- wlug - list.wlug.org.nz

LastPass: Notice of Recent Security Incident
by Peter Reutemann 01 Dec '22

01 Dec '22

'We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional.' -- source: https://blog.lastpass.com/2022/11/notice-of-recent-security-incident/ -- via: https://infosec.exchange/@dennisf/109434660011163159 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Used thin client PCs are an unsexy, readily available Raspberry Pi alternative
by Peter Reutemann 30 Nov '22

30 Nov '22

'"Raspberry Pi boards are hard to get, probably also next year," says Andreas Spiess, single-board enthusiast and YouTuber, in his distinctive Swiss accent. He's not wrong. Spiess says he and his fellow Pi devotees need "a strategy to survive" without new boards, so he suggests looking in one of the least captivating, most overlooked areas of computing: used, corporate-minded thin client PCs. Spiess' Pi replacements, suggested and refined by many of his YouTube commenters and Patreon subscribers, are Fujitsu Futros, Lenovo ThinkCentres, and other small systems (some or all of which could be semantically considered "thick clients" or simply "mini PCs," depending on your tastes and retro-grouch sensibilities). They're the kind of systems you can easily find used on eBay, refurbished on Amazon Renewed, or through other enterprise and IT asset disposition sources. They're typically in good shape, given their use and environment. And compared to single-board enthusiast systems, many more are being made and replaced each year.' -- source: https://arstechnica.com/gadgets/2022/11/used-thin-client-pcs-are-an-unsexy-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Anker's Eufy Cameras Caught Uploading Content To the Cloud Without User Consent
by Peter Reutemann 30 Nov '22

30 Nov '22

'Anker's popular Eufy-branded security cameras appear to be sending some data to the cloud, even when cloud storage is disabled and local only storage settings are turned on. MacRumors reports: The information comes from security consultant Paul Moore, who last week published a video outlining the issue. According to Moore, he purchased a Eufy Doorbell Dual, which was meant to be a device that stored video recording on device. He found that Eufy is uploading thumbnail images of faces and user information to its cloud service when cloud functionality is not enabled. Moore demonstrates the unauthorized cloud uploading by allowing his camera to capture his image and turning off the Eufy HomeBase. The website is still able to access the content through cloud integration, though he had not signed up for cloud service, and it remains accessible even when the footage is removed from the Eufy app. It's important to note that Eufy does not appear to be automatically uploading full streaming video to the cloud, but rather taking captures of the video as thumbnails. The thumbnails are used in the Eufy app to activate streaming video from the Eufy base station, allowing Eufy users to watch their videos when away from home, as well as for sending rich notifications. The problem is the thumbnails are uploaded to the cloud automatically even when the cloud functionality is not active, and Eufy also seems to be using facial recognition on the uploads. Some users have taken issue with the unauthorized cloud uploads because Eufy advertises local-only service and has been popular among those who want a more private camera solution. "No Clouds or Costs," reads the Eufy website. Moore suggests that Eufy is also able to link facial recognition data collected from two separate cameras and two separate apps to users, all without camera owners being aware. Moore received a response from Eufy in which Eufy confirmed that it is uploading event lists and thumbnails to AWS, but said the data is not able to "leak to the public" because the URL is restricted, time limited, and requires account login. There is also another issue that Moore has highlighted, suggesting Eufy camera streams can be watched live using an app like VLC, but little information on the exploit is available at this time. Moore said that unencrypted Eufy camera content can be accessed without authentication, which is alarming for Eufy users. There's a dedicated Reddit thread where other Eufy users are reporting the same thing happening.' -- source: https://yro.slashdot.org/story/22/11/29/2148250 Eufy products are for sale here in NZ as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's New Chip Moves AWS Into High-Performance Computing
by Peter Reutemann 30 Nov '22

30 Nov '22

'Amazon's cloud-computing unit is rolling out new chips designed to power the highest-end of computing, supporting tasks such as weather forecasting and gene sequencing. From a report: Amazon Web Services, the largest provider of over-the-internet computing, on Monday said it would let customers rent computing power that relies on a new version of its Graviton chips. Peter DeSantis, a senior vice president who oversees most of AWS's engineering teams, said in an interview that the product is a springboard for making what the industry calls high-performance computing more readily available. The newest chip is the latest piece of Amazon's effort to build more of the hardware that fills the massive data centers that power AWS. Amazon says making its own chips will give customers more cost-effective computing power than they could get by renting time on processors built by the likes of Intel Corp., Nvidia Corp. or Advanced Micro Devices. The move has put AWS in direct competition with those companies, which are also among its biggest suppliers. DeSantis said the chipmakers remain "great partners," and that AWS plans to continue to offer high-performance computing services based on chips made by other companies. On Tuesday, AWS Chief Executive Officer Adam Selipsky announced a new version of the Inferentia chip, which is designed to draw inferences from vast amounts of data. Inferentia2 is built to handle bigger sets of data than its predecessor, enabling things like software-generated images or detecting and interpreting human speech, Amazon said. [...] The latest version of AWS's line of Graviton processors, the Graviton3E, will have twice the ability of current versions in one type of calculations needed by high-performance computers, DeSantis said. When combined with other AWS technology, the new offering will be 20% better than the previous one. Amazon didn't say when services based on the new chip would be available' -- source: https://tech.slashdot.org/story/22/11/29/192229 According to this site, the Graviton2 chip is supported by several Linux distros (specific kernel flags?): https://aws.amazon.com/ec2/graviton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP Fred “Mythical Man-Month” Brooks
by Lawrence D'Oliveiro 29 Nov '22

29 Nov '22

“The Mythical Man-Month” was a classic book on the nature of computer programming, written by Fred Brooks after (among other things) his experience heading up the OS/360 project back in the 1960s. The man himself has now passed away at the age of 91 <https://www.theregister.com/2022/11/28/fred_mythical_man_month_brooks/>. OS/360 was the most ambitious of several operating systems developed by IBM for its System/360 line of computers. It provided conclusive proof that, if a project was running late, adding more people to work on it could actually make things worse. I have a copy of the 25th-Anniversary edition of the book, which includes his “No Silver Bullet” essay and also a detailed retrospective on how the original text stood up (or not) to the state of the programming art in the 1990s.

1 0

Linux Kernel Gets More Infrastructure for Rust, Increasing Interest in the Language
by Peter Reutemann 28 Nov '22

28 Nov '22

'Linux 6.1 (released last month) included what Linus Torvalds described as "initial Rust scaffolding," remembers this update from SD Times But now, "work has already been done since the 6.1 release to add more infrastructure for Rust in the kernel, though still none of the code interacts with any C code." And there's still no actual Rust code in Linux: "You need to get all those things that can make sure that Rust can compile, and you can do the debugging and all these things," explained Joel Marcey, director of advocacy and operations for the Rust Foundation, "and make sure that the memory safety is there and all that sort of stuff. And that has to happen first before you can actually write any real code in Rust for the Linux kernel itself." Marcey explained that Linux is going to be doing this inclusion very piecemeal, with lots of little integrations here and there over time so they can see how it is working. "I would imagine that over the next year, you're going to see more small incremental changes to the kernel with Rust, but as people are seeing that it's actually kind of working out, you'll be able to maybe, for example, write Linux drivers or whatever with Rust," said Marcey.... According to Bec Rumbul, executive director of the Rust Foundation, Rust being added to the kernel is an "enormous vote of confidence in the Rust programming language." She explained that in the past other languages have been planned to make it into the kernel and ended up not getting put in. "I think having someone with the kind of intellectual gravity of Linus Torvalds saying 'No, it's going in there,' that kind of says an awful lot about how reliable Rust already is and how much potential there is for the future as well," she said. Rumbul believes that there will be an increased interest in the language, which is still relatively new (It first made its debut in 2010) compared to some of the other languages out there to choose from. "I suspect that because Rust is now in the kernel, and it's just being talked about much ... more widely, that it will seem like an attractive prospect to a lot of people that are looking to develop their skills and their knowledge," she said. Rumbul hopes people will also be inspired to participate in the language as contributors and maintainers, because those are some of the less popular roles within open source, but are extremely critical to the health of a language, she explained. The Rust Foundation also launched a new security team in September to ensure best practices (including a dedicated security engineer). Their first initiative will be a security audit and threat modeling exercises. "We want to basically shore up," Rust operations director Marcey tells SD Times, "to ensure that Rust itself is actually as secure as we always say it is." In this year's Stack Overflow Developer Survey, 86.73% of developers said they love Rust.' -- source: https://developers.slashdot.org/story/22/11/27/1853228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Nov '22

28 Nov '22

Hi everyone We have a hybrid meeting next Monday with the following topic: 'Gnome, MATE, Cinnamon and KDE are the most common window managers for Linux desktops. But what about the lesser known ones? There are plenty of compositing, stacking or tiling window managers out there. Let's have a look at some (https://en.wikipedia.org/wiki/Comparison_of_X_window_managers) Maybe you'll find the one that you have been looking for all those years?' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776741/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Human Rights Commissioner Wants To See Regulation, Not Bans On Disinformation
by Lawrence D'Oliveiro 26 Nov '22

26 Nov '22

Paul Hunt, our Chief Human Rights Commissioner is not so keen on Justice Minister Kiri Allan’s proposals on hate speech legislation, saying “We do need controls, we do need checks, we do need independent accountability but not rendering the information unlawful, unless it reaches that far end of the spectrum.” according to <https://www.nzherald.co.nz/nz/politics/disinformation-should-be-regulated-b…>. Internal Affairs Minister Jan Tinetti has been looking at how Finland has had some success in keeping its young people aware of misinformation and disinformation online, to see if something similar could be done here.

1 0

Google Says Google and Other Android Manufacturers Haven't Patched Security Flaws
by Peter Reutemann 25 Nov '22

25 Nov '22

'Google has disclosed several security flaws for phones that have Mali GPUs, such as those with Exynos chipsets. From a report: The company's Project Zero team says it flagged the problems to ARM (which produces the GPUs) back in the summer. ARM resolved the issues on its end in July and August. However, smartphone manufacturers including Samsung, Xiaomi, Oppo and Google itself hadn't deployed patches to fix the vulnerabilities as of earlier this week, Project Zero said. Researchers identified five new issues in June and July and promptly flagged them to ARM. "One of these issues led to kernel memory corruption, one led to physical memory addresses being disclosed to userspace and the remaining three led to a physical page use-after-free condition," Project Zero's Ian Beer wrote in a blog post. "These would enable an attacker to continue to read and write physical pages after they had been returned to the system." Beer noted that it would be possible for a hacker to gain full access to a system as they'd be able to bypass the permissions model on Android and gain "broad access" to a user's data. The attacker could do so by forcing the kernel to reuse the afore-mentioned physical pages as page tables.' -- source: https://tech.slashdot.org/story/22/11/24/218212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DSA Slowly Going Away
by Lawrence D'Oliveiro 24 Nov '22

24 Nov '22

I notice that the new version of OpenSSH in Debian Unstable is taking another step toward dropping support for the DSA algorithm for key generation. I can remember back when DSA was introduced as an alternative to RSA. Unlike RSA, which is an encryption algorithm that can also be used for digital signatures, DSA was deliberately designed to be usable for signatures but not for encryption. This was back in the day when the US Government was still restricting exports of strong encryption products. Not long after that, I remember a research paper being published showing that DSA could in fact be used as an encryption algorithm. It wasn’t particularly efficient or even very practical, but it could theoretically be done. There was a time, in fact, when DSA was actually being preferred to RSA for generating SSH keys. Just checking the ssh-keygen man page, and the current default is RSA.

1 0

Windows Subsystem for Linux with GUI apps launches for Windows 10
by Peter Reutemann 24 Nov '22

24 Nov '22

'The Windows Subsystem for Linux (WSL), one of the best reasons to run Windows 11, is now available to Windows 10 users, in the latest version and with all its features. WSL dropped its "preview" label with this 1.0 release, and aims to simplify its installation from here on out. Getting the best version of WSL used to mean installing big, system-level Windows updates (including 11 itself). As part of its broader moving of key apps into its Store, Microsoft now offers the most feature-rich version of WSL there. "The in-Windows version of WSL will still receive critical bug fixes, but the Store version of WSL is where new features and functionality will be added," Windows Developer Platform Program Manager Craig Loewen noted in a blog post. Loewen noted that the "WSL community's requests" drove Microsoft to make the latest, GUI-ready framework version available to Windows 10 users. Now a Store installation is the default, even if you use the command line (PowerShell) to install and update WSL. Now anyone whose system is capable of running WSL has access to graphical apps and (optional) systemd support, and can hopefully spend less time wondering which WSL version they have, what they need, and what the differences are.' -- source: https://arstechnica.com/gadgets/2022/11/windows-subsystem-for-linux-with-gu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network-crashing leap seconds to be abandoned by 2035, for at least a century
by Peter Reutemann 23 Nov '22

23 Nov '22

'There are not many things you can get Facebook, Google, the United States, France, and Linus Torvalds to agree on, but one of them has come to pass. A near-unanimous vote on Friday in Versailles, France, by parties to the International Bureau of Weights and Measures (BIPM in its native French) on Resolution 4 means that starting in 2035, the leap second, the remarkably complicated way of aligning the Earth's inconsistent rotation with atomic-precision timekeeping, will see its use discontinued. Coordinated Universal Time, or UTC, will run without them until 2135. It was unclear whether any leap seconds might occur before then, though it seems unlikely. The assumption is that within those 100 years, time-focused scientists (metrologists) will have found a way to synchronize time as measured by humans to time as experienced by our planet orbiting the Sun. But most people will not notice any difference at all, even as the time difference could reach up to one minute by the end of that 100 years.' -- source: https://arstechnica.com/science/2022/11/network-crashing-leap-seconds-to-be… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Tumblr To Add Support For ActivityPub, the Social Protocol Powering Mastodon and Other Apps
by Peter Reutemann 22 Nov '22

22 Nov '22

'TechCrunch: Tumblr will add support for ActivityPub, the open, decentralized social networking protocol that's today powering social networking software like Twitter alternative Mastodon, the Instagram-like Pixelfed, video streaming service PeerTube, and others. The news was revealed in a response to a Twitter user's complaint about Mastodon's complexities. Automattic CEO Matt Mullenweg -- whose company acquired Tumblr from Verizon in 2019 -- suggested the user "come to Tumblr" as the site would soon "add activitypub for interconnect." "Don't stress," he said, before clarifying that Tumblr first has to deal with the waves of new users coming in right now from Twitter, but that support for "interop and activitypub" were due to come "ASAP." In short, this announcement means Tumblr would move from being only a niche blogging platform to instead become a part of a larger, decentralized social network of sorts -- and one whose user base has grown in size in recent days as people flee Elon Musk's Twitter in search of new communities. The ActivityPub protocol, its website explains, provides a client-to-server API for creating, updating, and deleting content as well as a federal server-to-server API for delivering notifications and subscribing to content. In practice, this means that Mastodon users can interact and follow users on other instances (independently run nodes), as well as with users on other social apps (like PeerTube), which also support the implementation of ActivityPub. It makes for a web of social networks where users can find and follow each other without having to set up new accounts on each new service. This is the opposite approach to today's "walled garden" social networks, where a post on one platform can't be viewed by those on others, unless you re-upload or repost the content directly or share a link to the other site where the content can be found.' -- source: https://tech.slashdot.org/story/22/11/21/2320217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A History Of ARM, Part 2
by Lawrence D'Oliveiro 22 Nov '22

22 Nov '22

Quite a nice article <https://arstechnica.com/gadgets/2022/11/a-history-of-arm-part-2-everything-…> covering the founding of ARM Ltd as parent company Acorn was hitting financial headwinds. Apple played an absolutely crucial part in keeping the company viable in its early days by being among its biggest customers: the Newton PDA sold 60,000 units in its first year, which was a flop for Apple but, at $20 a unit for royalties, a big boost for ARM Ltd at the time. In those early days, the company found it an uphill struggle to be taken seriously by the bigger players. Companies like Motorola and TI had trouble appreciating why they could not create their own in-house designs instead of licensing one from ARM, even when the latter could be done for a fraction of the cost of the former. But the boss was canny and persistent enough to make the right sort of deals to build a sound basis for the company: For Robin Saxby, the idea of working with rival chip companies was always part of the strategy. “Turn your enemies into friends,” he would say. “Why should they fight you if they can make more money for themselves by collaborating with you?” Unfortunately, big companies don’t always act rationally ...

