. But if there's one thing we've learned about the Raspberry Pi, it's that there's always room for improvement. Today, the Zero has received its first major hardware upgrade since its hugely successful launch in November: a camera connector. The new addition works very nicely with the two new Sony imaging modules announced last month and the board retains its $5 (£4) price." -- source: http://www.engadget.com/2016/05/16/raspberry-pi-zero-camera-module/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open-Source VPU-Side Bootloader For Raspberry π
by Lawrence D'Oliveiro 17 May '16

17 May '16

The Raspberry π has been open-source from the beginning in every respect except one: the earliest stages of booting are actually managed by the “VPU” graphics chip, not by the ARM CPU. And the bootloader has been a proprietary firmware blob with no source code available. What made it worse was that the VPU has control over the CPU, not the other way round. Now it looks like that may be changing <http://phoronix.com/scan.php?page=news_item&px=Raspberry-Pi-Bootloader>.

2 1

Using Intel’s Xeon Phi Under Linux
by Lawrence D'Oliveiro 17 May '16

17 May '16

Some researchers at the Czech Technical University in Prague have been using an Intel Xeon Phi co-processor with Gentoo Linux, and have written up their experiences as a guide for others <http://phoronix.com/scan.php?page=news_item&px=Intel-Xeon-Phi-Gentoo>.

2 1

YubiKey Replaces Open-Source Encryption With Proprietary Version
by Lawrence D'Oliveiro 16 May '16

16 May '16

The latest version of the YubiKey no longer uses OpenPGP <https://www.techdirt.com/articles/20160515/02094934446/bad-news-two-factor-…>.

1 0

Ubuntu 16.04 proves even an LTS release can live at Linux’s bleeding edge
by Peter Reutemann 16 May '16

16 May '16

'A disappointing trend has become clear to Linux users in recent years. Whenever Canonical offers a new Ubuntu Long Term Support (LTS) release, it tends to be conservative in nature. (See our Ubuntu 14.04 review, which earned a "Missing the boat on big changes" headline.) Apparently no one wants to try to support a brand new, potentially buggy piece of code for half a decade. The last few Ubuntu releases haven't been LTS rollouts, yet Vivid Vervet (15.04) and Wily Werewolf (15.10) also short-changed users in the way of new features. So when Canonical officially released the latest Ubuntu LTS version (Ubuntu 16.04 or Xenial Xerus) this spring, similar expectations loomed. Frankly, this could potentially be the most boring Ubuntu release to date. Thankfully, perception hasn't matched reality this time around for Ubuntu users. Ubuntu 16.04 is in fact the most exciting release Canonical has put out in recent memory. And after using it for the last few weeks, this may even be the best release Canonical has presented to date.' -- source: http://arstechnica.com/information-technology/2016/05/ubuntu-16-04-proves-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Raspbian Linux OS Gets Major Update, Adds Bluetooth Support to Pi 3
by Peter Reutemann 14 May '16

14 May '16

"The Raspberry Pi 3 was launched with built-in chip for Bluetooth and Wi-Fi support, however, software support for Bluetooth was lacking until now. The drivers were there, but today's update to the Raspbian Linux distribution adds much-needed GUI tools to help you establish Bluetooth connections. Another cool addition is a new backup tool. There are other improvements as well including the mouse settings, and the ability to empty the wastebasket through right-clicking as seen below (yes, seriously). There is even a new shutdown dialog, something even casual users should notice." -- source: https://hardware.slashdot.org/story/16/05/13/1740218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 6

Heart Surgery Stalled For Five Minutes Thanks To Errant Anti-Virus Scan
by Lawrence D'Oliveiro 13 May '16

13 May '16

<https://www.techdirt.com/articles/20160506/07161334360/heart-surgery-stalle…> "...the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly."

1 0

Could someone help with setting up a computer with linux
by Michelle 13 May '16

13 May '16

Hi, My name's Michelle. I've been using Linux on and off for the last few years. If this has not been sent to your LUG mailing list (if you have one) could you please send it to that or to all the people in your LUG please? I'm looking for someone who would help me set up a computer with linux on it. I had a Dell on which I set up Puppy with no problem whatsoever. The computer died and so then I took the puppy distro and the other disto I'd bought (can't remember what) and tried to install them on 2 older computers I had but it didn't work. I don't know why, maybe it was because one of the distros was on a stick and not compatible or maybe both computer hard drives were stuffed? After that I bought a mini-pc (I think it was supposed to run linux) but it didn't work at all. Then I bought a tablet but after a month or two it stopped working or pretty much? Stopped working. So I just used a phone for about a year and last year bought a brand new Toshiba laptop. The problem with this was two fold: 1. It was a laptop. 2. It was a Toshiba (oh how I hate Toshiba) I had known that not all computers were readily compatible with linux but after my easy experience with the Dell I wasn't too concerned. I bought two linux distros on different media and hoped/assumed? that something would work – it didn't. I bought another say 2 or 3 distros and managed to get the Mint to install on this Toshiba. It wasn't until after this annoying endeavor that I found out online that: - laptops are less compatible than desktops with linux and that - Toshiba out of the maybe top 6 or 8 computer manufacturers is consistantly about the least compatible with linux ( I HATE TOSHIBA) I don't happen to have a few spear thousand dollars sitting around to enable me to buy a computer and try and set it up with the distros I want, find it dosen't work, buy another computer, find it doesn't work, buy another and finally find one that works with the distros I want. So I am sending this message to basically all the Linux users groups in NZ and hoping someone can help me set up a computer with the two linux distros I want. I don't know how that would work. Maybe someone is about to buy a new computer and can try these distros before they put theirs on, maybe someone has a partition on their computer that is spare and can try it there, maybe they own a computer shop or work in a computer shop or at a university or polytech with computers or computer parts around. So for anyone who may be willing to help me here is what I would like: - a desktop (not the modern ones that are a computer plus other thing/s but just a computer - not a toshiba - Whonix to run on top of Qubes. Whonix is great for anonimity and Qubes is designed for security/safety. - I have a DrayTek vigor 120 modem. I connect it via DSL. When looking into whonix I read that it is complex to configure and setup, so I was hoping that you might have such a modem or access to one and set it up with whonix and then tell me how you did it. - I don't want the computer to come with wifi or bluetooth or any similar thing. I don't want it just not running, I don't want it there at all. - I'm wanting to install 3 old encyclopedias. I was reading about the new versions online and people were recommending old ones. I've bought Encarta 2004, 2001 and Encyclopaedia Britannica '98. To run them on I've bought Windows 98 second edition and Windows NT (first edition?). If you have or could borrow these windows OS could you see if you could get them running in whonix or qubes? - One or both of the encyclopedias need 2 DVD players so I'd like at least 2 DVD players with one being a recorder. - I'm not looking for a high end computer. As long as it will play youtube, that's fast enough. BUT I would appreciate hearing any recommendation about if I just add such and such for $100 or $150 it would go much faster. I'd like 500GB hard drive at least and I've been recommended to get 8GB RAM at least. I wouldn't buy the computer off you but rather if you could tell me what computer/computer parts worked, I'd pay up to $150 for the info. If 10 different people told me what worked of course I couldn't pay 10 different people $150. I am sending this to: the wlug, Glen Ogilvie at nelg(a)linuxsolutions.co.nz in Auckland, the Welly LUG through hugh(a)davenport.net.nz, nzlug(a)lists.nzoss.org.nz and Wellington LUG through jethro.carr(a)jethrocarr.com. If you know of any active LUG that I have missed or anyone else that might be willing to assist me could you please pass this onto them? My email is michelle400(a)orcon.net.nz. If this is posted to a mailing list (I've never used one before) and I don't reply in a week could you get back to me on my email? Thank you to anyone willing to help Michelle Gorringe.

3 3

BitKeeper Becomes Open-Source
by Lawrence D'Oliveiro 10 May '16

10 May '16

BitKeeper was the distributed version-control system that Linus Torvalds and the other kernel developers were using over a decade ago. It was a proprietary product, but the Linux folk were allowed use of it for no charge, under a licence that prohibited reverse-engineering, and that obligated them to uprade to newer versions with whatever new licence terms the company wanted to impose. It was a stoush over this reverse-engineering prohibition that led to BitMover giving notice it was cancelling this agreement, which in turn led to Torvalds creating Git. And the rest, as they say, is history. <http://phoronix.com/scan.php?page=news_item&px=BitKeeper-Open-Source>

1 0

Debian Dropping Support For Older CPUs
by Peter Reutemann 09 May '16

09 May '16

'The Debian project supports a wide range of hardware architectures, including 32-bit x86 CPUs. Changes are happening in Debian's development branches which will make older versions of the 32-bit architecture obsolete. Ben Hutchings provides the details: "Last year it was decided to increase the minimum CPU features for the i386 architecture to 686-class in the Stretch release cycle. This means dropping support for 586-class and hybrid 586/686 processors. (Support for 486-class processors was dropped, somewhat accidentally, in Squeeze.) This was implemented in the Linux kernel packages starting with Linux 4.3, which was uploaded to Unstable in December last year. In case you missed that change, GCC for i386 has recently been changed to target 686-class processors and is generating code that will crash on other processors. Any such systems still running Testing or Unstable will need to be switched to run Stable (Jessie)."' -- source: https://linux.slashdot.org/story/16/05/09/028259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leading-Edge Technology ... Or Not
by Lawrence D'Oliveiro 07 May '16

07 May '16

To service the McLaren F1 supercar, McLaren needs a Compaq LTE 5280 laptop which hasn’t been manufactured in about 20 years <http://www.theverge.com/2016/5/3/11576032/mclaren-f1-compaq-laptop-maintena…>. The laptop has a special CA (“Conditional-Access”) card, and "The CA card is an interface between the laptop software (which is DOS-based) and the car." .. the CA card was used as custom hardware as part of an integrated system for security and copy protection. In other words, this is part of a system to ensure that nobody but McLaren can access the car software. Their attempt at vendor lock-in has led to vendor lock-in being imposed on them.