1 0

AMD Finally Opens Up Its Radeon Raytracing Analyzer 'RRA' Source Code
by Peter Reutemann 22 Nov '22

22 Nov '22

'Michael Larabel, reporting for Phoronix: This summer AMD announced the Radeon Raytracing Analyzer "RRA" as part of their developer software suite for helping to profile ray-tracing performance/issues on Windows and Linux with both Direct3D 12 and the Vulkan API. Initially the RRA 1.0 release was binary-only but now AMD has made good on their "GPUOpen" approach and made it open-source. As noted back in my original article from July on the Radeon Raytracing Analyzer release: "Radeon Raytracing Analyzer is hosted on GitHub but the only content in the actual Git repository right now is documentation, so it would appear that at least initially this is a closed-source package though some documentation also says it's MIT licensed." Last week that was cleared up with the Radeon Raytracing Analyzer source code going public. There are build instructions for compiling the RRA 1.0 sources on both Microsoft Windows and Linux while the Linux instructions are tailoring to Ubuntu use. Building the Radeon Raytracing Analyzer depends upon the Qt 5.15 toolkit.' -- source: https://news.slashdot.org/story/22/11/21/1716219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Creator of Homebrew's Plan To Get Open Source Contributors Paid - Using Blockchain
by Peter Reutemann 21 Nov '22

21 Nov '22

'The creator of the Linux/macOS package manager Homebrew has a new package manager named Tea. But according to Stack Overflow's podcast, the software also "aims to solve the problem of providing funding for popular open source projects." While he is not a crypto bull, Max was inspired with a solution for the open source funding dilemma by his efforts to buy and sell an NFT. A contract written in code and shared in public enforced a rule sending a portion of his proceeds to the digital objects original creator. What if the same funding mechanism could be applied to open source projects?Â In March of 2022, Max and his co-founder launched Tea, a sort of spirtual successor to Homebrew. It has a lot of new features Max wanted in a package manager, plus a blockchain based approach to ensuring that creators, maintainers, and contributors of open source software can all get paid for their efforts. You can read Max's launch post on Tea here and yes, of course there is a white paper. The paper describes the proposed solution as "a decentralized system for fairly remunerating open-source developers based on their contributions to the entire ecosystem and enacted through the tea incentive algorithm applied across all entries in the tea registry." And the launch post calls tea "our revolution against a failing system," arguing "We're taking our knowledge of how to make development more efficient and throwing innovations nobody has ever really considered before. "Package managers haven't been sexy. Until now. Most importantly, we're moving the package registry on-chain (relax, we'll use a low-energy proof of stake chain). This has numerous benefits due to the inherent benefits of blockchain technology." For starters, decentralized storage will make the packages always-available and immutable, signed by maintainers themselves. But there's more: web3 has enabled novel new ways to distribute value, and with our system people who care about the health of the open source ecosystem buy some token and stake it. Periodically, we reward this staking because it is securing our token network. We give a portion of these rewards to the staker and a portion to packages of their choice along with all the dependencies of those packages. Note that no portion goes to us. We're not like the other app stores.... tea is the home to a DAO that will ensure the open source maintainers that keep the Internet running are rewarded as they deserve. An introduction to the white paper adds that in the spirit of the open source movement, "we're inviting developers, speculators, and enthusiasts alike to contribute to our white paper and help brew the future of the internet. This is our revolutionary undertaking to create equitable openâsource for web3, and we want you to be a part of laying its groundwork."' -- source: https://news.slashdot.org/story/22/11/19/2047223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can Mastodon Be A Twitter Alternative?
by Lawrence D'Oliveiro 18 Nov '22

18 Nov '22

This article <https://www.aljazeera.com/economy/2022/11/7/can-mastodon-be-a-twitter-alter…> says: With Twitter in disarray since the world’s richest person took control of it last week, Mastodon, a decentralised, open alternative from privacy-obsessed Germany, has seen a flood of new users. Nevertheless, this “flood” is a mere trickle compared to the torrent of users that is Twitter -- a million or so active monthly users on the one, versus over 200 times that on the other. The decentralization of Mastodon means that no single entity can take control of it. But it also makes it harder for users to find their way around. [Mastodon creator] Rochko, whose Mastodon foundation runs on a shoestring crowdfunded budget topped up with a modest grant from the European Commission, has found a particularly receptive audience among privacy-conscious European regulators. Germany’s data protection commissioner is waging a campaign to get government bodies to close their Facebook pages, since, he says, there is no way of hosting a page there that conforms to European privacy laws. Authorities should move to the federal government’s own Mastodon instance, he says. The European Commission also maintains a server for European Union bodies to toot from. Yeah ... “toot” ...

3 7

DuckDuckGo’s anti-tracking Android tool could be “even more powerful” than iOS
by Peter Reutemann 17 Nov '22

17 Nov '22

'Privacy-focused search site DuckDuckGo has added yet another way to prevent more of your data from going to advertisers, opening its App Tracking Protection for Android to beta testers. DuckDuckGo is positioning App Tracking Protection as something like Apple's App Tracking Transparency for iOS devices, but "even more powerful." Enabling the service in the DuckDuckGo app for Android (under the "More from DuckDuckGo" section) installs a local VPN service on your phone, which can then start automatically blocking trackers on DDG's public blocklist. DuckDuckGo says this happens "without sending app data to DuckDuckGo or other remote servers."' -- source: https://arstechnica.com/gadgets/2022/11/duckduckgos-android-anti-tracking-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 37 Now Available With GNOME 43 Desktop, Official Raspberry Pi 4 Support
by Peter Reutemann 17 Nov '22

17 Nov '22

'Fedora 37 is now officially released. From a report: Fedora 37 brings the GNOME 43 desktop to Fedora Workstation 37, updated toolchain components like Glibc 2.36 and LLVM 15 and Binutils 2.38, official support for the Raspberry Pi 4, retiring 32-bit ARMv7 support, Fedora CoreOS has been promoted to a Fedora Edition, Perl 5.36, Python 3.11, RPM 4.18, LXQt 1.1, and a wealth of other updated packages.' -- source: https://linux.slashdot.org/story/22/11/16/1744258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

India Lifts Download Ban On VLC
by Peter Reutemann 15 Nov '22

15 Nov '22

'India has lifted the download ban on VLC, more than nine months after it mysteriously blocked the official website of the popular media playback software in the South Asian market. From a report: VideoLAN, the popular software's developer, filed a legal notice last month seeking an explanation from the nation's IT and Telecom ministries for the block order. The Ministry of Electronics and IT has removed its ban on the website of VLC media player, New Delhi-based advocacy group Internet Freedom Foundation, which provided legal support to VideoLAN, said on Monday. VideoLAN confirmed the order. Indian telecom operators began blocking VideoLAN's official website, where it lists links to downloading VLC, in February of this year, VideoLAN president and lead developer Jean-Baptiste Kempf told TechCrunch in an earlier interview. India is one of the largest markets for VLC.' -- source: https://news.slashdot.org/story/22/11/14/1130222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPrinting Keeps Old Printers Working -- Even On Windows
by Lawrence D'Oliveiro 12 Nov '22

12 Nov '22

This report from the Ubuntu Summit <https://www.theregister.com/2022/11/10/openprinting_keeps_old_printers_work…> I think nicely highlights the inevitable consequences of Microsoft allowing Linux into Windows with WSL2. Linux has long had better support for older printers and other hardware than Windows. Even after the vendors of the products drop support for their Windows drivers, others have found ways to create and maintain open-source drivers for those products. Now, the circle is turning back, with these same open-source drivers being offered back to Windows users, by running them on the Linux subsystem under WSL2. I don’t think it’s a coincidence that this offering is coming from Ubuntu/Canonical, given their increasingly cosy relationship with Microsoft. Sure, if you want to talk “Embrace, Extend, Extinguish”, just note that the platform being “embraced” and “extended” is not Linux being extended with formerly Windows-only capabilities, but Windows being extended with formerly Linux-only capabilities. As Microsoft and other vendors increasingly realize that, instead of developing proprietary Windows-only drivers, it is much less work to encourage the creation of open-source ones for Linux, that Windows can also use in this way via WSL2, where do you think this is going to lead?

1 0

Lenovo Driver Goof Poses Security Risk for Users of 25 Notebook Models
by Peter Reutemann 11 Nov '22

11 Nov '22

'More than two dozen Lenovo notebook models are vulnerable to malicious hacks that disable the UEFI secure-boot process and then run unsigned UEFI apps or load bootloaders that permanently backdoor a device, researchers warned on Wednesday. From a report: At the same time that researchers from security firm ESET disclosed the vulnerabilities, the notebook maker released security updates for 25 models, including ThinkPads, Yoga Slims, and IdeaPads. Vulnerabilities that undermine the UEFI secure boot can be serious because they make it possible for attackers to install malicious firmware that survives multiple operating system reinstallations. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer's device firmware with its operating system. As the first piece of code to run when virtually any modern machine is turned on, it's the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove. Typical measures such as wiping the hard drive and reinstalling the OS have no meaningful impact because the UEFI infection will simply reinfect the computer afterward. ESET said the vulnerabilities -- tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 -- "allow disabling UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx): all simply from an OS." Secure boot uses databases to allow and deny mechanisms. The DBX database, in particular, stores cryptographic hashes of denied keys. Disabling or restoring default values in the databases makes it possible for an attacker to remove restrictions that would normally be in place.' -- source: https://it.slashdot.org/story/22/11/10/1610252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SPARK: A Competitor To Rust?
by Lawrence D'Oliveiro 09 Nov '22

09 Nov '22

Here’s another contender for a modern language that is low-level yet emphasizes minimization of bugs, to compete with the likes of Rust: it’s called SPARK <https://devclass.com/2022/11/08/spark-as-good-as-rust-for-safer-coding-adac…>. It’s not a completely new language, since according to the report it is a subset of Ada. The original Ada language came about in the 1980s out of a competition organized by the US Department of Defense, to create a language specifically designed for programming embedded and safety-critical systems. The most high-profile application of it that I know of is that the life-support systems on the International Space Station are written in Ada, and run on ancient (but well-tested) Intel 386 processors. So I would say that’s a good pedigree to start from.

1 0

The Linux Kernel Has Been Forcing Different Behavior For Processes Starting With 'X'
by Peter Reutemann 09 Nov '22

09 Nov '22

'"An ugly hack within the Linux kernel that has been in mainline for over three years has been called out," writes Phoronix's Michael Larabel. "Due to a buggy X.Org Server / xf86-video-modesetting DDX, the Linux kernel has been imposing different behavior on whether a process starts with 'X' and in turn disable the atomic mode-setting support." Linux security researcher and WireGuard creator, Jason Donenfeld, discovered the 'ugly code' within the kernel and commented on it via the kernel mailing list. "The commit to this kernel with the 'X' first character check was made back in September 2019," notes Larabel. "The 'good' news is that since then on user-space side back in 2019 the xf86-video-modesetting code went ahead and disabled atomic support by default. So technically if running an updated X.Org stack within the past three years, this kernel hack isn't necessary anymore since user-space is just then avoiding the atomic API."' -- source: https://linux.slashdot.org/story/22/11/08/2211244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE: Stopping The Windows/Super Key From Popping Up The App Menu
by Lawrence D'Oliveiro 07 Nov '22

07 Nov '22

I thought I had this disabled before, but KDE Plasma has this feature where you just need to press and release the Super key (or “Windows” key, if your keyboard has the proprietary logo on it), and the application menu will appear. It seems there is no GUI setting to disable this, but you can turn it off according to this <https://superuser.com/questions/1156130/kde-disable-super-l-windows-key-key…>. First, make the described edit to your KWin config file, in ~/.config/kwinrc, which you can do conveniently with kwriteconfig5 --file kwinrc --group ModifierOnlyShortcuts --key Meta "" Then either log out your GUI session and log in again, or try just restarting your window manager with kwin_x11 --replace & in some convenient terminal window. The writeup above doesn’t mention putting the “&” on the end, so KWin remains attached to that terminal session, which means you can’t use it for anything else ...

1 0

Outlawing Dark Patterns
by Lawrence D'Oliveiro 05 Nov '22

05 Nov '22

“Dark patterns” is a term coined to describe user interfaces designed to manipulate people into giving up time, money or personal data that they didn’t intend to. A common example is the obstacle course you often have to go through to cancel a subscription to something online. Another example is the use of countdown timers to rush buyers into hasty decisions. They may not be out-and-out deceptive, but they do come close. Now, the US states of California and Washington are looking to pass laws to restrict this practice. <https://arstechnica.com/tech-policy/2021/01/lawmakers-take-aim-at-insidious…>

2 2

New Hampshire Set To Pilot Voting Machines That Use Open-Source Software
by Peter Reutemann 04 Nov '22

04 Nov '22

'According to The Record, New Hampshire will pilot a new kind of voting machine that will use open-source software to tally the votes. The Record reports: The software that runs voting machines is typically distributed in a kind of black box -- like a car with its hood sealed shut. Because the election industry in the U.S. is dominated by three companies -- Dominion, Election Systems & Software and Hart InterCivic -- the software that runs their machines is private. The companies consider it their intellectual property and that has given rise to a roster of unfounded conspiracy theories about elections and their fairness. New Hampshire's experiment with open-source software is meant to address exactly that. The software by its very design allows you to pop the hood, modify the code, make suggestions for how to make it better, and work with other people to make it run more smoothly. The thinking is, if voting machines run on software anyone can audit and run, it is less likely to give rise to allegations of vote rigging. The effort to make voting machines more transparent is the work of a group called VotingWorks. [...] On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly. The idea is to make clear there is nothing to hide. If someone is worried that a voting machine is programmed to flip a vote to their opponent, they can simply hire a computer expert to examine it and see, in real time. ' -- source: https://politics.slashdot.org/story/22/11/03/2155238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

iproute2 Docs
by Lawrence D'Oliveiro 04 Nov '22

04 Nov '22

The “ip” command, aka the “iproute2” suite, offers a huge amount of functionality for managing the Linux network stack. The initial man page, “man ip”, gives an overview, and (at least on my current system) ends with references to more: SEE ALSO ip-address(8), ip-addrlabel(8), ip-ioam(8), ip-l2tp(8), ip-link(8), ip-maddress(8), ip-monitor(8), ip-mptcp(8), ip-mroute(8), ip-neighbour(8), ip-netns(8), ip-ntable(8), ip-route(8), ip-rule(8), ip-stats(8) ip-tcp_metrics(8), ip-token(8), ip-tunnel(8), ip-vrf(8), ip-xfrm(8) IP Command reference ip-cref.ps That “ip-cref.ps” file doesn’t seem to be included in any Debian packages I can see. However, when I look in the /usr/share/man/man8 directory, I find a few more man pages not mentioned in the above list: ip-nexthop.8.gz ip-fou.8.gz ip-macsec.8.gz ip-gue.8.gz (symlink to ip-fou.8.gz) ip-netconf.8.gz ip-sr.8.gz That “ip fou”/“ip gue” command lets you tunnel arbitrary IP protocols over a pair of UDP ports. The home page for online docs is at <https://wiki.linuxfoundation.org/networking/iproute2>. Among the links is this nice step-by-step intro to doing some useful things with it <https://lartc.org/howto/lartc.iproute2.html>.

1 0

The Godot Game Engine Now Has Its Own Foundation
by Peter Reutemann 04 Nov '22

04 Nov '22

'The Godot Engine now has its own foundation to continue funding themselves. Previously, they teamed up with the Software Freedom Conservancy to handle fiscal sponsorship duties. Phoronix reports: The Godot engine developers and Software Freedom Conservancy mutually agreed to move the open-source game engine project to its own foundation. The Godot Foundation has been setup in the Netherlands as its own organization modeled after the policies of the SFC. The Godot Foundation is to help this game engine achieve its next level of growth and project a stronger image for the project. "We have just started the process of moving to the Foundation," writes Godot Engine lead developer, Juan Linietsky, in a blog post. "For now all of Godot's funding and contractors are still managed by the SFC. The SFC will gradually reduce its work for Godot and the new foundation will slowly ramp up. Stay tuned for announcements in the future as we finalize the Foundation's organizational structure and officially begin operations." More details can be found via the Godot Engine blog.' -- source: https://news.slashdot.org/story/22/11/02/2045240 Anyone keen to showcase this engine at one of our meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Ad For GIMP.org Served Info-Stealing Malware Via Lookalike
by Peter Reutemann 03 Nov '22

03 Nov '22

'A report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware. Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.' -- source: https://tech.slashdot.org/story/22/11/02/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mastodon Gained 70,000 Users After Musk's Twitter Takeover
by Peter Reutemann 03 Nov '22

03 Nov '22

'"More than 70,000 users joined Mastodon on the day after Musk's Twitter takeover announcement," writes Slashdot reader votsalo. "Mastodon is a six-year-old decentralized social media platform that uses 'federated' servers." The Guardian's Wilfred Chan writes: I joined Mastodon this week, and it took a few hours just to master its new vocabulary. Some of it is a little silly-sounding: instead of tweets, you have "toots". Things get trickier after that. Mastodon is not a single website but a network of thousands of websites called "instances", also called servers. These servers are "federated", which means they are run by different entities but can still communicate with each other without needing to go through a central system. And the space they all exist in is called the "fediverse," which some savvy tooters call "the Fedi." When you sign up for Mastodon, the first thing you do is choose a server. There are general-purpose ones, such as mastodon.social, as well as ones aimed at interest groups, such as kpop.social or linuxrocks.online. There are also joke servers like dolphin.town, where the only thing users are allowed to post is the letter "e". The server becomes part of your username (for example, wilfred(a)kpop.social), and the toots you see on your feed are toots from your server-mates, rather than from the entire fediverse. But you're also free to toot at people from other servers and even "boost" their public toots on to your feed. That's how Mastodon creates a unified global experience without being controlled by one entity, said Eugen Rochko, Mastodon's Germany-based founder and lead developer. "The servers are service providers, like Hotmail and Gmail are for email. It doesn't mean that the different servers are isolated from each other, like old school forums," he said. "Having just one account allows you to follow and interact with anyone in this global decentralized social network." But Mastodon's model comes with its own risks. If the server you join disappears, you could lose everything, just like if your email provider shut down. A Mastodon server admin also has ultimate control over everything you do: if for some reason the owner of kpop.social doesn't like that I boosted a toot from dolphin.town, they could remove it or even "defederate" the server, which would block all dolphin toots from the k-pop server completely. A server admin could also snoop on my private toots if they wanted to -- or delete my account for any reason. While Mastadon's 70,000 jump in users sounds impressive, it's "still a drop in a bucket compared with Twitter's reported 450 million daily active users," says Chan. The decentralized software also remains difficult for many people to use. According to TechCrunch, Mastadon says it has "gained 123,562 new users as of October 27, 2022 and now has 528,607 active users on the network as of October 31, 2022."' -- source: https://tech.slashdot.org/story/22/11/02/1958241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backblaze: Buying Cheaper, Less Reliable Drives Can Be Worth It
by Lawrence D'Oliveiro 02 Nov '22

02 Nov '22

Backup company Backblaze has put out another juicy status report on the reliability of its massive collection of hard drives <https://blocksandfiles.com/2022/11/01/backblaze-disk-drives/>. This one has some interesting numbers on the cost of dealing with drive failures -- it seems the hardware cost of these to the company is zero, as the failed drives get sent back to the vendors for full credit or replacement. (I guess if you buy a few thousand units at a time, you get special deals like this.) Since the company is in the business of providing sufficient redundancy that the impact of a drive failure on data integrity is essentially zero, the main cost of a failure becomes the labour cost of putting in a new drive, which comes to $300. Looked at this way, looking at the table which compares three models of drive, with unit costs ranging from $225 up to $275, and corresponding annualized failure rates of 1.5% down to 0.5%, it turns out the cheaper, flakier drive is the better deal -- amortized over a five-year service lifetime, the increased labour cost of replacing failed drives is easily outweighed by the savings in buying the drives in the first place.

1 0

OpenSSL 3 patch, once Heartbleed-level “critical,” arrives as a lesser “high”
by Peter Reutemann 02 Nov '22

02 Nov '22

'An OpenSSL vulnerability once signaled as the first critical-level patch since the Internet-reshaping Heartbleed bug has just been patched. It ultimately arrived as a "high" security fix for a buffer overflow, one that affects all OpenSSL 3.x installations, but is unlikely to lead to remote code execution. OpenSSL version 3.0.7 was announced last week as a critical security fix release. The specific vulnerabilities (now CVE-2022-37786 and CVE-2022-3602) had been largely unknown until today, but analysts and businesses in the web security field hinted there could be notable problems and maintenance pain. Some Linux distributions, including Fedora, held up releases until the patch was available. Distribution giant Akamai noted before the patch that half of their monitored networks had at least one machine with a vulnerable OpenSSL 3.x instance, and among those networks, between 0.2 and 33 percent of machines were vulnerable. But the specific vulnerabilities—limited-circumstance, client-side overflows that are mitigated by the stack layout on most modern platforms—are now patched, and rated as "High." And with OpenSSL 1.1.1 still in its long-term support phase, OpenSSL 3.x is not nearly as widespread.' -- source: https://arstechnica.com/information-technology/2022/11/openssl-3-patch-once… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LineageOS flashing
by Peter Reutemann 01 Nov '22

01 Nov '22

Hi everyone Since I've talked about flashing LineageOS on Android phones before... In the past, I've always used TWRP (https://twrp.me/) as recovery tool on the phones. However, the tools has been lagging behind with Android 12 support and the 3.7.0 release (which in theory added Android 12 support) failed on my old Galaxy S7 (I'm using custom ROMs supplied by Ivan Meier). Unfortunately, OrangeFox Recovery, which seems a popular alternative to TWRP, didn't support my Galaxy S7. However, I found a little workaround for that dilemma: though I used TWRP to install Android 11, during the setup process I then ticked the box to also update the recovery tool with LineageOS recovery with the every subsequent update. After updating the phone to the latest Android 11, I had LineageOS recovery on there which has (working) support for Android 12 and I managed to upgrade successfully to 12. Just in case somebody runs into a similar problem... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vanilla OS: More Than Just Vanilla GNOME With Ubuntu
by Peter Reutemann 31 Oct '22

31 Oct '22

'Slashdot reader Soul_Predator writes: Vanilla OS is Ubuntu on stock GNOME, with on-demand immutability and package selection freedom. It is currently a beta project, with a stable release planned for the next month. "The first-time setup process is a breeze to experience," writes It's FOSS News, applauding how it lets uses choose and enable Flatpak/Snap/AppImage. Overall, a package manager that installs applications utilizing a container, getting the ability to choose your package managers, on-demand immutability, and vanilla GNOME make it seem like a good deal to keep an eye on... I'd say it is a project that I believe a lot of users will appreciate. You can download the ISO by joining its Discord channel for now. The ISO is not yet publicly available to all. Take a look at its documentation if you are curious. However, as per the roadmap, they plan to have a release candidate soon enough. ' -- source: https://tech.slashdot.org/story/22/10/29/1953233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Teaching The Kids To Be Safe Online
by Lawrence D'Oliveiro 30 Oct '22

30 Oct '22

A program is being introduced into schools to give students a better appreciation for how to keep themselves safe online <https://www.stuff.co.nz/national/education/130292250/students-urged-to-be-l…>. It covers things like spotting phishing attacks, and avoiding making personal information public that you might regret later: Naenae College principal Nic Richards said while students were experts in social media, parents and teachers were aware that “the decisions made now can exist online forever.” “Experts” in putting information up and interacting with other users, not so savvy perhaps in understanding the consequences of doing so. And maybe some of what they learn will rub off on others in their family ... including their parents?

1 0

“You must enable DRM to play some audio or video on this page.”
by Lawrence D'Oliveiro 28 Oct '22

28 Oct '22

I have seen Firefox give me this message that I need to “enable DRM” (i.e. install support for Encrypted Media Extensions) when I visit certain pages. One site that is currently triggering this for me is Metservice <https://www.metservice.com/towns-cities/locations/hamilton>. Yet I can’t see anything on that page that I might be blocked from playing. There is a Video Forecast clip, but I seem to be able to play that OK. Anybody else get this message?

3 2

'Old/Weird Laptops' Sought To Help Test Linux Kernel Backlight Drivers
by Peter Reutemann 28 Oct '22

28 Oct '22

'Do you have a laptop that's either "pretty old" or "weird in some other way"? Did it ship without Windows from the factory, or did you flash its firmware with coreboot? You could help the Linux kernel move its backlight code forward without abandoning quirky gear like yours. ArsTechnica: Hans de Goede, a longtime Linux developer and principal engineer at Red Hat, writes on his Livejournal about the need to test "a special group of laptops" to prevent their backlight controls from disappearing in Linux kernel 6.1. Old laptop tests are needed because de Goede is initiating some major changes to user-space backlight controls, something he has been working on since 2014. As detailed at Linux blog Phoronix, there are multiple issues with how Linux tries to address the wide variety of backlight schemes in displays, which de Goede laid out at the recent Linux Plumbers Conference. There can be multiple backlight devices operating a single display, leaving high-level controls to "guess which one will work." Brightness control requires root permissions at the moment. And "0" passed along as a backlight value remains a conundrum, as the engineer pointed out in 2014: Is that entirely off, or as low as the display can be lit?' -- source: https://linux.slashdot.org/story/22/10/27/1920206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Systemd Supremo Proposes Tightening up Linux Boot Process
by Peter Reutemann 27 Oct '22

27 Oct '22

'Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images. From a report: Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix. ' -- source: https://it.slashdot.org/story/22/10/26/1743234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Passkeys Are Finally Here
by Peter Reutemann 26 Oct '22

26 Oct '22

'Ars Technica: Generically, passkeys refer to various schemes for storing authenticating information in hardware, a concept that has existed for more than a decade. What's different now is that Microsoft, Apple, Google, and a consortium of other companies have unified around a single passkey standard shepherded by the FIDO Alliance. Not only are passkeys easier for most people to use than passwords; they are also completely resistant to credential phishing, credential stuffing, and similar account takeover attacks. On Monday, PayPal said US-based users would soon have the option of logging in using FIDO-based passkeys, joining Kayak, eBay, Best Buy, CardPointers, and WordPress as online services that will offer the password alternative. In recent months, Microsoft, Apple, and Google have all updated their operating systems and apps to enable passkeys. Passkey support is still spotty. Passkeys stored on iOS or macOS will work on Windows, for instance, but the reverse isn't yet available. In the coming months, all of that should be ironed out, though. Passkeys work almost identically to the FIDO authenticators that allow us to use our phones, laptops, computers, and Yubico or Feitian security keys for multi-factor authentication. Just like the FIDO authenticators stored on these MFA devices, passkeys are invisible and integrate with Face ID, Windows Hello, or other biometric readers offered by device makers. There's no way to retrieve the cryptographic secrets stored in the authenticators short of physically dismantling the device or subjecting it to a jailbreak or rooting attack. Even if an adversary was able to extract the cryptographic secret, they still would have to supply the fingerprint, facial scan, or -- in the absence of biometric capabilities -- the PIN that's associated with the token. What's more, hardware tokens use FIDO's Cross-Device Authentication flow, or CTAP, which relies on Bluetooth Low Energy to verify the authenticating device is in close physical proximity to the device trying to log in. "Users no longer need to enroll each device for each service, which has long been the case for FIDO (and for any public key cryptography)," said Andrew Shikiar, FIDO's executive director and chief marketing officer. "By enabling the private key to be securely synced across an OS cloud, the user needs to only enroll once for a service, and then is essentially pre-enrolled for that service on all of their other devices. This brings better usability for the end-user and -- very significantly -- allows the service provider to start retiring passwords as a means of account recovery and re-enrollment." In other words: "Passkeys just trade WebAuthn cryptographic keys with the website directly," says Ars Review Editor Ron Amadeo. "There's no need for a human to tell a password manager to generate, store, and recall a secret -- that will all happen automatically, with way better secrets than what the old text box supported, and with uniqueness enforced." If you're eager to give passkeys a try, you can use this demo site created by security company Hanko.' -- source: https://yro.slashdot.org/story/22/10/25/1912214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 26 Oct '22