1 0

embedded projects
by rowan schischka 06 May '16

06 May '16

there is about five weeks of lectures left at uni so looking to get some things together now due to international shipping delays. does anyone want to share shipping costs on an intel curie? http://www.intel.com/content/www/us/en/do-it-yourself/arduino-101.html I would also appreciate some buying advice. there are a number of retailers but the cheapest one only sells instore in north america. I also need to purchase a small suitable rechargeable battery. also where is the maker scene at waikato? -- Rowan Schischka

3 2

UK Spooks Say: Don’t Keep Resetting Your Passwords!?
by Lawrence D'Oliveiro 06 May '16

06 May '16

On World Password Day (who knew?), the Communications-Electronics Security Group (CESG), part of GCHQ, is telling sysadmins not to force their users to keep resetting their passwords <http://www.theregister.co.uk/2016/05/05/stop_resetting_your_password_says_u…>. The result, according to CESG, is that we are more likely to write our password down. Or forget the password altogether, forcing service desks to reset them, chewing up time and resources. So what was wrong with writing them down, again? You know how to keep your cash, credit cards and house keys safe; why can’t you keep your written passwords in the same place? The last three paragraphs of the article are, um, worth reading carefully...

2 1

Microsoft unveils new effort to make its documentation great again ... or does it?
by rowan schischka 06 May '16

06 May '16

>Just one problem: while Microsoft itself uses the term ?open sourced? I think you will find that Microsoft will make its own definition of the word 'open'. for example for years they have been calling their bulk license purchasing plan the 'Open License' (OLP, OLV, OVS, etc). Their Open is not GPL. They want hobbyists and students to tinker with their products and if you're not making money they wont bother you. for example they give charities and schools dirt cheap pricing because they just want everyone to use their products. Their bottom line is; if you make money off our product we want our cut of that to return to our investors.

3 2

TLS Proxies: Insecure By Design
by Lawrence D'Oliveiro 06 May '16

06 May '16

A “TLS Proxy” short-circuits the security of TLS/SSL connections so it can do deep-packet inspection on encrypted connections. This kind of thing always seemed dodgy. And now it turns out that is so for good reason: these devices are full of holes <http://www.theregister.co.uk/2016/05/05/tls_proxies_are_insecure/>. The paper mentioned there concentrated on consumer/retail devices. But it’s unlikely ones designed for business/enterprise use are going to fare any better...

1 0

Unity 8 And Snaps Are Conquering The Ubuntu Desktop After Ubuntu 16.10
by Peter Reutemann 05 May '16

05 May '16

"Today is the last day of the Ubuntu Online Summit 2016, and the Ubuntu developers discussed the future of the Ubuntu Desktop for Ubuntu 16.10 (Yakkety Yak) and beyond. It looks like Snaps (Snappy) and Unity 8 with Mir are slowly conquering the Ubuntu Desktop, at least according to Canonical's Will Cooke, Ubuntu Desktop Manager. Work has already begun on pushing these new and modern technologies to the Ubuntu Desktop, as Ubuntu 16.04 LTS has just received support for installing Snaps from the Ubuntu Snappy Store. Canonical's Will Cooke has mentioned the fact that the Unity 7 desktop enters its twilight years, which means that it gets fewer features and it's being reduced to only critical and OEM work. This is because Unity 8 desktop is getting all the attention now, and it will become the default desktop session somewhere after Ubuntu 16.10 (Yakkety Yak)." -- source: https://news.slashdot.org/story/16/05/05/2038256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft unveils new effort to make its documentation great again ... or does it?
by Lawrence D'Oliveiro 05 May '16

05 May '16

<http://arstechnica.com/information-technology/2016/05/microsoft-unveils-new…>: Some teams within Microsoft, such as those developing ASP.NET and .NET Core, had already open sourced their documentation. On the new site, all documentation will be handled similarly. Every article will have an "edit" button enabling changes and fixes to be proposed. These changes will be handled as pull requests on GitHub, with the documentation itself using the popular Markdown markup language. Just one problem: while Microsoft itself uses the term “open sourced” <https://docs.microsoft.com/teamblog/introducing-docs-microsoft-com/>: All documentation on docs.microsoft.com is open sourced and designed to allow community contributions. Nowhere does it actually spell out what the copyright licence is. Clicking on the “Terms of Use” link takes you here <https://www.microsoft.com/en-us/legal/intellectualproperty/copyright/defaul…>, where it says Personal and Non-Commercial Use Limitation Unless otherwise specified, the Services are for your personal and non-commercial use. You may not modify, copy, distribute, transmit, display, perform, reproduce, publish, license, create derivative works from, transfer, or sell any information, software, products or services obtained from the Services.

1 0

Proprietary Software Riddled With Old Open-Source Vulnerabilities
by Lawrence D'Oliveiro 04 May '16

04 May '16

No big news, really: closed-source software, even if it is built on open-source components, will inevitably accumulate long-standing bugs that never get fixed. And sometimes the bugs have security implications. This report from Black Duck uses the term “commercial” software, but it’s quite clear they mean “proprietary” software, i.e. closed-source <http://www.theregister.co.uk/2016/05/04/commercial_software_chokkas_with_an…>. The telling phrase in the report is “visibility into the components that are included in their code base is required”. How would you *not* have such visibility, if the source of your product is open? A lot of companies may hate copyleft licences, but at least they force a level of transparency that makes this kind of thing much harder to cover up.

1 0

Hard Drive Warranties Are Now Specifying Data-Write Limits?
by Lawrence D'Oliveiro 04 May '16

04 May '16

It used to be that warranties for hard drives were for some specified number of years, it didn’t matter how much load they were under (compare SSDs). But it seems that is now changing, as capacities are pushed to the point where ever more creative strategies are needed to get the devices to work at all <http://www.theregister.co.uk/2016/05/03/when_did_hard_drives_get_workload_r…>.

3 2

The Tao Of Programming
by Lawrence D'Oliveiro 04 May '16

04 May '16

<http://www.mit.edu/~xela/tao.html>: 4.3 The Master was explaining the nature of Tao to one of his novices. "The Tao is embodied in all software -- regardless of how insignificant," said the Master. "Is the Tao in a hand-held calculator?" asked the novice. "It is," came the reply. "Is the Tao in a video game?" asked the novice. "It is even in a video game," said the Master. "Is the Tao in the DOS for a personal computer?" asked the novice. The Master coughed and shifted his position slightly. "The lesson is over for today," he said.

1 0

Aging and bloated OpenSSL is purged of 2 high-severity bugs
by Peter Reutemann 03 May '16

03 May '16

"Maintainers of the OpenSSL cryptographic library have patched high-severity holes that could make it possible for attackers to decrypt login credentials or execute malicious code on Web servers. The updates were released Tuesday morning for both versions 1.0.1 and 1.0.2 of OpenSSL, which a large portion of the Internet relies on to cryptographically protect sensitive Web and e-mail traffic using the transport layer security protocol. OpenSSL advisories labeled the severity of both vulnerabilities "high," meaning the updates fixing them should be installed as soon as possible. The fixes bring the latest supported versions to 1.0.1t and 1.0.2h." -- source: http://arstechnica.com/security/2016/05/aging-and-bloated-openssl-is-purged… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huge number of sites imperiled by critical image-processing vulnerability
by Peter Reutemann 03 May '16

03 May '16

"A large number of websites are vulnerable to a simple attack that allows hackers to execute malicious code hidden inside booby-trapped images. The vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users." -- source: http://arstechnica.com/security/2016/05/easily-exploited-bug-exposes-huge-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fast good unlimited internet
by Ian Young 03 May '16

03 May '16

As per the subject it sounds great. Alas this is New Zealand, home of the rapacious duopoly, and one cable outwards. So you won't be looking at 'Spark' (aka former monoply Telecom) or global corp Vodafone. The fast thing has got a bit better since the powers that be finally fibred up at taxayer expense at least in part. Or so I hear. Ultra fast is probably an exaggeration compared with benchmark nations. Long white cloud has some issues with population density and geography. However it sounds like there may be a local option. Tauranga is an opulent region so there must be some money in it for small providers. Until a bigger fish appears bent on acquisition.

1 0

Art Or Spam?
by Lawrence D'Oliveiro 03 May '16

03 May '16

A bot has been hanging around 3D-printing site Thingiverse, generating random and bizarre/surreal remixes of objects posted to the site by others <http://arstechnica.com/gadgets/2016/05/that-time-a-bot-invaded-thingiverse-…>. The creators of the bot recently showed some of the results at an exhibition. Is “confrontational art” just another term for “trolling”? Opinions about the bot’s contribution to the community seem mixed...

1 0

Tauranga ISPs
by Chris McClimans 03 May '16

03 May '16

Any suggestions for fast, good, unlimited broadband? Maybe with a chance for static IPs?