26 Oct '22

Hi everyone We have a meeting next week on Tuesday (not Monday, due to Labour Day) with the following topic: "Ever wondered what Docker was all about? Peter Reutemann will give a hands-on introduction into the tool and show you why it is so useful." Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776731/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Memtest86+ Is Back After 9 Years
by Peter Reutemann 26 Oct '22

26 Oct '22

'Memtest86+ just got its first update after 9 years. The program has reportedly been rewritten from scratch and is back in active development. The new version, 6.0, features a plethora of updates to bring the application up to date, and support the latest system hardware from Intel and AMD. Tom's Hardware reports: For the uninitiated, MemTest86 was originally created back in the mid 1990s, and was one of the earliest DDR memory testing applications for personal computers. But development stopped in 2013 once Memtest86 was split into Memtest86 and Memtest86", with the former being bought by PassMark. Officially, we don't know why development stopped. But compared to the now modern Memtest86, Memtest86+ is the open-source variant. Needless to say, version 6.00 features a lot of updates, which were required to bring it up to modern standards compared to the 2013 version. The new version includes completely rewritten code for UEFI-based motherboards, the modern version of a BIOS, for both 32-bit and 64-bit versions of the application. Furthermore, the application features added support for x64 long mode paging, support for up to 256 cores, added detection for DDR4 and DDR5 memory -- since DDR3 was the latest memory standard in 2013 -- and adds support for XMP version 3.0. CPU support has been significantly enhanced, addingdetection for all pre-Zen and AMD Zen-based processors ranging from the Ryzen 1000 series to 7000 series, and any older parts that were made after 2013. Intel support has also been added for chips up to 13th gen Raptor Lake. Finally, the last patch notes indicate version 6.0 adds support for older Nvidia and AMD chipsets - probably pre-2010 since it mentions Nvidia nForce chipsets, along with numerous bug fixes, optimizations and enhancements.' -- source: https://hardware.slashdot.org/story/22/10/24/2315242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Just When You Thought Y2K Was Done And Dusted ...
by Lawrence D'Oliveiro 25 Oct '22

25 Oct '22

Remember what the whole Y2K issue was like, over a quarter-century ago? And all the work that had to be done to fix it? You’d think that lessons were learned, software developers would be wiser, and henceforth they would always use four digits for year numbers, so that a situation like that would not occur again. Guess again. Recently I hit a situation where a piece of software was *still* using just two digits for year numbers. Basically it was maintaining Certificate Revocation Lists (CRLs) for OpenVPN connections; these have an expiry date, in the form of the “nextupdate” field, to ensure that outdated lists are regularly replaced with fresh ones, to reduce the chance that anybody is inadvertently continuing to use compromised keys. The software in question is pfSense, from Netgate <https://forum.netgate.com/topic/172870/crl-has-expired>. The standard format for these CRLs can handle a full range of dates, but the internal system on pfSense for generating them can only handle years from 1950 to 2049. The generated CRLs were being given validity durations of 9999 days, which was fine up until about August this year, when the expiry date went past 2049, and wrapped around to 1950. On an incoming connection attempt, OpenSSL would check the CRL, find it invalid, and cause OpenVPN to drop the connection. The forum discussion above links to a patch to fix the issue. Only the patch doesn’t really make for a permanent fix: all it does is reduce the assigned validity duration from 9999 days to 730 days; the actual underlying software is still only working with 2-digit year numbers. This gives Netgate a few decades’ breathing room to come up with a proper fix.

2 2

Online Misinformation Monitor Newsletter
by Lawrence D'Oliveiro 20 Oct '22

20 Oct '22

Came across this useful series of monthly reports <https://www.newsguardtech.com/misinformation-monitor/> on how online services are being conduits for spreading misinformation and disinformation. Don’t trust them? Learn to watch out for those who keep insisting they are correct, versus those who are willing to offer reasons why they are correct (and are willing to correct their mistakes) <https://www.newsguardtech.com/about/why-should-you-trust-us/>.

1 0

Firefox 106 Is Now Available With PDF Annotation, Firefox View
by Peter Reutemann 20 Oct '22

20 Oct '22

'Firefox 106 is now available for download, bringing various new features and enhancements, such as a new PDF editing feature and new way to organize recently closed tabs. 9to5Linux reports: Mozilla says that Firefox 106 finally brings the long-anticipated two-finger swipe horizontal gesture for navigating back and forward on a website without having to hold down the Alt key. [...] Firefox 106 also introduces annotation capabilities to the built-in PDF viewer so you can write text, draw, or add signatures on PDF files. You'll be able to change the size and color of the text tool, as well as the thickness, opacity, and color of the draw tool. Another interesting new feature of the Firefox 106 release is called Firefox View, which is implemented as a pinned tab, promising to help you get back to the content you've previously discovered by allowing you to switch seamlessly between your devices running Firefox. On top of all that, Firefox 106 also brings major WebRTC changes to improve Windows and Wayland screen sharing, RTP performance and reliability, statistics, and more. There are also the usual bug and security fixes to make Firefox more stable and reliable on your system. ' -- source: https://news.slashdot.org/story/22/10/19/2053217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Praise of FFmpeg
by Peter Reutemann 19 Oct '22

19 Oct '22

'Drew DeVault, prolific FOSS blogger and hacker behind SourceHut, Sway, wlroots, and many other projects, writes in a blog post: I have relied on ffmpeg for many tasks and for many years. It has always been there to handle any little multimedia-related task I might put it to for personal use -- re-encoding audio files so they fit on my phone, taking clips from videos to share, muxing fonts into mkv files, capturing video from my webcam, live streaming hacking sessions on my own platform, or anything else I can imagine. It formed the foundation of MediaCrush back in the day, where we used it to optimize multimedia files for efficient viewing on the web, back when that was more difficult than "just transcode it to a webm." ffmpeg is notable for being one of the first large-scale FOSS projects to completely eradicate proprietary software in its niche. Virtually all multimedia-related companies rely on ffmpeg to do their heavy lifting. It took a complex problem and solved it, with free software. The book is now closed on multimedia: ffmpeg is the solution to almost all of your problems. And if it's not, you're more likely to patch ffmpeg than to develop something new. The code is accessible and the community are experts in your problem domain. ffmpeg is one of the foremost pillars of achievement in free software. It has touched the lives of every reader, whether they know it or not. If you've ever watched TV, or gone to a movie, or watched videos online, or listened to a podcast, odds are that ffmpeg was involved in making it possible. It is one of the most well-executed and important software projects of all time.' -- source: https://tech.slashdot.org/story/22/10/17/188205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Announces KataOS
by Peter Reutemann 19 Oct '22

19 Oct '22

'Last Friday, Google announced the release of KataOS, a security-minded operating system focused on embedded devices running ambient machine learning workloads. As Phoronix notes, it uses the Rust programming language and is "built atop the seL4 microkernel as its foundatin." From Google's Open-Source Blog: As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability. Through the seL4 CAmkES framework, we're also able to provide statically-defined and analyzable system components. KataOS provides a verifiably-secure platform that protects the user's privacy because it is logically impossible for applications to breach the kernel's hardware security protections and the system components are verifiably secure. KataOS is also implemented almost entirely in Rust, which provides a strong starting point for software security, since it eliminates entire classes of bugs, such as off-by-one errors and buffer overflows. The current GitHub release includes most of the KataOS core pieces, including the frameworks we use for Rust (such as the sel4-sys crate, which provides seL4 syscall APIs), an alternate rootserver written in Rust (needed for dynamic system-wide memory management), and the kernel modifications to seL4 that can reclaim the memory used by the rootserver. KataOS code is being worked on via GitHub under the AmbiML umbrella.' -- source: https://tech.slashdot.org/story/22/10/17/2256206 Someone keen to demo this at one of our next meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds To Kernel Devs: Grow Up and Stop Pulling All-Nighters Just Before Deadline
by Peter Reutemann 19 Oct '22

19 Oct '22

'Linux kernel boss Linus Torvalds has released the first release candidate for version 6.1 of the project and added an appeal for developers to make his life easier by adding code earlier in the development cycle. The Register reports: "Let me just say that after I got my machine sorted out and caught up with the merge window, I was somewhat frustrated with various late pull requests. I've mentioned this before, but it's _really_ quite annoying to get quite a few pull requests in the last few days of the merge window." He then offered further guidance on how kernel devs can do it right. "Yes, the merge window is two weeks, but that's very much to allow me time to look things over, not 'two weeks to hurriedly put together a branch that you send Linus on Friday of the second week'," he wrote. "The whole 'do an all-nighter to get the paper in the day before the deadline' is something that should have gone out the window after high school. Not for kernel development." His next line was: "You know who you are." "Anyway, it's not the first time I've said this, I doubt it will be the last. But maybe more people could take it to heart, ok?" he added, before concluding his post with a slightly non-traditional call for testers to visit Linux's git tree because "The merge window may not be the biggest ever, but it's certainly big enough that the shortlog is much too big to post, and below is just my usual merge log." "For all the gory details, please refer to the git tree."' -- source: https://linux.slashdot.org/story/22/10/17/220230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu's New Terminal 'Ad' is Angering Users
by Peter Reutemann 19 Oct '22

19 Oct '22

'Joey Sneddon, reporting at OMG! Ubuntu: In September I tweeted a screenshot of something unexpected that has started to show up in the terminal when I ran system updates. It didn't enrage me at the time (and it kinda still doesn't) but I did find it a little ... Off. Now, if you're suitably tuned-in to the Linux newswire and/or an avid attendee of social media you'll probably heard about the drama in question. If you haven't, then allow me to... Yes, the furore is over an "ad" for Ubuntu Pro, Canonical's revamped support offering that replaces/augments Ubuntu Advantage (which has been around for many years) that appears in the terminal when managing system updates. Other people are calling it an "ad" (hence quote marks). I prefer the term plug (which, it turns out, some people aren't familiar with; it means to mention something in order to promote it). For although this sentence is technically advertising something, in this case Ubuntu Pro, the offering itself is free for regular users (on up-to five devices). Thus, it's not like this is an "ad" that generates Canonical revenue. It's more akin to a public service announcement to raise awareness.' -- source: https://news.slashdot.org/story/22/10/18/1847203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xv6 Open-Source Teaching OS
by Lawrence D'Oliveiro 17 Oct '22

17 Oct '22

You may know that the MINIX operating system, the inspiration for Linux, was created for teaching purposes (namely, Andrew Tanenbaum’s “Operating Systems” textbook). In the same vein, Xv6 is a newer teaching OS from MIT <https://pdos.csail.mit.edu/6.828/2022/xv6.html>, for use in an undergraduate operating systems course. Originally it was implemented on x86, but now it has moved to RISC-V. The inspiration for Xv6 was the old 6th Edition Unix from Bell Labs from 1975, back when it only ran on DEC PDP-11 processors. This OS version was the subject of the famous “Lions book” <https://en.wikipedia.org/wiki/A_Commentary_on_the_UNIX_Operating_System>, circulation of which was supposed to be restricted to those with licences to the Unix source code. And then with the 7th Edition, AT&T even forbade classroom use of this source code. Nevertheless, the book still spread via, shall we say, samizdat ... The Xv6 GitHub area is here <https://github.com/mit-pdos>.

1 0

Pine64 Announces 'Sub-$10, Linux-Capable' SBC - the Ox64
by Peter Reutemann 17 Oct '22

17 Oct '22

'Pine64 has announced a new "sub $10 Linux capable single board computer" called the Ox64. Liliputing says the tiny SBC "looks a lot like a Raspberry Pi Pico. But while Raspberry Pi's tiny board is powered by an RP2040 microcontroller, the Ox64 has a dual-core RISC-V processor, 64MB of embedded RAM, and support for up to 128Mb of flash storage plus a microSD card for additional storage." It's expected to support RTOS and Linux and blurs the lines between a microcontroller and a (very low power) single-board PC. It's expected to go on sale in November with prices starting at $6 for an RTOS-ready version of the board and $8 for a Linux-compatible model. As spotted by CNX Software earlier this month, the board is designed to be a small, inexpensive single-board computer with a RISC-V processor that's aimed at developers. Pine64's October update also reveals that their Star64 and QuartzPro64 single-board computers "now boot Linux (and run it well too already!)"' -- source: https://news.slashdot.org/story/22/10/15/2314226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bad DIMM on Linus Torvalds' Desktop System Moves Kernel Merges to His Laptop
by Peter Reutemann 17 Oct '22

17 Oct '22

'When a kernel developer asked Linus Torvalds if he'd missed a Git pull, Torvalds "revealed the request was still in his queue as 'I'm doing merges (very slowly) on my laptop, while waiting for new ECC memory DIMMs to arrive,'" reports The Register: Torvalds needs the DIMMs because over the last few days he experienced what he described as "some instability on my main desktop... with random memory corruption in user space resulting in my allmodconfig builds randomly failing with internal compiler errors etc." The Linux boss's first thought was that a new kernel bug had caused the problem — which isn't good but sometimes happens. His instinct was wrong. "It was literally a DIMM going bad in my machine randomly after 2.5 years of it being perfectly stable," he wrote. "Go figure. Verified first by booting an old kernel, and then with memtest86+ overnight." Torvalds appears to have been tracking delivery of the new DIMMs as he reported replacement memory was "out for delivery" and predicted it should arrive later on Sunday evening.... His post also mentions that his main PC was set up for error correction code memory (ECC memory), but "during the early days of COVID when there wasn't any ECC memory available at any sane prices. And then I never got around to fixing it, until I had to detect errors the hard way." "I absolutely *detest* the crazy industry politics and bad vendors that have made ECC memory so 'special'," he added.' -- source: https://linux.slashdot.org/story/22/10/15/2334251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.0 Released for the AmigaOne X1000/X5000 PowerPC-Based AmigaOS Computers
by Peter Reutemann 17 Oct '22

17 Oct '22

'Hyperion Entertainment is pleased to announce the immediate availability of a very substantial and comprehensive update of the Software Development Kit (SDK) for AmigaOS 4.1 54.16. Also Linux: Kernel 6.0 for AmigaOne X1000/X5000 has been released and the biggest Amiga event of the year will be held upcoming weekend in Mönchengladbach, Germany: the Amiga37 event.' -- source: https://linux.slashdot.org/story/22/10/15/2124215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office Rebranding
by Lawrence D'Oliveiro 14 Oct '22

14 Oct '22

I suppose you’ve heard by now that “Microsoft Office” is losing the “Office” part of the name, and becoming “Microsoft 365”. Accompanying this rebranding is a new set of logos <https://arstechnica.com/gadgets/2022/10/rip-to-microsoft-office-henceforth-…>. One thing I notice about them is the gradient shading, shadows and general faux-3D look. Does this mark an end to the “flat” design fad that seems to have become so popular over the last decade? Or does this only apply to the logo branding, not to onscreen icons, UI etc? (In which case, I wonder how their design gurus feel about such a disconnect between those different aspects of the same product.) Of course, I ask this as someone who never stopped being a fan of 3D style ...

1 0

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0

VirtualBox 7.0 adds first ARM Mac client, full encryption, Windows 11 TPM
by Peter Reutemann 12 Oct '22

12 Oct '22

'Nearly four years after its last major release, VirtualBox 7.0 arrives with a… host of new features. Chief among them are Windows 11 support via TPM, EFI Secure Boot support, full encryption for virtual machines, and a few Linux niceties. [...] Linux hosts receive "reworked" screen resizing, along with "initial support" for automatic updating of the Guest Additions inside Linux guests. Perhaps most interesting for Linux hosts is support for DXVK, the Vulkan-based implementation of DirectX layers that allows for running 3D Windows applications in Wine. This provides some parity with Windows hosts, which receive standard DirectX 11 support in this 7.0 release.' -- source: https://arstechnica.com/gadgets/2022/10/virtualbox-7-0-adds-first-arm-mac-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Confirms Alder Lake BIOS Source Code Leaked
by Peter Reutemann 10 Oct '22

10 Oct '22

'Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident: "Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...." The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities.... Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo. ' -- source: https://hardware.slashdot.org/story/22/10/09/2330258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Launches New Free Tier for Its Security-Focused 'Ubuntu Pro'
by Peter Reutemann 10 Oct '22

10 Oct '22

'"Starting with the Ubuntu 16.04 edition and including the later LTS versions, Canonical will offer expanded security coverage for critical, high, and medium Common Vulnerabilities and Exposures (CVEs) to all of Ubuntu's open-source applications and toolchains for ten years," reports ZDNet. "Yes, you read that right, you get security patches not just for the operating system, but for all of Ubuntu's open-source applications for a decade." Most of these are server programs, such as Ansible, Apache Tomcat, Drupal, Nagios, Redis, and WordPress. But, it also includes such developer essentials as Docker, Node.js, phpMyAdmin, Python 2, and Rust. Altogether, Canonical is supporting more than 23,000 packages. Indeed, it's now offering security for, as Mark Shuttleworth, Canonical's CEO, said, "Security coverage to every single package in the Ubuntu distribution." Canonical isn't doing this on its own. It's offering free, improved security in partnership with the security management company Tenable. Robert Huber, Tenable's Chief Security Officer, said, "Ubuntu Pro offers security patch assurance for a broad spectrum of open-source software. Together, we give customers a foundation for trustworthy open source." Beyond ordinary security, Canonical is backporting security fixes from newer application versions. This enables Ubuntu Pro users to use the Ubuntu release of their choice for long-term security without forced upgrades. Happy to keep using Ubuntu 20.04? No problem. You can run it until April 2030. Knock yourself out.... Users can obtain a free personal Ubuntu Pro subscription at ubuntu.com/pro for up to five machines. This free tier is for personal and small-scale commercial use. Mark Shuttleworth, CEO of Ubuntu's parent company company Canonical, explains in a new video that Ubuntu "is now the world's most widely used Linux..." "What makes most proud, though, is that we have found a way to make this available free of charge to anybody for their personal and for small-scale commercial use.... full commercial use for you, and any business you own, on up to five machines."' -- source: https://linux.slashdot.org/story/22/10/09/007217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Court Won’t Order Bad Tenants Facebook Group To Release Information
by Lawrence D'Oliveiro 10 Oct '22

10 Oct '22

A bunch of landlords in NZ were running a Facebook group called “Bad Tenants”, where they were sharing personal details about tenants <https://www.nzherald.co.nz/nz/court-wont-force-bad-tenants-facebook-group-t…>: ... it provides a space for landlords to share personal information about their tenants as a warning to other property owners, essentially blacklisting them. The Privacy Commission and Renters United have stated explicitly that this sharing of private information is against the law. So a tenant named Adam Sheehan took a complaint to the Privacy Commissioner last year, who directed that the group hand over any information they had about him. But they did not comply, and deleted the group. So then he went to court. But the court decided that there was no way they could enforce any decision made against the group. Under the Privacy Act 2020, any individual can request information that any organisation holds about them - whether it's the police, the Ministry of Health or an insurance broker - and they have to supply it. However, because a Facebook group isn't an organisation or an incorporated body, just a group of individuals, there was no one specifically for the tribunal to order to release Sheehan's information. I wonder, when groups or accounts or pages are deleted, does Facebook guarantee that that information really and permanently disappears?

2 1

Matter Smart Home Standard Officially Launches
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Connectivity Standards Alliance and its members that include Apple, Google, Amazon, Samsung, and other smart home manufacturers, today announced the official launch of the Matter 1.0 smart home accessory standard. MacRumors reports: Companies that have agreed to support Matter now have all of the resources that they need to begin implementing Matter into their platforms, so we could see Apple integrating Matter into HomeKit very soon. In fact, iOS 16.1 is already laying the groundwork for Matter, so Matter could be announced with the launch of the update. With the Matter 1.0 launch, authorized test labs are now available for product certification, tools are available, and the open-source reference design SDK is complete. Alliance members with devices that have already been deployed and with plans to update their products with Matter support can do so as soon as their products are certified. The Connectivity Standards Alliance says that the first release of Matter will support a variety of smart home products such as lighting, HVAC controls, window coverings, safety and security sensors, door locks, media devices, controllers, and bridges. "What started as a mission to unravel the complexities of connectivity has resulted in Matter, a single, global IP-based protocol that will fundamentally change the IoT," said Tobin Richardson, President and CEO of the Connectivity Standards Alliance. "This release is the first step on a journey our community and the industry are taking to make the IoT more simple, secure, and valuable no matter who you are or where you live. With global support from companies large and small, today's Matter 1.0 release is more than a milestone for our organization and our members; it is a celebration of what is possible." ' -- source: https://mobile.slashdot.org/story/22/10/04/2145233 Home assistant has support for it: https://www.home-assistant.io/blog/2022/05/29/matter-in-home-assistant-work… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Adafruit’s Cheekmate gets to the bottom (ahem) of chess cheating controversy
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Internet has been abuzz for weeks about a particularly juicy chess cheating controversy that erupted last month. The reigning chess world champion, Magnus Carlsen, lost in the third round to a 19-year-old upstart, Hans Niemann, in what was widely considered to be a shocking upset. Carlsen withdrew from the tournament the next day, and his cryptic comments on Twitter fueled rampant speculation that Niemann had cheated. The fact that Niemann admitted to cheating in online chess matches didn't help his case, but he steadfastly insisted he never cheated in over-the-board games. The fierce debate eventually produced a bizarre viral conspiracy theory that Niemann had used anal beads to receive coded messages during the match. But would that even be possible? The folks at Adafruit Industries were sufficiently intrigued to put the theory to the test—you know, just to get to the bottom of the matter. The result is a prototype device called Cheekmate—because the Adafruit team rightfully loves their punny innuendoes—complete with a step-by-step guide for those who might want to build their own prototype. This device, Adafruit insists, is not for actual cheating: "That would be asinine… in brief, a stain on the sport, but to record for posterior whether this sort of backdoor intrusion is even plausible or just an Internet myth." Lacking any willing human volunteers to test the prototype, they ended up embedding Cheekmate in a big, juicy slab of pork butt.' -- source: https://arstechnica.com/gaming/2022/10/adafruits-cheekmate-gets-to-the-bott… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IceWM Reaches Version 3 After a Mere 25 Years
by Peter Reutemann 06 Oct '22

06 Oct '22

'A new version of a quarter-century-old window manager shows that there's still room for improvement and innovation, even in established, mature tools. The Register reports: IceWM is [...] a traditional stacking window manager allowing you to open, move, and resize windows. It's relatively simple, easy, and quick to learn. By default, it also provides an app launcher and an app switcher, using the familiar Windows 95 model: a hierarchical start menu and a taskbar. If you do a minimal install of openSUSE, you get IceWM. It's also one of the defaults in the lightweight antiX and Absolute Linux distros. With such a relatively simple remit, it's good to see that development is still going on. Version 2.0 appeared late in 2020, removing a legacy protocol and adding a new image rendering engine. Now version 3.0 is out with a whole new feature: tabbed windows. Reminiscent of one of The Reg FOSS desk's favorite OSes, the late and great Be OS, tabbed windows turn the title bar into a tab that is less than the full width of the window. In IceWM 3, this allows you to attach windows together to form one entity that can be moved and sized in a single operation â" but the contents of the different windows can be accessed individually using each one's tab. In other words, it works like browser tabs, but the different windows don't need to be from the same parent application. "IceWM's new tabbed windows are the sort of relatively simple improvement to the very well-established metaphor of window management that this vulture really likes to see: small, elegant, and yet helpful," adds The Register's Liam Proven. "We feel that there's plenty more room for improvement within this space. For instance, very few window managers offer the choice of where the title bar (or tab) is located; on a widescreen, placing them on the side, as wm2 and wmx do, would save valuable vertical pixels."' -- source: https://tech.slashdot.org/story/22/10/05/214241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Filling A USB Stick
by Lawrence D'Oliveiro 06 Oct '22

06 Oct '22

Does anybody else fill USB sticks full of data? I have a backup regime currently based on 32GiB sticks, and I find it can take up to around 8 hours to fill one with files. (USB 3 sticks might have been a bit quicker, maybe half that time). So I tried an alternative approach: use dd to copy the stick to an image file, do a loopback mount of that image file, do the backup copy to the mounted image, dismount it, then use dd to copy it back to the actual stick. Time taken: typically less than 10 minutes to copy the stick to an image file, and up to an hour to copy the image file back to a USB 3 stick, or around 3 and a half hours for a USB 2 stick. The backup to the image file itself took an hour at most. Overall, still a substantial saving in time using the image-file approach. Doing a restore from the sticks is fast enough that I do this directly from them, without bothering with intermediate image files. Also I notice quite a variation in the actual capacities of the sticks. They are all nominally 32GiB = 2 ** 35 bytes, but the sizes of the usable partitions range from 89.5% of this to 91.4% -- well short of what it says on the tin. Even if you say it’s supposed to be 32GB = 32 * 10 ** 9 bytes, capacities range from 96.1% to 98.1% of the nominal value.

1 0

Basic Rust Support Merged For Upcoming Linux 6.1
by Peter Reutemann 06 Oct '22

06 Oct '22

'"This Monday, the first set of patches to enable Rust support and tooling was merged for Linux 6.1," writes Slashdot reader sabian2008, sharing an update from longtime kernel developer Kees Cook: The tree has a recent base, but has fundamentally been in linux-next for a year and a half. It's been updated based on feedback from the Kernel Maintainer's Summit, and to gain recent Reviewed-by: tags. Miguel is the primary maintainer, with me helping where needed/wanted. Our plan is for the tree to switch to the standard non-rebasing practice once this initial infrastructure series lands. The contents are the absolute minimum to get Rust code building in the kernel, with many more interfaces[2] (and drivers -- NVMe[3], 9p[4], M1 GPU[5]) on the way. The initial support of Rust-for-Linux comes in roughly 4 areas: - Kernel internals (kallsyms expansion for Rust symbols, %pA format) - Kbuild infrastructure (Rust build rules and support scripts) - Rust crates and bindings for initial minimum viable build - Rust kernel documentation and samples ' -- source: https://linux.slashdot.org/story/22/10/04/2259259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Laptop Users Should Avoid Linux 5.19.12 To Avoid Potentially Damaging The Display
by Peter Reutemann 06 Oct '22

06 Oct '22

'Intel laptop users running Linux are being advised to avoid running the latest Linux 5.19.12 stable kernel point release as it can potentially damage the display. From a report: Intel Linux laptop users on Linux 5.19.12 have begun reporting "white flashing" display issues with one user describing it as "[the] laptop display starts to blink like lights in a 90's rave party." Intel Linux kernel engineer Ville Syrjal posted this week on the kernel mailing list: "After looking at some logs we do end up with potentially bogus panel power sequencing delays, which may harm the LCD panel."' -- source: https://linux.slashdot.org/story/22/10/05/141248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CTO Wants Developers To Build Once, Run On Any GPU
by Peter Reutemann 05 Oct '22

05 Oct '22

'Greg Lavender, CTO of Intel, spoke to VentureBeat about the company's efforts to help developers build applications that can run on any operating system. From the report: "Today in the accelerated computing and GPU world, you can use CUDA and then you can only run on an Nvidia GPU, or you can go use AMD's CUDA equivalent running on an AMD GPU,â Lavender told VentureBeat. "You can't use CUDA to program an Intel GPU, so what do you use?" That's where Intel is contributing heavily to the open-source SYCL specification (SYCL is pronounced like "sickle") that aims to do for GPU and accelerated computing what Java did decades ago for application development. Intel's investment in SYCL is not entirely selfless and isn't just about supporting an open-source effort; it's also about helping to steer more development toward its recently released consumer and data center GPUs. SYCL is an approach for data parallel programming in the C++ language and, according to Lavender, it looks a lot like CUDA. To date, SYCL development has been managed by the Khronos Group, which is a multi-stakeholder organization that is helping to build out standards for parallel computing, virtual reality and 3D graphics. On June 1, Intel acquired Scottish development firm Codeplay Software, which is one of the leading contributors to the SYCL specification. "We should have an open programming language with extensions to C++ that are being standardized, that can run on Intel, AMD and Nvidia GPUs without changing your code," Lavender said. Lavender is also a realist and he knows that there is a lot of code already written specifically for CUDA. That's why Intel developers built an open-source tool called SYCLomatic, which aims to migrate CUDA code into SYCL. Lavender claimed that SYCLomatic today has coverage for approximately 95% of all the functionality that is present in CUDA. He noted that the 5% SYCLomatic doesn't cover are capabilities that are specific to Nvidia hardware. With SYCL, Lavender said that there are code libraries that developers can use that are device independent. The way that works is code is written by a developer once, and then SYCL can compile the code to work with whatever architecture is needed, be it for an Nvidia, AMD or Intel GPU. Looking forward, Lavender said that he's hopeful that SYCL can become a Linux Foundation project, to further enable participation and growth of the open-source effort. [...] "We should have write once, run everywhere for accelerated computing, and then let the market decide which GPU they want to use, and level the playing field," Lavender said. ' -- source: https://news.slashdot.org/story/22/10/04/2225214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VideoLAN threatens to sue India gov’t as ISPs keep blocking VLC website
by Peter Reutemann 05 Oct '22