3 2

Ubuntu Quietly Raises Install Image Size to 2GB
by Peter Reutemann 02 May '16

02 May '16

'You can expect to see a larger Ubuntu desktop installation image by the time the Yakkety Yak yips out. Developers are currently debating the exact size limits that official flavours will adhere to, with some favouring a 2GB hard limit while others are looking to go full-DVD size at 4.7GB+. Canonical's Steven Langasek explains the plans for Ubuntu 16.10 Yakkety Yak: "I've finally gone ahead and bumped the limit on Ubuntu desktop images to 2GB for a minimally-sized USB stick; this gives us a new limit that I think we will care about, while also leaving us headroom so we're not constantly fighting it back down to the line." The Ubuntu ISO is supposed to be around the 1GB mark but has creeped past this in recent releases. The current Ubuntu 16.04 LTS desktop .iso is 1.4GB.' -- source: https://linux.slashdot.org/story/16/05/02/1035248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

From Paintbox to PC: How London became the home of Hollywood VFX
by Lawrence D'Oliveiro 01 May '16

01 May '16

Nice article about the video-effects business, from the Quantel Paintbox to present-day CGI <http://arstechnica.com/the-multiverse/2016/05/how-london-became-the-home-of…>, from Ars Technica UK. Betting on Moore’s Law: Framestore tried to predict when technology would allow them to charge what their clients were willing to pay, and adjust the business accordingly. It was a risky, yet incredibly shrewd plan—and it paid off. This same company went on to make “Walking With Dinosaurs”. Moving away from the legendary SGI workstations of the early 1990s, towards more commodity hardware nowadays: Today, VFX studios are powered by Intel processors, Nvidia graphics cards (all the VFX studios I spoke to used Nvidia graphics cards, citing reasons of driver stability), and Linux operating systems. These parts are just as accessible to consumers as they are to businesses: one only need look at the rise of YouTube and high-quality homemade videos to see just how far the commoditisation of VFX technology has come. But those Nvidia cards are mainly used for on-screen previews, not the final renders: Like the rest of the VFX industry, Pixar is yet to introduce GPUs into its render farms, preferring instead to use them in local or farm-based workstations for quick and dirty lighting previews. It faces the same issue as everyone else: GPUs simply don't have enough memory. Each frame in a final render requires as much 64GB of system memory, with films like Avatar pushing 128GB. The highest-end Nvidia graphics card comes equipped with just 12GB of memory. The article has a strange reluctance to use the term “renderer”. It describes Arnold as “a cutting edge lighting program” and Renderman as “a way to flesh out an existing 3D model or animation with interactive lighting and shading”. One quote I found revealing: At most VFX studios the final render is done at around 2K resolution. It doesn’t qualify this by saying this is for TV work, not for film work. So is 2K enough even for film work? And just like when they moved from TV to film, studios like MPC, Framestore, and Pixar are waiting for technology to catch up with their creative ambitions, even if they're not all convinced 4K is the answer. Meanwhile, some people are managing 4K renders <https://www.youtube.com/results?search_query=blender+foundation+4k> just fine...

1 0

Re: [wlug] Intel?s Atom Chips Circling The Plughole (Lawrence D'Oliveiro)
by rowan schischka 01 May '16

01 May '16

>I wondered--still wonder--why Intel doesn?t just make ARM chips. It?s got to be more profitable than the billions it has wasted on developing Atom processors that nobody seems to want. I believe the Atom was Intel's competition to the AMD geode which is I think is still available. I wouldnt say no one wants them. Microsoft has been keen on them since Windows RT failed. Arm is an old competitor to Intel; remember Acorn computers? I dont think they would attract investors if they were buying licenses from ARM. Seems logical they are dropping the Atom in favour of their new IoT chips. Im more interested in what Samsung is doing with its Artik 12x12mm SOC, an arm you can fit in your undies! -- Rowan Schischka

3 3

Intel’s Atom Chips Circling The Plughole
by Lawrence D'Oliveiro 30 Apr '16

30 Apr '16

The next, “Broxton”, generation of Intel’s Atom chips have been cancelled, along with future SoCs incorporating Atom cores <http://www.theregister.co.uk/2016/04/30/intel_atoms_cancelled/>. I can remember when the first generation of Atom chips were announced, back in 2008 or so with the debut of “netbooks”--remember them? (/me glances at an old Asus Eee 701 sitting within arm’s reach.) Intel claimed it was two years ahead of ARM at that point, and able to offer the “full Internet experience” (which was code for “can run Flash videos”). That “two years ahead” claim went quiet after a few months... I wondered--still wonder--why Intel doesn’t just make ARM chips. It’s got to be more profitable than the billions it has wasted on developing Atom processors that nobody seems to want.

1 0

Intel’s Clear Linux Is Making Waves
by Lawrence D'Oliveiro 26 Apr '16

26 Apr '16

Intel has brought out “Clear Linux”, incorporating many optimizations for speed. Now the Fedora folks are looking into these speedups, with a view to making them more mainstream <http://phoronix.com/scan.php?page=news_item&px=Fedora-Looks-At-Clear>.

1 0

Cinnamon 3.0 Desktop Environment Tagged for Linux Mint 18, Here's What's New
by Peter Reutemann 25 Apr '16

25 Apr '16

"With updated dependencies on board and numerous bug fixes, Cinnamon 3.0 comes with multiple new features, among which we can mention an option that lets users display or hide the favbox in the Menu applet, the addition of new default application buttons, as well as support for displaying the panel-launchers actions. The Sound settings have been rewritten in Python, and there's a custom page that shows users when there's no input devices available or if any apps are now playing. Additionally, the Sound panel received a custom settings box that should prevent the sound effects dialog to be opened in a very tall window." -- source: http://www.linuxtoday.com/developer/cinnamon-3.0-desktop-environment-tagged… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Seeks New Home For Email Client Thunderbird
by Peter Reutemann 25 Apr '16

25 Apr '16

"In a report commissioned by Mozilla to explore the next home for Thunderbird, two potential new hosts have been offered: the Software Freedom Conservancy (host to git, boost, QEMU, and a host of other projects) and The Document Foundation (home of LibreOffice). At the same time, the report discusses completely uncoupling Thunderbird from the rest of the Mozilla codebase and bringing in a dedicated technical architect to chart the software's roadmap. Given that the two named organizations are already on board with taking Thunderbird under their wing, is this a new lease on life for the email program Mozilla put out to pasture four years ago?" -- source: https://tech.slashdot.org/story/16/04/25/1949239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still On For Tonight?
by Chris McClimans 25 Apr '16

25 Apr '16

I noted that we seem to be scheduled, even though it is a public holiday today. I was planning to attend, but wanted to make sure it was still on. I have some fun org-babel-async stuff I use that might be fun to share. (vim users might enjoy looking at spacemacs.org as well) Cheers, -chris

2 2

Docker-Online-Meeting tomorrow 9am
by Chris McClimans 24 Apr '16

24 Apr '16

http://www.meetup.com/Docker-Online-Meetup/events/230475901/ Wouldn't mind meeting in person if anyone is up for it. Cheers, -chris

1 0

Ubuntu 16.04 LTS Available To Download; Mozilla To Offer 0-Day Firefox Releases Via Snaps
by Peter Reutemann 22 Apr '16

22 Apr '16

"The latest, and hopefully, the greatest version of Ubuntu is now available to download. On the sidelines, Mozilla today announced the availability of future releases of its popular Firefox web browser in the snap package format for Ubuntu 16.04 LTS. Earlier today, Canonical unleashed the final release of the highly anticipated Ubuntu 16.04 LTS (Xenial Xerus) operating system, bringing users a great set of new features and improvements. Also today, it looks like Canonical has renewed its partnership with Mozilla to offer Firefox as the default web browser on Ubuntu 16.04 LTS and upcoming releases of the Linux kernel-based operating systems. As part of the new partnership, Mozilla is committed to distributing future versions of Firefox as a snap package. Having Firefox distributed in the snap format means that you'll have 0-day releases in Ubuntu 16.04. Yes, just like Windows and Mac OS X, users are enjoying their 0-day releases of Mozilla Firefox and don't have to wait for package maintainers of a particular GNU/Linux distribution to update the software in the main repositories. For Mozilla, having Firefox as a snap package means that they'll be able to continually optimize it for Ubuntu." -- source: https://tech.slashdot.org/story/16/04/21/1940213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

meeting next Monday
by Ian Young 21 Apr '16

21 Apr '16

If there is time available I could talk about a distro called LXLE I have been looking at lately. ~ Ian Y

2 1

Tauranga Makerspace
by Chris McClimans 20 Apr '16

20 Apr '16

http://onurcelebi.com/blog/how-a-diode-changed-my-life/ I've been working with electronics over the past year, including making a keyboard with batteries, and charging ports, etc for use with various embedded systems, usb, and bluetooth. Reading this article actually helped me solve some of the charging and power problems, and makes me realize I don't know much about electronics. I'm looking forward to getting together with other folks who solder, and see what happens. (Still trying to find housing, but I'm hanging around @basestationnz most mornings)

1 0

Intel To Sack “Up To 12,000” Staff
by Lawrence D'Oliveiro 19 Apr '16

19 Apr '16

<http://arstechnica.com/business/2016/04/intel-announces-evolution-away-from…> ...the firings were meant to "accelerate [Intel's] evolution from a PC company to one that powers the cloud and billions of smart, connected computing devices." And yet they still insist on trying to push unpopular x86 chips on these markets, instead of the ARM chips that everybody else wants to use.

1 0

topics for next monday?
by Peter Reutemann 19 Apr '16

19 Apr '16

Hi everyone At the moment, we don't have anything lined up for next Monday. Any ideas for topics? New distros or applications uncovered? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 8

Cybersecurity Report From 1970
by Lawrence D'Oliveiro 19 Apr '16

19 Apr '16

<http://arstechnica.com/security/2016/04/flashback-declassified-1970-dod-cyb…> The Ware Report included a list of conclusions and recommendations that (based on recent data breaches and security failures) many have failed to take to heart. “Plus ça change”, as they say...

1 0

The Ars guide to building a Linux router from scratch
by rowan schischka 19 Apr '16

19 Apr '16

> What about a MIPS-oriented distro like OpenWRT? I have never tested OpenWRT. I would think that the strength of openWRT would be in its web interface and it has been customised for specific hardware. Both my embedded devices are capable of running debian and I have no need for a web interface. I think you would use OpenWrt if you already have the hardware for it.

1 0

Re: [wlug] The Ars guide to building a Linux router from scratch
by Roger Hardy 18 Apr '16

18 Apr '16

I run several instances of pfsense on both pcengines APU boards and as Xen VM's, and I would use that over pretty much anything these days. Good throughput, easy to manage, and lots of features. In my case this was because my iptables script was getting to be handful as well as IPSec and OpenVPN installations that are now much easier to manage and monitor. Industrial strength magic for home router price from my point of view.