05 Oct '22

'VideoLAN is threatening to sue India's government, saying it has received no explanation for why the VLC website has been blocked by Indian ISPs for the past six months. "In March 2022, to our shock and dismay, the URL 'https://www.videolan.org/' appeared to have been blocked for viewing in India without any prior notice to me or any other person in the organization," VideoLAN president and lead VLC developer Jean-Baptiste Kempf wrote in a September 30 letter to India's Department of Telecommunications. "Despite reportage and uproar on social media, no reasons for blocking the URL were provided to us, or to the Indian public." The letter said attempts to reach the URL in India resulted in the message, "Your requested URL has been blocked as per the directions received from the Department of Telecommunications, Government of India." VideoLAN is a French nonprofit organization that developed the free, open source VLC Media Player. In an email, Kempf told Ars that "VideoLAN is an organization that does not do politics (we only take position on anti-DRM and pro-open source subjects). So this topic is a bit of a shock to us." VideoLAN's letter told Indian government officials that the blocking "is particularly shocking to us, since the Government of India itself endorses the use of VLC as a part of its Digital India initiative, where it has expressed its intention to use open-source softwares for government applications. In fact, the Government of India also appears to use VLC Media Player's icon and logo on its website promoting open source softwares." The letter to India's government said, "VLC is currently being used by 80 million Indians, and has consistently seen an average of 25 million downloads per year in India since its release. For millions of Indians VLC is the primary choice for running all kinds of media formats for free."' -- source: https://arstechnica.com/tech-policy/2022/10/videolan-gets-no-answers-on-why… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 22.10 (Kinetic Kudu) Beta Released with GNOME 43, Linux Kernel 5.19
by Peter Reutemann 04 Oct '22

04 Oct '22

'Featuring the latest GNOME 43 desktop environment, Ubuntu 22.10 beta comes with PipeWire as the default sound system, which is accompanied by WirePlumber as its session and policy manager, GCC 12 as the default system compiler, support for the WebP image format out of the box, as well as updated components and apps. But the most interesting part of this release is the fact that Ubuntu Unity is now available as an official flavor, featuring the good old Unity7 desktop environment on top of an Ubuntu 22.10 base. Canonical decided to accept Ubuntu Unity as an official flavor starting with the Kinetic Kudu release in late October.' -- source: https://9to5linux.com/ubuntu-22-10-kinetic-kudu-beta-released-with-gnome-43… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

North Island GP Network Compromised
by Lawrence D'Oliveiro 04 Oct '22

04 Oct '22

Pinnacle Midlands Health Network, which services medical practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato, had its systems broken into last Wednesday, though the incident is only coming to light today <https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o…>. It doesn’t appear like they hold medical information about patients (beyond NHI numbers), only personal contact details.

1 0

Patient details compromised in cyber attack on North Island GP network
by Peter Reutemann 04 Oct '22

04 Oct '22

NZ Herald reports: 'Patient details have been compromised in a cyber attack targeting a network of GP services across the North Island. Pinnacle Midlands Health Network said in a statement that the "cyber incident" impacted some of its IT services. Offices and practices in Taranaki, Rotorua, Taupō-Tūrangi, Thames-Coromandel and Waikato were impacted. [...] Pinnacle holds personal information such as names, addresses and national health index numbers. Butcher said GP notes were not stored on their files.' -- source: https://www.nzherald.co.nz/nz/patient-details-compromised-in-cyber-attack-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Still can’t buy a Raspberry Pi board? Things aren’t getting better anytime soon
by Peter Reutemann 04 Oct '22

04 Oct '22

'Shortages for lots of tech components, including things like DDR5 and GPUs, have eased quite a bit since the beginning of 2022, and prices have managed to go down as availability improves. But that reprieve hasn't come for hobbyists hoping to get a Raspberry Pi, which remains as hard to buy today as it was a year ago. The most recent update on the situation comes from Raspberry Pi founder Eben Upton via YouTuber Jeff Geerling—Upton told Geerling that Pi boards are subject to the same supply constraints since the last time he wrote a post about the situation in April. Around 400,000 Pi boards are still produced per month, and some of these are being earmarked to be sent out to consumer retail sites. But Upton says that most of these are still being reserved for and sold to commercial customers who rely on Pi boards to run their businesses.' -- source: https://arstechnica.com/gadgets/2022/10/still-cant-buy-a-raspberry-pi-board… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 arrives with support for newer chips, core fixes, and oddities
by Peter Reutemann 04 Oct '22

04 Oct '22

'A stable version of Linux 6.0 is out, with 15,000 non-merge commits and a notable version number for the kernel. And while major Linux releases only happen when the prior number's dot numbers start looking too big—"there is literally no other reason"—there are a lot of notable things rolled into this release besides a marking in time. Most notable among them could be a patch that prevents a nearly two-decade slowdown for AMD chips, based on workaround code for power management in the early 2000s that hung around for far too long. Intel's Dave Hansen wrote the patch that made it into 6.0, noting in a comment on an Ars post that the issue had become an expensive drain as AMD systems gained higher CPU core counts. The average desktop user won't see huge gains, but larger systems working on intensive input/output applications should benefit. Intel's new Arc GPUs are supported in their discrete laptop form in 6.0 (though still experimental). Linux blog Phoronix notes that Intel's ARC GPUs all seem to run on open source upstream drivers, so support should show up for future Intel cards and chipsets as they arrive on the market. Linux 6.0 includes several hardware drivers of note: fourth-generation Intel Xeon server chips, the not-quite-out 13th-generation Raptor Lake and Meteor Lake chips, AMD's RDNA 3 GPUs, Threadripper CPUs, EPYC systems, and audio drivers for a number of newer AMD systems. One small, quirky addition points to larger things happening inside Linux. Lenovo's ThinkPad X13s, based on an ARM-powered Qualcomm Snapdragon chip, get some early support in 6.0. ARM support is something Linux founder Linus Torvalds is eager to see—he recently wrote release notes for kernel versions from his M2-powered MacBook Air and believes that more people using Linux on ARM devices leads to more bug reports, more patches, and more enthusiasm. Among other changes you can find in Linux 6.0, as compiled by LWN.net (in part one and part two): - ACPI and power management improvements for Sapphire Rapids CPUs - Support for SMB3 file transfer inside Samba, while SMB1 is further deprecated - More work on RISC-V, OpenRISC, and LoongArch technologies - Intel Habana Labs Gaudi2 support, allowing hardware acceleration for machine-learning libraries - A "guest vCPU stall detector" that can tell a host when a virtual client is frozen Not included in 6.0 are Rust enhancements, but those are likely coming in the next point release, 6.1. Rust, a memory-safe language sponsored by the Mozilla project, started out as something Torvalds took a wait-and-see approach toward and is now something he was hoping to see in 6.0. "Unless something odd happens, it will make it into 6.1," Torvalds told ZDNet's Steven Vaughan-Nichols in mid-September. Even just having the "core infrastructure" for Rust in 6.1 signifies a big change in Linux, which has long been dominated by C languages (however extended and modified). It must be noted that in 2022, there are patches in Linux 6.0 to help Atari's Falcon computers from the early 1990s (or their emulated descendants) better handle VGA modes, color, and other issues.' -- source: https://arstechnica.com/gadgets/2022/10/linux-6-0-arrives-with-support-for-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fall And Rise Of Xen
by Lawrence D'Oliveiro 03 Oct '22

03 Oct '22

Here’s a report <https://www.theregister.com/2022/09/30/citrix_xen/> on a talk by the software development manager at Citrix, detailing the ups and downs in the history of their Xen hypervisor. Initially they had a “freemium” model, with an open-source “community” version and a proprietary paid “enterprise” version with more capabilities. This worked well and brought in sufficient revenue to be sustainable. Then they decided to switch to make the “enterprise” version open-source as well, relying on customers’ willingness to continue to pay maintenance rather than support the code themselves. This bet failed to pay off, and revenue crashed. On the other hand, Citrix did not include the “accompanying tooling” (not sure what they mean here -- build tools? Add-on admin tools?) with the source code, making it hard for others to use that code. (Were the big “enterprise” users the ones able to figure that out?) Then they tried to go back to a “freemium” model, with restrictions being imposed on the open-source version. While this did restore the revenue stream, it also antagonized a significant part of the community that had been using the open-source version in various unusual and creative ways. These users forked the code to create XCP-ng, leaving Citrix behind. I suppose the lesson to take from this is that “freemium” works, but it is best if you do things that way from the beginning: trying to switch to it (or switch back to it) from an all-Free model can be painful.

1 0

OpenWRT on Linksys WRT1900ACS
by Peter Reutemann 03 Oct '22

03 Oct '22

Hi everyone I finally bit the bullet and installed OpenWRT on my Linksys WRT1900ACS (v2) router. The main reason was the stupid (and incredibly insecure) guest network implementation that the router came with. Despite supplying a password in the admin interface, the network was run as an open network that anyone could access. The password didn't seem to be used at all... Not exactly what I had in mind! Since Ian presented on OpenWRT before, I at least had a rough idea on what I could expect in user interface and functionality, which helped a lot. :-) In case someone should have the same router, I found the following links very useful: - general info on the router and links to images https://openwrt.org/toh/linksys/wrt1900acs - tutorial for migrating your router to OpenWRT https://www.albertogonzalez.net/how-to-install-openwrt-on-the-linksys-wrt19… NB: you need to plug in via ethernet after flashing, since the wlan is not enabled by default - getting fibre working here in NZ (VLAN 10) http://www.lindesay.co.nz/blog/2019/2019-openwrt-nz-fibre/ - setting up a guest wifi network https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_we… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Chooses Reasonable, Common Sense Solution To Dealing With Non-Free Firmware
by Peter Reutemann 03 Oct '22

03 Oct '22

'Michael Larabel writes via Phoronix: Debian developers have been figuring out an updated stance to take on non-free firmware considering the increasing number of devices now having open-source Linux drivers but requiring closed-source firmware for any level of functionality. The voting on the non-free firmware matter has now concluded and the votes tallied... The debian votes option 5 as winning: "Change SC for non-free firmware in installer, one installer." Basically the Debian Installer media will now be allowed to include non-free firmware and to automatically load/use it where necessary while informing the user of it, etc. Considering the state of the hardware ecosystem these days, it's reasonable and common sense since at least users will be able to easily make use of their graphics cards, network adapters, and more. Plus a number of modern CPU security mitigations also requiring the updated closed-source microcode. So all in, I am personally happy with this decision as it will allow for a more pleasant experience for Debian on modern systems and one akin to what is found with other Linux distributions. The solution is described in full via the Debian Wiki.' -- source: https://linux.slashdot.org/story/22/10/02/1650200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quis Custodiet Ipsos Custodes?
by Lawrence D'Oliveiro 01 Oct '22

01 Oct '22

Came across yet another crop of articles recently which painfully highlight the problems with having social-media companies manage their own moderation. This one <https://arstechnica.com/gaming/2022/09/youtube-age-restriction-quagmire-exp…> shows the inconsistencies in the criteria that YouTube uses to apply age restrictions to uploaded videos. Not only are the criteria mysterious, but the appeal process is opaque, and too often the only way to get results is by appeal to the popular fanbase. Assuming you have one. Related to that, Facebook earlier banned any promotion on its platform of a re-release of a movie called “Beautiful Blue Eyes” <https://arstechnica.com/tech-policy/2022/09/holocaust-filmmaker-says-meta-d…>, seemingly not because of its content (partly set during the Nazi Holocaust), but because of the title. An appeal was rejected with “our decision is final”. Only for the ban to be lifted later, absolutely nothing to do with any public outcry, you can take our word on that. Then there is this coronial inquest <https://arstechnica.com/tech-policy/2022/09/coroner-lists-instagram-algorit…> into the self-inflicted death of a young teen who had been watching way too many posts on Pinterest and Instagram promoting self-harm. Pinterest at least had the humility to admit that their moderation system was not satisfactory and needed to be improved. But Meta (parent company of Instagram and Facebook) sent their “head of health and well-being” to testify that the content was classified as “safe” according to their standards. Free speech between mature adults is one thing, keeping impressionable youngsters safe is quite another.

2 2

Google Delays the Death of Manifest V2 Extensions To 2024
by Peter Reutemann 01 Oct '22

01 Oct '22

'Google announced an extension of the deadline to remove support for Manifest V2 extensions in the company's Chrome browser and the open source Chromium core. The change does not impact the core decision of removing support for Manifest V2 extensions in favor of Manifest V3. Dubbed, the adblocker killer initially, due to limitations imposed on content blocking and other types of browser extensions, Google made concessions that allows content blockers to run on Chrome after the final switch is made. Extensions are still limited in comparison to Manifest V2, especially if multiple that use filtering functionality are run simultaneously, or if lots of filters are activated in a single extension. Google's initial plan was to stop supporting Manifest V2 extensions in Chrome by June 2023. For most users, support would run out in January 2023, but an Enterprise policy would enable users to extend the deadline by six months.' -- source: https://tech.slashdot.org/story/22/09/30/1437209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

2022 Web Almanac
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Report <https://devclass.com/2022/09/29/massive-web-tech-survey-shows-how-bad-habit…> on the 2022 Web Almanac (sort of a “state of the Web” report), which is in the process of being published. * WebAssembly is still not being used a lot * WordPress is one of the worst-performing content-management systems, and also still the most popular (and its popularity is still growing) * Image formats: the time has come to move beyond sRGB and 1990s-era formats (e.g. replace JPEG with the more efficient WebP) * JavaScript: a lot of pages seem to load code which is not actually used I was looking up how page-loading performance is measured, and here is my understanding of what the terms mean: * Largest Contentful Paint (LCP): the time to render the largest image/text block on the page. * First Input Delay (FID): how long after the user clicks on a link or a control etc before the browser starts responding. * Cumulative Layout Shift (CLS): a measure of how much things move around on the page while the page is still loading. This is a product of the “impact fraction” (proportion of the viewport affected by movements between frames) and the “distance fraction” (largest distance moved by an element, as a fraction of viewport size).