1 0

The Ars guide to building a Linux router from scratch
by rowan schischka 18 Apr '16

18 Apr '16

A few years ago I built an ap on a pc engines alix board. Of course the choice of wireless card is going to be the deciding factor in performance as the alix's cpu and ram is higher than most wireless appliances. My performance was good but not as good as similar priced appliances. I am not using it atm because I'm using a skinny 4g modem. If I needed a wireless ap in the future I would buy an appliance over built due to cost, time, and performance. What you loose out on appliance ap is software and security upgrades. Also the coolest thing with building a router based on debian is you can install anything you want. But if you want to install proxy server, file server and virus scanners don't go for an embedded chip, get a proper pc with decent cpu and hard drive. And lastly I tested the original raspberry pi as an ap. Throughput was terrible. About 1mb per second file transfer speed using rsync, my understanding is that is due to everything running through its USB controller

2 1

The Ars guide to building a Linux router from scratch
by Peter Reutemann 17 Apr '16

17 Apr '16

"After finally reaching the tipping point with off-the-shelf solutions that can't match increasing speeds available, we recently took the plunge. Building a homebrew router turned out to be a better proposition than we could've ever imagined. With nearly any speed metric we analyzed, our little DIY kit outpaced routers whether they were of the $90- or $250-variety." -- source: http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-ro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 16.04 LTS Will Bring Snap Packages For Up-To-Date, More Secure Apps
by Peter Reutemann 13 Apr '16

13 Apr '16

"Canonical, Ubuntu's parent company, has announced that Ubuntu 16.04 LTS (Long Term Support) will come with support for the snap packaging format and tools. As a result, end users will get more up-to-date apps, something that proved tricky in the past due âoethe complexity of packaging and providing updates,â which prevented updates to some apps being delivered. Snaps will make the Ubuntu platform more unified, developers will more easily be able to create software for PC, Server, Mobile, or IoT devices. The other major benefit of snaps is that that they're more secure than software installed through deb packages. Snaps are isolated from the rest of the system, meaning that malware packaged with a snap won't be able to affect your Ubuntu installation." -- source: https://news.slashdot.org/story/16/04/13/1627204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Future of Firefox is Chrome
by Peter Reutemann 13 Apr '16

13 Apr '16

"Mozilla seems to think a new future for Firefox [lies in Chrome]. While they claim that it is only about new ways of browser design, it is also an open secret that they are running into more and more problems lately with web compatibility. [Senior VP Mark Mayo caused a storm by revealing that the Firefox team is working on a next-generation browser that will run on the same technology as Google's Chrome browser. The project, named Tofino, will not use Firefox's core technology, Gecko, but will instead plumb for Electron, which is built on the technology behind Google's rival Chrome browser, called Chromium.] The benefit of Chromium/Electron would be that it is a solution they could pull much faster forward than their own Servo plans [Servo being Mozilla's Rust-based web engine]. What the real outcome of all this will be, only Mozilla knows so far. But inside Mozilla there is much resistance against such plans... Interesting times are ahead." -- source: https://news.slashdot.org/story/16/04/12/2025215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Yes, Badlock bug was shamelessly hyped, but the threat is real
by Peter Reutemann 13 Apr '16

13 Apr '16

"In a nutshell, Badlock refers to a defect in a security component contained in just about every version of the Windows and Linux operating systems. Known as the Distributed Computing Environment/Remote Procedure Call (DCE/RPC), it's used by administrators around the world to access the most valuable asset on any Windows network—the Active Directory, which acts as a network's digital security guard, allowing, for instance, an organization's CFO to log in to an accounting server, while locking out the janitor or the groundskeeper. Because Active Directories enforce security policies and contain password data and other crucial credentials, they are almost always the first asset hackers access once they gain a limited foothold into a targeted network." "An Active Directory infrastructure with a Samba server as a domain member is vulnerable to this flaw," an advisory published Tuesday by Linux distributor Red Hat warned. "A man-in-the-middle attacker could intercept DCE/RPC traffic between the domain member and the domain controller to impersonate the client and get the same privileges as the authenticated user account. The attacker could view or modify secrets within an AD database, including user password hashes, or shutdown critical services." -- source: http://arstechnica.com/security/2016/04/yes-badlock-bug-was-shamelessly-hyp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux-On-Windows Performance
by Lawrence D'Oliveiro 11 Apr '16

11 Apr '16

Some initial benchmarks on the Linux layer that Microsoft has added to Windows 10: <http://www.phoronix.com/scan.php?page=article&item=windows-10-lxcore&num=1>. Summary: CPU performance seems quite good, while I/O is terrible.

1 0

Popular Firefox Add-Ons Open Millions To New Attack
by Peter Reutemann 09 Apr '16

09 Apr '16

'Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary."' 'Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."' -- source: https://it.slashdot.org/story/16/04/09/1758255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Help Shut Down Spam Botnet That Enslaved 4, 000 Linux Machines
by Peter Reutemann 09 Apr '16

09 Apr '16

'A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down. Sophisticated Mumblehard spamming malware flew under the radar for five years. Known as Mumblehard, the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the delisting of any Mumblehard-based IP addresses that sneaked into the real-time composite blocking list, or CBL, maintained by the anti-spam service. "There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots," researchers from security firm Eset wrote in a blog post published Thursday. "If one was found to be blacklisted, this script requested the delisting of the IP address. Such requests are protected with a CAPTCHA to avoid automation, but OCR (or an external service if OCR didn't work) was used to break the protection."' -- source: https://linux.slashdot.org/story/16/04/09/1827238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Warns Of "Uncorrectable Freedom & Security Issues" For x86
by Lawrence D'Oliveiro 05 Apr '16

05 Apr '16

Modern Intel and AMD x86 chips cannot even boot up without various pieces of locked-down proprietary binary firmware. Effectively this is an OS-within-an-OS, that retains ultimate control of the processor, regardless of what the owner of the machine might want. <http://phoronix.com/scan.php?page=news_item&px=x86-Uncorrectable-Freedom>

1 0

Microsoft Windows Linux Take 2
by Lawrence D'Oliveiro 30 Mar '16

30 Mar '16

From <http://arstechnica.com/information-technology/2016/03/ubuntus-bash-and-linu…>: ...we've known for several months now is that the company has developed some Windows kernel components (lxcore.sys, lxss.sys, presumably standing for "Linux core" and "Linux subsystem," respectively) that support the major Linux kernel APIs. ... Microsoft is calling this the "Windows Subsystem for Linux" (WSL). ... Canonical has provided a system image containing the Ubuntu versions of the various command-line tools that are typically found in a Linux distribution. Our understanding is that these are not recompiled or ported versions of the programs (as are used in tools aiming to provide a Unix-like environment on Windows such as Cygwin) but instead unmodified programs. Microsoft is describing this in terms of providing a Linux-like command-line environment at the moment, but from what we can gather, there's little fundamental restriction to this, potentially opening the door to running a wide range of Linux programs natively on Windows. Absolutely nothing to do with the fact that tomorrow is April 1...

1 0

meeting on Monday
by Peter Reutemann 28 Mar '16

28 Mar '16

Hi everyone We have a WLUG meeting on Monday. Unfortunately, there won't be a demonstration of the Raspberry Pi 3 and I'm not sure about the Pine 64 either. http://www.meetup.com/WaikatoLinuxUsersGroup/events/229051656/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

Red Hat Achieves 2 Billion USD In Annual Revenue
by Lawrence D'Oliveiro 23 Mar '16

23 Mar '16

Red Hat has taken just 2 years to double its annual takings <http://phoronix.com/scan.php?page=news_item&px=Red-Hat-Two-Billion>. I remember a senior executive saying some years ago that for every dollar of revenue they get, they take $10 away from their proprietary rivals. So their overall effect on the market is massively deflationary.

1 0

Oracle Versus PostgresQL
by Lawrence D'Oliveiro 21 Mar '16

21 Mar '16

Looks like Russia’s Government departments are looking to move to PostgresQL instead of Oracle. In response, Oracle has released a document trying to point out all the problems with PostgresQL <http://www.theregister.co.uk/2016/03/21/oracle_fights_russian_software_poli…>. First they ignore you, then they laugh at you, then they fight you...

1 0

How to maintain my connection to squeeze
by Chris O'Halloran 12 Mar '16

12 Mar '16

Hi all, I have a server at work that is hacked and customized to bits to keep a wiki going using mediawiki [1] software including node.js [1a] binaries. It was a turneky [2] appliance based on Debian 6 or squeeze. It's work very well these past 6 or 7 years. It also runs a ruby on rails app clockingit.[3] I've installed the anaconda python distribution [4] on it and that is running fine. It was the only way to get python 3.4 running nicely with notebooks. A thing I've been tinkering with lately is the latex circuit package circuitikz [5] for my making nice circuit diagrams and another bit of ipython magics [6] allows you to insert these into your ipython notebooks. I know this keeps putting off the inevitable but I'd rather procrastinate further than rebuild the server. It seems squeeze has experienced some sort of migration to an LTS release even though officially it's not longer supported. The point is, I'd like to sudo apt-get install texlive-science but say it will have problems chris(a)wiki apt/sources.list.d$ sudo apt-get install texlive-science Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: texlive-science : Depends: python2.7 but it is not going to be installed Depends: texlive-base (>= 2015) but it is not going to be installed Depends: texlive-latex-base (>= 2015) but it is not going to be installed Depends: tex-common (>= 6) but 2.08.1 is to be installed Depends: texlive-latex-recommended (>= 2015) but it is not going to be installed Depends: texlive-binaries (>= 2015.20160222.37495-1) but 2009-8 is to be installed E: Broken packages when I do sudo apt-get update Err http://cdn.debian.net squeeze/main amd64 Packages 404 Not Found [IP: 180.214.94.18 80] Err http://cdn.debian.net squeeze/contrib amd64 Packages 404 Not Found [IP: 180.214.94.18 80] Err http://cdn.debian.net squeeze/non-free amd64 Packages 404 Not Found [IP: 128.61.240.89 80] Fetched 39.3 kB in 7s (5257 B/s) W: There is no public key available for the following key IDs: 7638D0442B90D010 W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/main/binary-amd64/Packages.gz 404 Not Found [IP: 180.214.94.18 80] W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/contrib/binary-amd64/Packages.gz 404 Not Found [IP: 180.214.94.18 80] W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/non-free/binary-amd64/Packages.gz 404 Not Found [IP: 128.61.240.89 80] So is seems I need to update the squeeze sources to still access the old repos. I'm nervous about upgrading because of all the customisations and don't wish to break things. Any clues on how I have have my server still able to download old packages. Cheers Chris [1] http://mediawiki.org/ [1a] https://nodejs.org/en/download/ [2] http://www.turnkeylinux.org/ [3] http://www.clockingit.com/ [4] https://www.continuum.io/downloads [5] http://www.texample.net/tikz/examples/circuitikz/ [6] https://github.com/mkrphys/ipython-tikzmagic