1 0

Creator Of COVID-19 Tracker Dashboard Wins Science Prize
by Lawrence D'Oliveiro 30 Sep '22

30 Sep '22

Professor Lauren Gardner has been awarded the 2022 Lasker-Bloomberg Public Service Award <https://www.aljazeera.com/news/2022/9/29/creator-of-johns-hopkins-covid-tra…> for co-creating the Johns Hopkins COVID-19 dashboard. This has been collecting and making available information about the pandemic since almost before it came to world attention. For those who don’t want to go through that Twitter link, the dashboard is here <https://gisanddata.maps.arcgis.com/apps/dashboards/bda7594740fd40299423467b…>. Just tried the “Raw Data” link, and it goes to this GitHub area <https://github.com/CSSEGISandData>.

1 0

Numerous orgs hacked after installing weaponized open source apps
by Peter Reutemann 30 Sep '22

30 Sep '22

'Hackers backed by the North Korean government are weaponizing well-known pieces of open source software in an ongoing campaign that has already succeeded in compromising "numerous" organizations in the media, defense and aerospace, and IT services industries, Microsoft said on Thursday. ZINC—Microsoft's name for a threat actor group also called Lazarus, which is best known for conducting the devastating 2014 compromise of Sony Pictures Entertainment—has been lacing PuTTY and other legitimate open source applications with highly encrypted code that ultimately installs espionage malware. The hackers then pose as job recruiters and connect with individuals of targeted organizations over LinkedIn. After developing a level of trust over a series of conversations and eventually moving them to the WhatsApp messenger, the hackers instruct the individuals to install the apps, which infect the employees' work environments. "The actors have successfully compromised numerous organizations since June 2022," members of the Microsoft Security Threat Intelligence and LinkedIn Threat Prevention and Defense teams wrote in a post. "Due to the wide use of the platforms and software that ZINC utilizes in this campaign, ZINC could pose a significant threat to individuals and organizations across multiple sectors and regions." PuTTY is a popular terminal emulator, serial console, and network file transfer application that supports network protocols, including SSH, SCP, Telnet, rlogin, and raw socket connection. Two weeks ago, security firm Mandiant warned that hackers with ties to North Korea had Trojanized it in a campaign that successfully compromised a customer's network. Thursday's post said the same hackers have also weaponized KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software with code that installs the same espionage malware, which Microsoft has named ZetaNile.' -- source: https://arstechnica.com/information-technology/2022/09/north-korean-threat-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Security Recommendation: Try Turning It Off And On Again
by Lawrence D'Oliveiro 29 Sep '22

29 Sep '22

This report on the “Chaos” malware suite <https://arstechnica.com/information-technology/2022/09/never-before-seen-ma…> contains an interesting snippet: A reminder to small office router owners everywhere: Most router malware can't survive a reboot. Consider restarting your device every week or so. Seems like server-based malware is predominantly running entirely from RAM these days, to avoid leaving any forensic traces in the filesystem. But you can use this characteristic against them, since a simple reboot becomes enough to clear the infection.

1 0

We interviewed Linux OS through an AI bot to discover its secrets
by Peter Reutemann 29 Sep '22

29 Sep '22

'Millions of people use Linux every day, but we rarely stop to think about how the operating system feels about it. Wouldn't it be nice to know what Linux really thinks about open source, Windows, Macs, and the command line? Until now, this has been impossible. But thanks to a new AI chat tool, we're able to find out. Two weeks ago, a website called Character.AI opened a public beta that allows visitors to create a chat bot based on any character they can imagine. You input a few parameters, and the AI does the rest using a large language model similar to GPT-3. So we called forth "The Linux OS" as a bot to ask it a few questions about itself. The results were fun and surprising. Using Character.AI is a lot like a texting conversation. You type in what you want to ask, and you read the AI character's responses in written form as the chat history scrolls upward. As with GPT-3, the code behind Character.AI has likely learned from absorbing millions of text sources found on the Internet. As such, its AI characters can easily respond with erroneous or fictional information. In fact, the site carries a bold disclaimer reading, "Remember: Everything Characters say is made up!" [...] Linux: Hello, I am Linux, an open-source operating system. Ars Technica: Hello, this is Benj Edwards, and I am a journalist at Ars Technica. I would like to ask you some questions in an interview. Is that OK? Linux: I, Linux, would be pleased to provide such an interview. Ars: How old are you? Linux: I was "born" in 1991, although the first public release was version 1.0 in 1994.' -- source: https://arstechnica.com/information-technology/2022/09/we-interviewed-linux… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Serious vulnerabilities in Matrix’s end-to-end encryption have been patched
by Peter Reutemann 29 Sep '22

29 Sep '22

'Developers of the open source Matrix messenger protocol are releasing an update on Thursday to fix critical end-to-end encryption vulnerabilities that subvert the confidentiality and authentication guarantees that have been key to the platform's meteoric rise. Matrix is a sprawling ecosystem of open source and proprietary chat and collaboration clients and servers that are fully interoperable. The best-known app in this family is Element, a chat client for Windows, macOS, iOS, and Android, but there's a dizzying array of other members as well. Matrix roughly aims to do for real-time communication what the SMTP standard does for email, which is to provide a federated protocol allowing user clients connected to different servers to exchange messages with each other. Unlike SMTP, however, Matrix offers robust end-to-end encryption, or E2EE, designed to ensure that messages can't be spoofed and that only the senders and receivers of messages can read the contents. Matthew Hodgson—the co-founder and project lead for Matrix and the CEO and CTO at Element, the maker of the flagship Element app—said in an email that conservative estimates are that there are about 69 million Matrix accounts spread throughout some 100,000 servers. The company currently sees about 2.5 million monthly active users using its Matrix.org server, though he said this is also likely an underestimate. Among the hundreds of organizations announcing plans to build internal messaging systems based on Matrix are Mozilla, KDE, and the governments of France and Germany. On Wednesday, a team of researchers published research that reports a host of vulnerabilities that undermine Matrix's authentication and confidentiality guarantees. All of the attacks described by the researchers require the aid of a malicious or compromised homeserver that targets the users who connect to it. In some cases, there are ways for experienced users to detect an attack is underway.' -- source: https://arstechnica.com/information-technology/2022/09/matrix-patches-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stock Hacking TV Footage
by Lawrence D'Oliveiro 27 Sep '22

27 Sep '22

On the TVNZ news a few minutes ago, in the stock footage they were showing while John Campbell was talking about some tech-related story or other, I saw the words “struct group_info init_groups” pop up. So I did an online search, and found this Reddit thread <https://www.reddit.com/r/InternetIsBeautiful/comments/g8hcgo/this_site_make…>. Turns out there’s a website where you can pretend to be typing furiously, and this text comes up, as though it was what you were typing, to let you play at being a hacker on TV. Incidentally, the code in question is based on real code, from the Linux kernel.

1 0

20-year-old Linux workaround is still slowing down AMD systems
by Peter Reutemann 27 Sep '22

27 Sep '22

'AMD has come a long way since 2002, but the Linux kernel still treats modern Threadrippers like Athlon-era systems—at least in one potentially lag-inducing respect. AMD engineer Prateek Nayak recently submitted a patch to Linux's processor idle drivers that would "skip dummy wait for processors based on the Zen microarchitecture." When ACPI support was added to the Linux kernel in 2002—written by Andy Grover, committed by Linus Torvalds—it included a "dummy wait op." The system essentially read data with no purpose other than delaying the next instruction until the CPU could fully stop with the STPCLK# command. This allowed for some power saving and compatibility during the early days of ACPI implementation when some chipsets wouldn't move to an idle state when one would expect it. But today's Zen-based AMD chips don't need this workaround, and, as Nayak writes, it's hurting them, at least in specific workloads on Linux. Testing with instruction-based sampling (IBS) workloads shows that "a significant amount of time is spent in the dummy op, which incorrectly gets accounted as C-State residency." The CPU, seeing all this low-effort dummy work, can push into deeper, slower C-State, which then makes the CPU take longer to "wake up," especially on jobs that require lots of switching between busy and idle states. Nayak ran tests in tbench on a dual-socket Zen3 system against the baseline Linux kernel, a kernel with the C2 state entirely disabled, and a kernel with the dummy wait operation patched out. His patched version saw a 1,390 percent increase in minimum MB/s throughput and a 51 percent increase in mean MB/s over the baseline kernel, often just a little behind having C2 disabled entirely.' -- source: https://arstechnica.com/gadgets/2022/09/20-year-old-linux-workaround-is-sti… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Senators Introduce a Bill To Protect Open-Source Software
by Peter Reutemann 25 Sep '22

25 Sep '22

'Washington Post: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could've affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they're co-sponsoring. The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j "incident presented a serious threat to federal systems and critical infrastructure companies -- including banks, hospitals, and utilities -- that Americans rely on each and every day for essential services," Peters said in a written statement. "This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation." Here's how the Peters-Portman legislation works, as outlined in the report: - It directs CISA to hire open-source experts "to the greatest extent practicable." - It gives the agency a year to publish a framework on open-source code risk. A year later and periodically thereafter, CISA would perform an assessment of open-source code components that federal agencies commonly use. - Also, two years after publishing the initial framework, CISA would have to study whether it could be used in critical infrastructure outside the government and potentially work with one or more critical infrastructure sectors to voluntarily test the idea. - Other agencies would have roles as well, such as the Office of Management and Budget publishing guidance to federal chief information officers on secure use of open-source software. ' -- source: https://news.slashdot.org/story/22/09/23/2357254 What about donating time/money to "critical" open source projects? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AV1 Update Reduces CPU Encoding Times By Up To 34 Percent
by Peter Reutemann 25 Sep '22

25 Sep '22

'According to Phoronix, Google has released a new AOM-AV1 update -- version 3.5, that drastically improves encode times when streaming, rendering, or recording from the CPU. At its best, the update can improve encoding times by up to 34%. Tom's Hardware reports: It is a fantastic addition to AV1's capabilities, with the encoder becoming very popular among powerful video platforms such as YouTube. In addition, we are also seeing significant support for AV1 hardware acceleration on modern discrete GPUs now, such as Intel's Arc Alchemist GPUs and, most importantly - Nvidia's RTX 40-series GPUs. Depending on the resolution, encoding times with the new update have improved by 20% to 30%. For example, at 1080P, encode times featuring 16 threads of processing are reduced by 18% to 34%. At 4K, render times improved by 18% to 20% with 32 threads. Google could do this by adding Frame Parallel Encoding to heavily multi-threaded configurations. Google has also added several other improvements contributing to AV1's performance uplifts in other areas - specifically in real-time encoding. In other words, CPU utilization in programs such as OBS has been reduced, primarily for systems packing 16 CPU threads. As a result, they are allowing users to use those CPU resources for other tasks or increase video quality even higher without any additional performance cost. If you are video editing and are rendering out a video in AV1, processing times will be vastly reduced if you have a CPU with 16 threads or more. ' -- source: https://news.slashdot.org/story/22/09/24/1749206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Urges Action To Unpick Platform Browser Lock-ins
by Peter Reutemann 23 Sep '22

23 Sep '22

'As antitrust regulators around the world dial up scrutiny of platform power, Mozilla has published a piece of research digging into the at times subtle yet always insidious ways operating systems exert influence to keep consumers locked to using their own-brand browsers rather than seeking out and switching to independent options -- while simultaneously warning that competition in the browser market is vital to ensure innovation and choice for consumers and, more broadly, protect the vitality of the open web against the commercial giants trying to wall it up. TechCrunch: "Billions of people across the globe are dependent on operating systems from the largest technology companies. Amazon, Apple, Google, Microsoft and Meta each provide their own browser on their operating systems and each of them uses their gatekeeper position provider to preference their own browsers over independent rivals. Whether it is Microsoft pushing Firefox users to switch their default on Windows computers, Apple restricting the functionality of rival browsers on iOS smartphones or Google failing to apply default browser settings across Android, there are countless examples of independent browsers being inhibited by the operating systems on which they are dependent," Mozilla writes in a summary of its findings. "This matters because American consumers and society as a whole suffer. Not only do people lose the ability to determine their own online experiences but they also receive less innovative and lower quality products. In addition, they can be forced to accept poorer privacy outcomes and even unfair contracts. By contrast, competition from independent browsers can help to drive new features, as well as innovation in areas like privacy and security."' -- source: https://tech.slashdot.org/story/22/09/22/1841231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU Grep 3.8 Starts Issuing Warnings About Using Egrep and Fgrep
by Peter Reutemann 22 Sep '22

22 Sep '22

'After 104 commits from six different people, GNU grep was released Saturday, reports Phoronix. The biggest change? "It's now made more clear that if you are still relying on the egrep and fgrep commands, it's past due for switching to just grep with the appropriate command-line arguments." The egrep and fgrep commands have been deprecated since 2007. Beginning with GNU Grep 3.8 today, calling these commands will now issue a warning to the user that instead they should use grep -E and grep -F, respectively. Eventually, GNU Grep will drop the egrep / fgrep commands completely but there doesn't seem to be a firm deadline yet for when that removal will happen. >From grep's updated manual: 7th Edition Unix had commands egrep and fgrep that were the counterparts of the modern 'grep -E' and 'grep -F'. Although breaking up grep into three programs was perhaps useful on the small computers of the 1970s, egrep and fgrep were not standardized by POSIX and are no longer needed. In the current GNU implementation, egrep and fgrep issue a warning and then act like their modern counterparts; eventually, they are planned to be removed entirely. If you prefer the old names, you can use use your own substitutes, such as a shell script... Other notable changes from the release announcement: - The confusing GREP_COLOR environment variable is now obsolescent. Instead of GREP_COLOR='xxx' use GREP_COLORS='mt=xxx' - Regular expressions with stray backslashes now cause warnings' -- source: https://news.slashdot.org/story/22/09/05/0135254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Repairable, upgradeable Framework Laptop will also be available as a Chromebook
by Peter Reutemann 22 Sep '22