2 2

Former Microsoft CEO No Longer Negatively Attacks Linux
by Lawrence D'Oliveiro 11 Mar '16

11 Mar '16

Interview with Steve Ballmer linked from <http://phoronix.com/scan.php?page=news_item&px=Ballmer-Linux-Cancer-Free>: Fifteen years after calling the open-source operating system Linux a "cancer," former Microsoft Corp (MSFT.O) Chief Executive Steve Ballmer has softened his position. Speaking on Wednesday night at a dinner hosted by Fortune magazine, Ballmer said the position was right for the time, but the threat from Linux was now "in the rearview mirror." Which is why Microsoft is spending more effort than ever on Linux, no doubt...

1 0

Microsoft SQL Server For Linux?
by Lawrence D'Oliveiro 07 Mar '16

07 Mar '16

From <http://arstechnica.com/information-technology/2016/03/sql-server-for-linux-…>: The announcement implies [one of] two things. Either there is a large number of Linux-using corporations out there that are desperate for SQL Server's feature set (as opposed to open source databases such as PostgreSQL, MySQL, or MaxDB, or the proprietary ones such as IBM's DB2 and, of course, Oracle's Oracle), or there is a large number of SQL Server-using organizations out there that are keen to ditch the cost of their Windows licenses but happy to continue to pay for their SQL Server licenses. Neither seems obvious to us. Nor to me...

1 0

Raspberry Pi 3
by William Mckee 02 Mar '16

02 Mar '16

Hello, Raspberry Pi 3 was just released. The highlights of the model: Raspberry Pi 3 - Model B Technical Specification Broadcom BCM2387 chipset 1.2GHz Quad-Core ARM Cortex-A53 802.11 bgn Wireless LAN and Bluetooth 4.1 (Bluetooth Classic and LE) 1GB RAM 64 Bit CPU I think I am most excited about the 64 Bit CPU. What's also amazing is they have kept the same price as the Raspberry Pi 2 - 35 pounds. I'm happy with my Raspberry Pi 2 setup but keen to pick one of these up (still can't get a zero). Blog post: https://www.raspberrypi.org/blog/raspberry-pi-3-on-sale/ cheers, William.

3 7

LibreSSL Unaffected By DROWN
by Peter Reutemann 02 Mar '16

02 Mar '16

"The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL." -- source: http://it.slashdot.org/story/16/03/02/1620221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SCO Is Undeniably, Reliably Dead
by Peter Reutemann 01 Mar '16

01 Mar '16

"On Friday, IBM and SCO filed an agreement with the US district court in Utah to accept a ruling of dismissal of the last remaining claims by SCO against IBM." -- source: http://yro.slashdot.org/story/16/03/01/154214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A Third of All HTTPS Websites Vulnerable To DROWN Attack
by Peter Reutemann 01 Mar '16

01 Mar '16

"The OpenSSL project has released versions 1.0.2g and 1.0.1s to address a high severity security issue known as the DROWN attack (CVE-2016-0800) which allows attackers to break HTTPS and steal encrypted information. In layman terms, the attack uses an improperly patched issue (from 1998) in SSL to attack websites using the more modern TLS protocol. Servers where admins use SSL and TLS are in danger. Additionally, servers where only TLS is used, but the admins are sharing the same certificate for other servers where they have SSL, are also vulnerable, since the attack targets RSA, employed in both SSL and TLS. The entire attack is also easy to carry out, costing only $440 on Amazon EC2." -- source: http://it.slashdot.org/story/16/03/01/1743237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pi used in FM radio transmitters in Syria
by Ian Young 01 Mar '16

01 Mar '16

Hope this is of some interest - not a Pi application I have heard about hitherto. http://www.bbc.com/news/technology-35690688

1 0

OpenShot 2.0 Beta Is Out
by Lawrence D'Oliveiro 29 Feb '16

29 Feb '16

Initial verdict on the results of the crowd-funded development: “The real winners here are Linux users who now have an editor that's on par with Apple's iMovie (even more powerful than recent versions of iMovie) and bears considerable resemblance to the industry-standard Final Cut Pro.” <http://www.theregister.co.uk/2016/02/29/openshot_2_review/>

2 1

Skype On Linux Is Broken
by Lawrence D'Oliveiro 26 Feb '16

26 Feb '16

Seems like the Linux version of Skype has lost the ability to connect with Skype on other platforms. <http://www.theregister.co.uk/2016/02/25/linux_skype_outage_outrage/>

1 0

Linux On Windows?
by Lawrence D'Oliveiro 25 Feb '16

25 Feb '16

Microsoft has abandoned its “Astoria” project to allow Android apps to run essentially unmodified on Windows. <http://arstechnica.com/information-technology/2016/02/microsoft-confirms-an…> Nevertheless, one interesting by-product of this effort remains: Tucked away inside the Windows 10 Insider Preview is a Linux-like operating system. The big question is what Microsoft is actually going to do with it.

1 0

Software Freedom Conservancy: Distributing Linux With ZFS Is Illegal
by Peter Reutemann 25 Feb '16

25 Feb '16

'Phoronix reports that Bradley M. Kuhn and Karen M. Sandler at the Software Freedom Conservancy (SFS) have posted a blog post today arguing that Canonical's plan to distribute Ubuntu 16.04 LTS "Xenial Xerus" with support for the ZFS file system violates the Linux kernel's GPLv2 license. On February 18, Dustin Kirkland at Canonical wrote on his blog: "We at Canonical have conducted a legal review, including discussion with the industry's leading software freedom legal counsel, of the licenses that apply to the Linux kernel and to ZFS. And in doing so, we have concluded that we are acting within the rights granted and in compliance with their terms of both of those licenses...The CDDL cannot apply to the Linux kernel because zfs.ko is a self-contained file system module — the kernel itself is quite obviously not a derivative work of this new file system. And zfs.ko, as a self-contained file system module, is clearly not a derivative work of the Linux kernel but rather quite obviously a derivative work of OpenZFS and OpenSolaris. Equivalent exceptions have existed for many years, for various other stand alone, self-contained, non-GPL kernel modules. Our conclusion is good for Ubuntu users, good for Linux, and good for all of free and open source software." The SFS's blog post of today states: "We are sympathetic to Canonical's frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL."' -- source: http://linux.slashdot.org/story/16/02/25/1846230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carnegie Mellon University Attacked Tor, Was Subpoenaed By Feds
by Peter Reutemann 25 Feb '16

25 Feb '16

'Back in November 2015 it was speculated that Carnegie Mellon University (CMU) helped the FBI attack the TOR network. Now, both the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases: "The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU") [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense ("DOD")," an order filed on Tuesday in the case of Brian Farrell reads. Between January and July 2014, a large number of malicious nodes operated on the Tor network, with the purpose, according to the Tor Project, of deanonymising dark web sites and their users. The attack relied on a set of vulnerabilities in the Tor software—which have since been patched—and according to one source, the technique could unmask new hidden services within two weeks.' -- source: http://yro.slashdot.org/story/16/02/25/172245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Hack Is an Indicator of a Larger Problem
by Peter Reutemann 25 Feb '16

25 Feb '16

"On February 20th, a hacker working under the handle 'Peace' took control of the website of Linux Mint, a popular Linux distribution derived from Ubuntu (and Debian) targeted toward non-technical users and power users unhappy with modern desktop environments. While these attacks are regrettable, and part of an infrastructure problem rather than a problem with the distribution itself, it increasingly appears that the Linux Mint team is spread too thin when it comes to security. The distribution itself blacklists updates that work perfectly in Ubuntu and Debian, and the graphical utilities don't update the kernel. Because the value added by Linux Mint is in Cinnamon, why do the developers need to distribute a broken version of Ubuntu when the Cinnamon DE could be distributed as an Ubuntu spin?" -- source: http://linux.slashdot.org/story/16/02/24/1924229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Virtual Ethernet Bug Delivers Corrupt TCP/IP Data
by Peter Reutemann 22 Feb '16

22 Feb '16

"Vijay Pandurangan from Twitter warns about a Linux kernel bug that causes containers using Virtual Ethernet devices for network routing to not check TCP checksums. Examples of software stacks that use Virtual Ethernet devices are Docker on IPv6, Kubernetes, Google Container Engine and Mesos. The kernel flaw results in applications incorrectly receiving corrupt data in a number of situations, such as with bad networking hardware. The bug dates back at least 3 years or more – it is present in kernels as far back as the Twitter engineering team has tested. Their patch has been reviewed and accepted into the kernel, and is currently being backported to -stable releases back to 3.14 in various distributions. If you use containers in your setup, Pandurangan recommends that you deploy a kernel with this patch." -- source: http://linux.slashdot.org/story/16/02/22/1715202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix image
by Ian Young 21 Feb '16

21 Feb '16

Hi Peter, Yes, I have the image thanks. ~ Ian Y

2 1

Timeline Of Events: Linux Mint Website Hack That Distributed Malicious ISOs
by Peter Reutemann 21 Feb '16

21 Feb '16

"The Linux Mint website was hacked last night and was pointing to malicious ISOs that contained an IRC bot known as TSUNAMI, used as part of an IRC DDoSing botnet. While the Linux Mint team says they were hacked via their WordPress site, security experts have discovered that their phpBB forum database was put up for sale on the Dark Web at around the same time of the hack. Also, it seems that after the Linux Mint team cleaned their website, the hackers reinfected it, which caused the developers to take it down altogether." -- source: http://linux.slashdot.org/story/16/02/21/1548228 Ouch... Maybe time to switch to a Nikola generated site... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

knoppix live install
by Ian Young 21 Feb '16

21 Feb '16

If there is some free time at Monday's meeting perhaps we could try an install of what i think is the latest Knoppix iso to USB, live as it happens. ~ Ian Y

2 1

World’s cheapest Android smartphone goes on sale for just $3.67
by Peter Reutemann 20 Feb '16

20 Feb '16

"An Android-based smartphone costing about the same as a cup of coffee has been launched today in India by the local company Ringing Bells. The Freedom 251 costs 251 rupees (about £2.50 or $4), comes with a one-year guarantee, and has surprisingly decent specifications, on paper at least. The phone's price is not subsidised by a carrier contract: it really costs £2.50." -- source: http://arstechnica.com/gadgets/2016/02/worlds-cheapest-android-smartphone-g… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

TP-Link Begins Lockdown of Firmware In Response To FCC
by Peter Reutemann 18 Feb '16

18 Feb '16

'In response to an FCC rule that requires manufacturers to lock down computing devices (routers, PCs, phones) to prevent modification if they have a "modular wireless radio," TP-Link has begun locking down its routers to prevent firmware not signed by TP-Link from being installed. This essentially prevents open source OSs (OpenWRT, for example) from being used on routers.' -- source: http://yro.slashdot.org/story/16/02/18/1423216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Stealing Keys From a Laptop In Another Room — and Offline
by Peter Reutemann 18 Feb '16

18 Feb '16

'Motherboard carries a report that with equipment valued at about $3,000, a group of Israeli researchers have been able to extract cryptographic keys from a laptop that is not only separated by a physical wall, but protected by an air gap. This, they say, "is the first time such an approach has been used specifically against elliptic curve cryptography running on a PC." From the article: The method is a so-called side-channel attack: an attack that doesn't tackle an encryption implementation head on, such as through brute force or by exploiting a weakness in the underlying algorithm, but through some other means. In this case, the attack relies on the electromagnetic outputs of the laptop that are emitted during the decryption process, which can then be used to work out the target's key. Specifically, the researchers obtained the private key from a laptop running GnuPG, a popular implementation of OpenPGP. (The developers of GnuPG have since released countermeasures to the method. Tromer said that the changes make GnuPG âoemore resistant to side-channel attack since the sequence of high-level arithmetic operations does not depend on the secret key.â)' -- source: http://it.slashdot.org/story/16/02/18/1626205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meet Linux's Little Brother Zephyr, a Tiny Open Source IoT RTOS
by Peter Reutemann 18 Feb '16

18 Feb '16

"The Linux Foundation has launched the Zephyr Project, to foster an open source, small footprint, modular, scalable, connected, real-time OS for IoT devices. The Zephyr Project's RTOS implements both a small footpoint microkernel and an even tinier nanokernel, and is the result of Wind River contributing its Rocket RTOS kernel to the Zephyr Project. (Wind's Rocket RTOS will now become a downstream commercial distribution based on Zephyr sources.) To get a sense of Zephyr's benefit, its nanokernel is said to be able to run in as little as 10KB of RAM on 32-bit microcontrollers, whereas a minimalistic Linux implementation like uClinux needs upwards of 200KB. The Linux Foundation hopes to see cross-project collaboration between the Zephyr and Linux communities. Technical details are at the Zephyr site." -- source: http://linux.slashdot.org/story/16/02/18/1522219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Magnitude of glibc Vulnerability Coming To Light
by Peter Reutemann 18 Feb '16

18 Feb '16

"The glibc vulnerability disclosed this week has some experts on edge because of how DNS can leveraged in exploits. Dan Kaminsky said that while man-in-the-middle attacks are one vector, it would appear that it's also possible to exploit the bug and attack most Linux servers via DNS caching-only servers. 'This would be substantially worse if it went through the caching ecosystem; 99 percent of attack vectors go through that system,' Kaminsky said. Glibc, or the GNU C library, is used by most flavors of Linux and also a number of popular web services and frameworks, giving attacks potentially massive horizontal scale. The major Linux distros have patched and pushed updates to servers; source code is also available for homegrown Linux builds." -- source: http://linux.slashdot.org/story/16/02/18/157239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Fwd: [SECURITY] [DSA 3481-1] glibc security update
by Peter Reutemann 18 Feb '16

18 Feb '16

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <blakjak(a)blakjak.net> Date: Thu, Feb 18, 2016 at 1:50 PM Subject: Re: [NZLUG] Fwd: [SECURITY] [DSA 3481-1] glibc security update To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> And just to illustrate that, CERT is compiling a list of vendor's position statements etc, it's quite a list already: https://www.kb.cert.org/vuls/id/457759 On 18/02/2016 1:49 p.m., Mark Foster wrote: This is a widespread risk to pretty much every linux based system out there. I hope you're all aware of this one and taking action to patch or protect your systems. -------- Forwarded Message -------- Subject: [SECURITY] [DSA 3481-1] glibc security update Resent-Date: Tue, 16 Feb 2016 14:18:54 +0000 (UTC) Resent-From: debian-security-announce(a)lists.debian.org Date: Tue, 16 Feb 2016 14:18:27 +0000 From: Salvatore Bonaccorso <carnil(a)debian.org> Reply-To: debian-security(a)lists.debian.org To: debian-security-announce(a)lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3481-1 security(a)debian.org https://www.debian.org/security/ Florian Weimer February 16, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : glibc CVE ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8778 CVE-2015-8779 Debian Bug : 812441 812445 812455 Several vulnerabilities have been fixed in the GNU C Library, glibc. The first vulnerability listed below is considered to have critical impact. CVE-2015-7547 The Google Security Team and Red Hat discovered that the glibc host name resolver function, getaddrinfo, when processing AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its internal buffers, leading to a stack-based buffer overflow and arbitrary code execution. This vulnerability affects most applications which perform host name resolution using getaddrinfo, including system services. CVE-2015-8776 Adam Nielsen discovered that if an invalid separated time value is passed to strftime, the strftime function could crash or leak information. Applications normally pass only valid time information to strftime; no affected applications are known. CVE-2015-8778 Szabolcs Nagy reported that the rarely-used hcreate and hcreate_r functions did not check the size argument properly, leading to a crash (denial of service) for certain arguments. No impacted applications are known at this time. CVE-2015-8779 The catopen function contains several unbound stack allocations (stack overflows), causing it the crash the process (denial of service). No applications where this issue has a security impact are currently known. While it is only necessary to ensure that all processes are not using the old glibc anymore, it is recommended to reboot the machines after applying the security upgrade. For the stable distribution (jessie), these problems have been fixed in version 2.19-18+deb8u3. For the unstable distribution (sid), these problems will be fixed in version 2.21-8. We recommend that you upgrade your glibc packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce(a)lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJWwy2KAAoJEAVMuPMTQ89EIIIP/1Sa7Mlc0xJ0b4v5QFf1UL1N zLPxw/JXbExR1sX9RUt8mCzdOoz5rcwaR8yyvGZS0A+NwtSgLr3sNKweMrrf3yaH Ul7vziRfgcNjnWdN5+aeHp+lIUEIgCbT6JJVqt/lfXO8/vo23V2EZKVTtnNt7oR6 FmhSW73+jt8v9qxdHVDhE0ivXhs7Neeo7oLfolAX9n+ZFjRhT68ERRTyPaq3dnfS PdDLdnn5V+g+3y9zjurGNvmSp7OcOq7aKclEFtQBoEF6ZFmqhUYkuOmAkhlQlMMX nJGqZYrY2pgz1pHZZXJGY31WIYDaYR0cSIoe/c49ejT+Kug9IMLBMruvwAglX+gd IAFflJ8Iar9StiPwMz3HloLbNT1vVCvlvdbEJiMrgpTMRUyacG6GfHVid2tso+n7 ZpWnxI2B62lwJU/Jq2yxRkIVtGs9go7lvGEmUs/T4Pl87otULBAfGD0xXtt2vY+A hrEbjCgNMrbrjiCdm/w2MW+hLwiXgRn617Q7w9e5gWnSjIEpybrrwKAR1QsDxxNM zwjgwQdTEivJ5dtXQdwkHg+2ba1/gqKqMU9b0rlBf/YF0e73I/FTaDu1nEgOX4En kq6ZwrPBlptv0kCR0EtyX6xmt4Q3j8tF1IwPyEwfiyPKcN0cxuk7LLILc7ewPnGU pPKkk9EqhPWAP7+Ufo9p =lzjt -----END PGP SIGNATURE----- _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS distro for regular PCs can now dual-boot with Windows
by Peter Reutemann 18 Feb '16

18 Feb '16

"Today, Neverware announced a new version of CloudReady aimed at schools and individuals who want to try the software on their PCs without losing the capability to run Windows. CloudReady version 45.3 can be installed on any system with an existing UEFI-mode installation of Windows 7, 8, or 10 and 32GB of free disk space. You can find detailed installation directions on Neverware's site." -- source: http://arstechnica.com/gadgets/2016/02/chrome-os-distro-for-regular-pcs-can… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Being Ordered To Help Break Into San Bernardino Shooter’s Phone
by Lawrence D'Oliveiro 17 Feb '16

17 Feb '16

It is being widely reported in the news that a judge has told Apple to give investigators access to encrypted data on an Iphone belonging to one of the perpetrators in the San Bernardino shooting case. Current versions of IOS do not allow Apple to break this encryption. However, it seems Apple is actually being asked to help bypass the feature that autowipes the phone after 10 failed attempts to enter the decryption key, thereby allowing the key to be broken by brute force. This feature is supposed to be under the control of the owner of the phone, not Apple. But what Apple can give, it can take away. It may be possible that Apple could load a software update (perhaps a temporary one) into the phone to override control of this feature. <https://www.techdirt.com/articles/20160216/17393733617/no-judge-did-not-jus… backdoor.shtml>

2 2

Backblaze Report On Hard Drive Failures In 2015
by Lawrence D'Oliveiro 17 Feb '16

17 Feb '16

Backblaze has posted another report on the reliability of their hard drives <https://www.backblaze.com/blog/hard-drive-reliability-q4-2015/>. As pointed out in the Ars Technica analysis <http://arstechnica.com/information-technology/2016/02/hgst-hard-disks-still…>, HGST is owned by WD, so WD is simultaneously responsible for the most and least reliable brands of drives in the report. An overall statistic of 6% failure rate per year seems a reasonable conclusion. Also it seems like 3-4TB is still the sweet spot.

1 0

WLUG meeting next Monday
by Peter Reutemann 17 Feb '16

17 Feb '16

Hi everyone We have a meeting coming up next Monday: "Peter Reutemann will demo Alpine Linux, a security-oriented, lightweight Linux distribution based on musl libc and busybox. Discussion of March meeting: potential introduction to git version control, in conjunction with CS^3 student society from Computer Science. Discussion of meetup.com's new pricing strategy: going up from USD 12 per 6 months to USD 29.94 per 6 months. Feel like demoing another distro? Or some other great open-source tool (doesn't necessarily have to be Linux)? Then let me know." http://www.meetup.com/WaikatoLinuxUsersGroup/events/228718557/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

New Warnings In GCC 6
by Lawrence D'Oliveiro 16 Feb '16

16 Feb '16

Couple of interesting blog posts <https://gnu.wildebeest.org/blog/mjw/2016/02/15/looking-forward-to-gcc6-many…>, <https://gnu.wildebeest.org/blog/mjw/2016/01/09/looking-forward-to-gcc6-nice…> about new dubious-looking constructs that the GCC 6 C and C++ compilers can pick up. I particularly like the latter, which warns against a situation like the following: if (cond) statement_guarded_by_cond; statement_not_guarded_by_cond; /* though it may look like it is */ Of course, this only works in a language that allows the redundancy of having both bracketing symbols and indentation. This is why trying to get rid of one, and having the other do duty for both--is such a bad idea.

2 2

UEFI aka Ooof!!y links - more than a lifetime to know
by Ian Young 13 Feb '16

13 Feb '16

Following a recent refererence to the dread Oofy at a LUG meeting and after looking at a couple of Intel PC type machines using this boot method I am pretty well totally baffled. The people of Arch however know it all. Or as much as can be known. https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface#… I seem to have a vague recollection that Sun once used Ooofy. And Apple of course was an early adopter. Or am I thinking of Open Firmware? Somewhat related. Hmmm. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface https://en.wikipedia.org/wiki/Open_Firmware

1 0

The Truth Behind “true”
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

Among the many useful commands you will find as standard on any POSIX system is “true”. This command does absolutely nothing, but returns a successful exit status. (There is also “false”, which also does nothing, but always returns a failure status. If anyone is curious as to how you would make use of these in shell scripts, just ask.) This page <http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html> gives the history of the “true” command from the original AT&T Unix--it was essentially a shell script that did absolutely nothing at all. Yet AT&T claimed copyright on it. This article <http://www.theregister.co.uk/2016/02/10/line_break_ep2/> includes, among its examples of supposedly bad code, the full source of the GNU “true” program (which actually also shares its source with the “false” program), which runs to 80 lines, as compared to the version from OpenBSD, which is just four lines (including a blank line and comments). But as pointed out in the previous link, the GNU version uses less memory and runs faster.

2 1

San Francisco To Open-Source Its Voting Software
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

The San Francisco Elections Commission has resolved to “support the development and certification of an open source voting system running on commercial off-the-shelf hardware; and to request that the Mayor and Board of Supervisors initiate and fund a project to develop and certify such a system for use in San Francisco”. <http://www.theregister.co.uk/2016/02/10/san_francisco_to_open_source_voting…> Contrast this with ongoing unsuccessful attempts to get access to the software used for Australian federal elections under its Freedom Of Information Act <http://www.theregister.co.uk/2015/12/13/aec_easycount_foi_decision/>: [Hobart lawyer Michael] Cordover sought the source code because Australia's 2013 election produced some irregularities. What software do we use in NZ?

2 1

Docker Images To Be Based On Alpine Linux
by Peter Reutemann 07 Feb '16

07 Feb '16

"Docker container sizes continue a race to the bottom with a couple of environments weighing in at less than 10MB. Following on the heels of this week's story regarding small images based on Alpine Linux, it appears that the official Docker images will be moving from Debian/Ubuntu to Alpine Linux in the near future. How low will they go?" -- source: http://linux.slashdot.org/story/16/02/06/0433228 Alpine Linux is rather small, coming in at 82MB as ISO download: http://www.alpinelinux.org/ Anybody feel like giving a demo at the next meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Pioneer Michael Tiemann On the Myth of the Average
by Peter Reutemann 03 Feb '16

03 Feb '16

'In a recent article, Michael Tiemann, one of the world's first open source entrepreneurs and VP of Open Source Affairs at Red Hat, highlights an example from the 1950s US Air Force where the "myth of the average resulted in a generation of planes that almost no pilots could reliably fly, and which killed as many as 17 pilots in a single day." He uses this example to argue that IT leaders who think that playing it safe means being as average as possible in order to avoid risks (i.e. "Buy what others are buying. Deploy what others are deploying. Manage what others are managing.") may be making IT procurement and strategy decisions based on flawed data. Instead, Tiemann says that IT leaders should understand elements of differentiation that are most valuable, and then adopt the standards that exploit them. "Don't aim for average: it may not exist. Aim for optimal, and use the power of open source to achieve what uniquely benefits your organization."' -- source: http://it.slashdot.org/story/16/02/03/177233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New Hack Shrinks Docker Containers
by Peter Reutemann 03 Feb '16

03 Feb '16

'Promising "uber tiny Docker images for all the things," Iron.io has released a new library of base images for every major language optimized to be as small as possible by using only the required OS libraries and language dependencies. "By streamlining the cruft that is attached to the node images and installing only the essentials, they reduced the image from 644 MB to 29MB,"explains one technology reporter, noting this makes it quicker to download and distribute the image, and also more secure. "Less code/less programs in the container means less attack surface..." writes Travis Reeder, the co-founder of Iron.io, in a post on the company's blog. "Most people who start using Docker will use Docker's official repositories for their language of choice, but unfortunately if you use them, you'll end up with images the size of the Empire State Building..."' -- source: http://developers.slashdot.org/story/16/02/03/221231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromodo Browser Disables Key Web Security
by Peter Reutemann 03 Feb '16

03 Feb '16

"A Google Security Research update has claimed that Comodo's internet browser Chromodo, based on the open-source project Chromium, contains significant security failings and puts its users at risk. This week's Google alert suggested that the Chromodo browser – available as a standalone download, as well as part of the company's Security package – is less secure than it promises. According to analysis, the browser is disabling the Same Origin policy, hijacking DNS settings, and replacing shortcuts with Chromodo links, among other security violations." -- source: http://it.slashdot.org/story/16/02/03/1416236 NB: I know that the browser is for Windows, but you might know someone who's using it, blindly trusting the marketing of Comodo. Chromium builds are available here: https://www.chromium.org/getting-involved/dev-channel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Crypto flaw was so glaring it may be intentional eavesdropping backdoor
by Peter Reutemann 03 Feb '16

03 Feb '16

"Socat is a more feature-rich variant of the once widely used Netcat networking service for fixing bugs in network applications and for finding and exploiting security vulnerabilities. One of its features allows data to be transmitted through an encrypted channel to prevent it from being intercepted by people monitoring the traffic. Amazingly, when using the Diffie-Hellman method to establish a cryptographic key, Socat used a non-prime parameter to negotiate the key, an omission that violates one of the most basic cryptographic principles." -- source: http://arstechnica.com/security/2016/02/crypto-flaw-was-so-glaring-it-may-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fwd: [NZOSS OpenChat] TPPA appears to compromise NZ data sovereignty
by Peter Reutemann 02 Feb '16

02 Feb '16

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Dave Lane <president(a)nzoss.org.nz> Date: Wed, Feb 3, 2016 at 10:22 AM Subject: [NZOSS OpenChat] TPPA appears to compromise NZ data sovereignty To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi all, Thanks to Grant Paton-Simpson for bringing clause 14.13.2 of the Trans-Pacific Partnership Agreement to my attention... I've just written a quick post to explain the potential implications of it, as I see it: https://nzoss.org.nz/content/tppa-compromises-nz-data-sovereignty Any comments or corrections (or alternative interpretations) to the article would be appreciated. If you think it is a cause for concern, I encourage you to promote it, particularly among those who will understand the implications. The TPPA is slated for signing tomorrow. We need to make a BIG stink about this very unfortunate turn of events. Cheers, Dave -- Dave Lane, President, New Zealand Open Source Society e: president(a)nzoss.org.nz m: 021 229 8147 w: http://nzoss.org.nz ―― View topic http://groups.nzoss.org.nz/r/topic/7bw4I2juaLBbCQycHlZriA Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The State Of Blender: “The Art Of Open Source”
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

An article <https://www.blender.org/media-exposure/the-art-of-open-source/> written for the November 2015 issue of “Linux Format” magazine covers the origins and increasing popularity of Blender. But more than popularity, it seems it is now (somewhat grudgingly) winning actual respect among 3D artists. Pixar even lists Blender as one of the packages it officially supports in the latest release of RenderMan. My main beef with the article is the writer keeps saying “commercial” when he means “proprietary”, seemingly reserving the use of “proprietary” for when he means “in-house”. If you don’t think Blender can be “commercial”, just look at some of its users mentioned in the article. A quote from one of those users: “In 10 years of using proprietary 3D software, we never received usable support from either software vendor or reseller – except on problems with registering our licences.”

1 0

Classic Linux Joke Even Less Funny Than Previously Thought
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

On some UEFI-based systems, the old “rm -rf /” trick for destroying your system may do more than annihilate your software installation, it may also brick your machine. This is because it is possible to mount a virtual kernel filesystem that gives access to persistent UEFI configuration data read/write, and deleting this data makes it impossible for your machine to boot. <http://www.theregister.co.uk/2016/02/02/delete_efivars_linux/>

1 0

Towards A Ten-Million-Core Supercomputer
by Lawrence D'Oliveiro 02 Feb '16

02 Feb '16

Europe’s ExaNeSt project is putting together a small prototype of what will eventually be a supercomputer with 10 million ARM cores. Why ARM? Because the performance bottleneck in a super is not the CPUs, but the interconnect between them. So it makes sense to use more power-efficient cores to keep the overall cost down. The main cost of running a super, or indeed any massively-multiprocessor installation (data centre, cloud service, render farm etc) is the electricity bill. <http://www.theregister.co.uk/2016/02/02/buddy_can_you_spare_ten_meeelion_ar…>

1 0

Using IPv6 with Linux? You’ve likely been visited by Shodan and other scanners
by Peter Reutemann 02 Feb '16

02 Feb '16

"One of the benefits of the next-generation Internet protocol known as IPv6 is the enhanced privacy it offers over its IPv4 predecessor. With a staggering 2128 (or about 3.4×1038) theoretical addresses available, its IP pool is immune to the types of systematic scans that criminal hackers and researchers routinely perform to locate vulnerable devices and networks with IPv4 addresses. What's more, IPv6 addresses can contain regularly changing, partially randomized extensions. Together, the IPv6 features cloak devices in a quasi anonymity that's not possible with IPv4. Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity. By setting up an IPv6-based network time protocol service most Internet-connected devices rely on to keep their internal clocks accurate, the operators can harvest huge numbers of IPv6 addresses that would otherwise remain unknown. The server operators can then scan hundreds or thousands of ports attached to each address to identify publicly available surveillance cameras, unpatched servers, and similar vulnerabilities." -- source: http://arstechnica.com/security/2016/02/using-ipv6-with-linux-youve-likely-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Bloat: How and Why UNIX Grew Up (and Out)
by Lawrence D'Oliveiro 31 Jan '16

31 Jan '16

The original versions of common utilities like “cat”, “grep” and “ls” on V6 Unix from 1976 could measure their disk and RAM usage in bytes in just five figures. A few decades later, and the corresponding programs on a modern Linux distro are orders of magnitude larger. Why? Here is a detailed (and technical) analysis from the 2012 Linux.conf.au <https://www.youtube.com/watch?v=Nbv9L-WIu0s> which takes you step by step through all the contributions to the difference. They isolated most of these by modifying the code, selectively taking out features, and building it in different ways. Conclusion: you may call it “bloat”, but if you want a modern system, it’s pretty much unavoidable.

1 0

High-severity bug in OpenSSL allows attackers to decrypt HTTPS traffic
by Peter Reutemann 28 Jan '16

28 Jan '16

"Maintainers of the OpenSSL cryptographic code library have fixed a high-severity vulnerability that made it possible for attackers to obtain the key that decrypts communications secured in HTTPS and other transport layer security channels. While the potential impact is high, the vulnerability can be exploited only when a variety of conditions are met. First, it's present only in OpenSSL version 1.0.2. Applications that rely on it must use groups based on the digital signature algorithm to generate ephemeral keys based on the Diffie Hellman key exchange. By default, servers that do this will reuse the same private Diffie-Hellman exponent for the life of the server process, and that makes them vulnerable to the key-recovery attack. DSA-based Diffie-Hellman configurations that rely on a static Diffie-Hellman ciphersuite are also susceptible." -- source: http://arstechnica.com/security/2016/01/high-severity-bug-in-openssl-allows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What’s The Cheapest Wi-Fi Access Point?
by Lawrence D'Oliveiro 27 Jan '16

27 Jan '16

Someone has hacked a cheapie wireless SD card reader to turn it into a wi-fi access point running OpenWRT: <http://phoronix.com/scan.php?page=news_item&px=Zsun-WiFI-With-OpenWRT>. The most obvious thing it lacks is any kind of wired network port...

1 0

Material for Monday's meeting
by Peter Reutemann 26 Jan '16

26 Jan '16

Hi everyone The material from Monday's meeting is now available from our github account: https://github.com/WLUG/meetings/tree/master/2016/2016-01-25 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.5 Adds Raspberry Pi 2 Support, AMD GPU Re-Clocking, Intel Kaby Lake
by Peter Reutemann 24 Jan '16

24 Jan '16

"Linux 4.5 is set to bring many new features across the kernel's 20 million line code-base. Among the new/improved features are Raspberry Pi 2 support, open-source Raspberry Pi 3D support, NVIDIA Tegra X1 / Jetson TX1 support, an open-source Vivante graphics driver, AMDGPU PowerPlay/re-clocking support, Intel Kaby Lake enablement, a Logitech racing wheel driver, improvements for handling suspended USB devices, new F2FS file-system features, and better Xbox One controller handling." -- source: http://linux.slashdot.org/story/16/01/24/1329206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Atom-Based JaguarBoard To Take On Raspberry Pi
by Peter Reutemann 24 Jan '16

24 Jan '16

"The tiny single-board PC movement that's leading the Internet of Things (IoT) market is largely dominated by ARM-based processors, and for good reason — they're cheap, low power and capable. However, what if you prefer to work with the x86 architecture? JaguarBoard looks strikingly similar to Raspberry Pi, which is arguably the most popular single-board mini PC. But unlike Raspberry Pi, JaguarBoard allows users to develop for x86, courtesy of its Intel Atom Z3735G (Bay Trail) foundation. The chip is a quad-core part clocked at 1.33GHz to 1.83GHz with 2MB of L2 cache, offering a fair amount of horsepower for IoT applications. In addition to an Atom processor, JaguarBoard also boasts 1GB of DDR3L memory, 16GB of eMMC storage, three USB 2.0 ports, 10/100M LAN port, HDMI 1.4 output, SDIO 3.0 socket, two COM ports, four GPIO pins, and audio ports. It's an interesting device that you could use strictly as a mini PC for general purpose computing, as an embedded system, a learning or research tool, or for whatever DIY projects you can conjure up." -- source: http://hardware.slashdot.org/story/16/01/24/1729241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Searching For Vulnerable Webcams
by Lawrence D'Oliveiro 23 Jan '16

23 Jan '16

Customers don’t understand and don’t care about the security of the devices they put online. And vendors are in no hurry to enlighten them, if it adds to costs and cuts profits. If anybody is in a position to intervene, it has to be a Government authority. <http://arstechnica.com/security/2016/01/how-to-search-the-internet-of-thing…>

1 0

Linux Filesystems On Windows
by Lawrence D'Oliveiro 22 Jan '16

22 Jan '16

Came across this <http://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/8468…> rather informative posting about different filesystems for cross-platform use. One interesting possibility is UDF (“Universal Disk Format”), which is how DVDs are usually formatted. It turns out it is useful not just for read-only media but read/write as well. There is widespread built-in support for it on Linux, OS X and Windows, albeit with some limitations in the proprietary OSes (as usual). It can even work on flash drives, though there may be some issues with the hardware layout being optimized for FAT32 or other antiquated filesystems. Alternatively, the article mentions a number of choices for accessing Linux filesystems on Windows: <http://www.fs-driver.org/> <http://uranus.chrysocome.net/linux/ext2ifs.htm> <http://www.diskinternals.com/linux-reader/> <http://www.chrysocome.net/virtualvolumes> Disclaimer: I haven’t tried any of these.

1 0

Command-Line Options For CUPS
by Lawrence D'Oliveiro 20 Jan '16

20 Jan '16

I was looking for some options to tweak scaling and positioning of images printed with the CUPS “lp” command. This page <http://www.cups.org/documentation.php/doc-1.5/options.html> lists various keywords that can be used with the “-o” option, in particular “natural-scaling”, “ppi” and “position”. You’ll notice that section has a large banner at the top saying “Not Supported on Mac OS X”. Which is slightly ironic, given that CUPS is owned by Apple. Anyway, the description of those options has disappeared from versions of that page for CUPS 1.6 and later, e.g. <http://www.cups.org/documentation.php/doc-1.6/options.html>, <http://www.cups.org/documentation.php/doc-2.1/options.html>. This even though I have CUPS 2.1.2 on my system, and the “position” option, for example, does seem to do something.

1 0

Tracking Protection In Wi-Fi Networks Coming Soon To Linux
by Peter Reutemann 19 Jan '16

19 Jan '16

'Fedora contributor and NetworkManager developer Lubomir Rintel explains how your devices are being identified on a network by a unique number that most of us know by the name of MAC address. Same goes for mobile networking, as your laptop's or mobile phone's MAC address is, in most cases, broadcasted everywhere you go before you even attempt a connection to a wireless network. And that's a problem for your privacy. The solution? Randomization of the MAC address while scanning for Wi-Fi networks. Apple is already using this method on iOS 8 and later mobile operating systems, and so is Microsoft in Windows 10, so Linux users will ["likely"] get it in the upcoming NetworkManager 1.2 release.' -- source: http://tech.slashdot.org/story/16/01/19/1345210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1