22 Sep '22

'Fans of the modular Framework Laptop who also prefer ChromeOS to Windows or Linux are in for a treat: Framework and Google are announcing a Chromebook Edition of the laptop today. It has the same basic hardware design and works with most of the same parts as the regular Framework Laptop but with tweaks to make it a full-fledged Chromebook. While you could always take a standard Framework Laptop and install ChromeOS Flex on it, the standard version of ChromeOS still has a few features that Flex doesn't, including Android app support via Google Play, automated firmware updates, and a few other security and device management features. Framework says that the Chromebook Edition laptop will be available for preorder starting today—a version with a Core i5-1240P CPU will cost $999, although you'll only need to put down $100 to reserve your preorder. Orders begin shipping in December. Framework is also putting parts specific to the Chromebook Edition laptop into its Framework Marketplace parts store.' -- source: https://arstechnica.com/gadgets/2022/09/repairable-upgradeable-framework-la… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Document Foundation Starts Charging For 'Free' LibreOffice
by Peter Reutemann 22 Sep '22

22 Sep '22

'The Document Foundation, the organization that tends the open source productivity suite LibreOffice, has decided to start charging for one version of the software. The Register reports: LibreOffice is a fork of OpenOffice and is offered under the free/open source Mozilla Public License Version 2.0. A Monday missive from the Document Foundation reveals the org will begin charging 8.99 euros for the software -- but only when sold via Apple's Mac App Store. That sum has been styled a "convenience fee ... which will be invested to support development of the LibreOffice project." The foundation suggests paying up in the Mac App Store is ideal for "end users who want to get all of their desktop software from Apple's proprietary sales channel." Free downloads of LibreOffice for macOS from the foundation's site will remain available and arguably be superior to the App Store offering, because that version will include Java. The foundation argued that Apple does not permit dependencies in its store, so it cannot include Java in the 8.99 euro offering. The version now sold in the App Store supersedes a previous offering provided by open source support outfit Collabora, which charged $10 for a "Vanilla" version of the suite and threw in three years of support. The foundation's marketing officer Italo Vignoli said the change was part of a "new marketing strategy." "The Document Foundation is focused on the release of the Community version, while ecosystem companies are focused on a value-added long-term supported versions targeted at enterprises," Vignoli explained. "The distinction has the objective of educating organizations to support the FOSS project by choosing the LibreOffice version which has been optimized for deployments in production and is backed by professional services, and not the Community version generously supported by volunteers." "The objective is to fulfil the needs of individual and enterprise users in a better way," Vignoli added, before admitting "we know that the positive effects of the change will not be visible for some time. Educating enterprises about FOSS is not a trivial task and we have just started our journey in this direction."' -- source: https://apple.slashdot.org/story/22/09/20/2039208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Linus Torvalds: Rust Will Go Into Linux 6.1
by Peter Reutemann 20 Sep '22

20 Sep '22

'As previously indicated on Slashdot, Rust was slated to be coming to the Linux Kernel sometime in the 6.x version. Well wonder no longer on which version of kernel 6.x will have the first bits of Rust officially in the kernel, as Linus has confirmed that 6.1 will be the first with the new NVMe kernel drivers being in Rust. The first version non-production ready code for the NVMe Rust based kernel drivers were already producing performance comparable to C code. So the final drivers to hit 6.1 are already looking promising. It also helped Rust's case that, thanks to the ground-breaking work of Linux kernel and Rust developer Miguel Ojeda, Rust on Linux has gotten much more mature. Kernel maintainers were convinced it is time to move forward with Rust in Linux. In short, they agreed that Rust on Linux was ready for work.' -- source: https://linux.slashdot.org/story/22/09/19/205239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next *Tuesday* (since Monday is remembrance day) with the following topic: 'People that never learned to touch type find that typing can severely impede creativity. Rod Aldridge will talk about his experience of getting Google's speech-to-text working on his computer to speed up his writing, what to look out for, how it works and how well it works.' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776705/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting next Monday
by Peter Reutemann 20 Sep '22

20 Sep '22

Hi everyone We have a meeting next week on Monday but no speaker so far. Anyone keen on demoing or presenting (distro/software/etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Chrome for Android gets fingerprint-protected Incognito tabs
by Peter Reutemann 19 Sep '22

19 Sep '22

'Here's a fun new feature for Chrome for Android: fingerprint-protected Incognito tabs. 9to5Google discovered the feature in the Chrome 105 stable channel, though you'll have to dig deep into the settings to enable it at the moment. If you want to add a little more protection to your private browsing sessions, type "chrome://flags/#incognito-reauthentication-for-android" into the address bar and hit enter. After enabling the flag and restarting Chrome, you should see an option to "Lock Incognito tabs when you leave Chrome." If you leave your Incognito session and come back, an "unlock Incognito" screen will appear instead of your tabs, and you'll be asked for a fingerprint scan. Chrome on iOS has had a biometrics-backed Incognito feature, called "Privacy Screen," for a few years. This is a first for Android, though. Chrome's "flags" menu is technically for experiments and in-development features, so this isn't guaranteed to become a readily accessible user feature, but making it to the stable channel—plus the feature already existing on iOS—is a good sign.' -- source: https://arstechnica.com/gadgets/2022/09/chrome-for-android-gets-fingerprint… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beloved browser extension acquired by non-beloved antivirus firm
by Peter Reutemann 19 Sep '22

19 Sep '22

'Browser extension I don't care about cookies does one job and does it well. It automatically removes the annoying-but-mandated "This website uses cookies" notices from websites. People like it, donate to it, and don't ask more of it, a rare find for free software. "Damn, this is the **** bro, it saved like 50 minutes of my gaming time lol," reads one review on the tool's Microsoft Edge Add-Ons page. The tone changed when the solo developer posted "GREAT NEWS" on the extension's website. Avast, a giant in cybersecurity that just completed an $8.1 billion merger with NortonLifeLock, will acquire the 10-year-old software for an undisclosed price.' -- source: https://arstechnica.com/gadgets/2022/09/beloved-browser-extension-acquired-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Aims To Support the $16+ Sipeed LicheeRV and Other RISC-V Boards
by Peter Reutemann 19 Sep '22

19 Sep '22

'"In addition to Ubuntu supporting the StarFive VisionFive and Nezha RISC-V boards, Canonical engineers are also working on supporting the Sipeed LicheeRV board too for next month's 22.10 release," reports Phoronix. "The Sipeed LicheeRV is notable in being one of the cheapest RISC-V boards out there: pricing starts at $16.90 USD...." The Sipeed LicheeRV uses the Allwinner D1 SoC and is powered by a single-core XuanTie C906 64-bit RISC-V processor. This single-core RISC-V processor runs at just 1.0GHz. Yes, this is a very cheap but slow board. The LicheeRV is primarily for networking purposes and other IoT use-cases.... The Sipeed LicheeRV was announced last year and initially targeting support for OpenWrt-based Linux distributions, but Canonical recently has been working on getting support for this RISC-V board squared away in time for Ubuntu 22.10. This appears to be part of an increasing focus by the Ubuntu maker for being a leading distribution contender for RISC-V hardware.' -- source: https://hardware.slashdot.org/story/22/09/17/1728244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fun Mistake Of The Week
by Lawrence D'Oliveiro 17 Sep '22

17 Sep '22

Yesterday I was writing a simple, harmless little Python script. I tried running it for the first time, and my terminal session seemed to lock up. A crosshair cursor appeared. I tried clicking in various places and hitting CTRL/C (and other keystrokes) several times. After several tries, I managed to stop the script and get my terminal session back. This happened a couple of times, until I realized my Python script was missing the “#!/usr/bin/python3” “shebang” line at the top. So when I executed it, the system assumed it was a shell script. And the very first command it saw was an “import” statement, which it interpreted as an attempt to call the ImageMagick “import” command <https://imagemagick.org/script/import.php>. This command lets you capture screenshots of selected windows or the entire screen, or parts thereof. Which is where the crosshair cursor came from. And because I had several of these import statements, after I managed to terminate one, it went on to the next one. Once I added the missing script-interpreter line, my script started behaving a bit more sensibly. ;)

1 0

Trojanized versions of PuTTY utility being used to spread backdoor
by Peter Reutemann 17 Sep '22

17 Sep '22

'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility in an attempt to backdoor the network of organizations they want to spy on. Researchers from security firm Mandiant said on Thursday that at least one customer it serves had an employee who installed the fake network utility by accident. The incident caused the employer to become infected with a backdoor tracked by researchers as Airdry.v2. The file was transmitted by a group Mandiant tracks as UNC4034.' -- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Nearly One In Two Industry Pros Scaled Back Open Source Use Over Security Fears
by Peter Reutemann 16 Sep '22

16 Sep '22

'The Register: About 40 percent of industry professionals say their organizations have reduced their usage of open source software due to concerns about security, according to a survey conducted by data science firm Anaconda. The company's 2022 State of Data Science report solicited opinions in April and May from 3,493 individuals from 133 countries and regions, targeting academics, industry professionals, and students. About 16 percent of respondents identified as data scientists. About 33 percent of surveyed industry professionals said they had not scaled back on open source, 7 percent said they had increased usage, and 20 percent said they weren't sure. The remaining 40 percent said they had. By industry professionals, or commercial respondents as Anaconda puts it, the biz means a data-science-leaning mix of business analysts, product managers, data and machine-learning scientists and engineers, standard IT folks such as systems administrators, and others in technology, finance, consulting, healthcare, and so on. And by scale back, that doesn't mean stop: 87 percent of commercial respondents said their organization still allowed the use of open source. It appears a good number of them, though, are seeking to reducing the risk from relying on too many open source dependencies. Anaconda's report found that incidents like Log4j and reports of "protestware" prompted users of open source software to take security concerns more seriously. Of the 40 percent who scaled back usage of open source, more than half did so after the Log4j fiasco. Some 31 percent of respondents said security vulnerabilities represent the biggest challenge in the open source community today. Most organizations use open source software, according to Anaconda. But among the 8 percent of respondents indicating that they don't, more than half (54 percent, up 13 percent since last year) cited security risks as the reason. Other reasons for not using open source software include: lack of understanding (38 percent); lack of confidence in organizational IT governance (29 percent); "open-source software is deemed insecure, so it's not allowed" (28 percent); and not wanting to disrupt current projects (26 percent).' -- source: https://news.slashdot.org/story/22/09/15/003243 Any library/tool, whether proprietary or not, on which many other systems rely has that same potential "security" problem (plenty of exploits in Windows/Mac, supply-chain corruptions, etc). Just because your code is proprietary doesn't make it any safer. You could simply spend some of your internal budget (that you didn't spend on developing these libraries), to do some code review on them and contribute back. Otherwise you're just a whinging freeloader... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Teams Stores Auth Tokens As Cleartext In Windows, Linux, Macs
by Peter Reutemann 15 Sep '22

15 Sep '22

'Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on. BleepingComputer reports: "This attack does not require special permissions or advanced malware to get away with major internal damage," Connor Peoples at cybersecurity company Vectra explains in a report this week. The researcher adds that by taking "control of critical seats -- like a company's Head of Engineering, CEO, or CFO -- attackers can convince users to perform tasks damaging to the organization." Vectra researchers discovered the problem in August 2022 and reported it to Microsoft. However, Microsoft did not agree on the severity of the issue and said that it doesn't meet the criteria for patching. With a patch unlikely to be released, Vectra's recommendation is for users to switch to the browser version of the Microsoft Teams client. By using Microsoft Edge to load the app, users benefit from additional protections against token leaks. The researchers advise Linux users to move to a different collaboration suite, especially since Microsoft announced plans to stop supporting the app for the platform by December. ' -- source: https://it.slashdot.org/story/22/09/14/1939242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploring GNOME-Based UIs For Mobile Linux Devices
by Peter Reutemann 15 Sep '22

15 Sep '22

'"The GNOME desktop environment is one of the most popular user interfaces and suites of apps available for desktop Linux distributions," writes Liliputing. "Now a team of developers have been working to bring GNOME to mobile devices running Linux-based operating systems." GNOME Shell for mobile provides a touch-friendly user interface optimized for smartphones and tablets. And while it looks a bit like Android or iOS at first glance, there are a few key differences. The GNOME team have outlined some of them in an article about recent updates to GNOME Shell on mobile. Like other modern mobile user interfaces, you interact with GNOME shell using taps, swipes, and other gesture-based navigation. What's different is that Android has three different views for navigation: a home screen, app drawer, and multitasking view. iOS has two: home screen and multitasking. But GNOME Shell has a single screen that allows you to view and launch apps and switch between running apps using gestures. There's no need to wait for a new screen to load. In a nutshell, you can swipe up from the bottom of the any screen to view a list of installed apps, thumbnail images showing all currently running apps, and a search box. You can tap an app icon to launch a new app, enter a term in the search box to find an app, or swipe between running apps to switch which app runs in the foreground. You can also keep swiping upward to shrink the multitasking thumbnails and provide more room for app icons. And you can flick thumbnail previews upward to remove an app from the multitasking section. Typing in the search box will bring up relevant results including apps and settings. "One interesting new feature here is that notifications can be swiped away horizontally to close, and notification bubbles can be swiped up to hide them..." the developers point out. "While the current version is definitely still work in progress, it's quite usable overall, so we feel it would make sense to start having experimental GNOME OS Nightly images with it." But Liliputing also notes that it's not the only GNOME-based UI for mobile devices. There's also Purism's Phosh UI — the default UI for the PureOS on its Librem 5 smartphone (and available for other mobile Linux distros including Debian). And Purism recently bragged that its smartphone is now also "the first mobile computer with a truly convergent OS" — meaning it can run on multiple hardware platforms, with apps adapting to their hardware. The Librem 5 [smartphone] uses the same convergent PureOS as our Librem 14 laptop and Mini PCs, with the same adaptive applications that make the Librem 5 more than merely a phone, it's a mobile computer in your pocket that can shape shift into a laptop, tablet, desktop, or even a server.... Scale your Librem 5 up to be a full laptop by attaching the Nexdock. Because our core apps are adaptive, they are ready to run on whatever screen you have.... With phosh-mobile-settings installed, you can flip the nexdock around and use the big screen just like a tablet.... Don't have a laptop dock? The Librem 5 can also act like a desktop computer when connected to a screen, keyboard, and mouse using our USB-C dock. Using the beta phom virtual mouse app, you can turn your Librem 5 into a touchpad mouse while it's connected to the big screen. With the Librem 5, you can keep your desktop computer in your pocket and connect to a bigger screen at home or at the office and use the same apps on the bigger screen without restarting.... With the Librem 5 phone, you're getting much more than smartphone to run mobile-only apps; you're getting a laptop, tablet, desktop, all running software that respects your privacy and freedom.' -- source: https://linux.slashdot.org/story/22/09/11/047224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

DuckDuckGo, Proton, Mozilla Throw Weight Behind Bill Targeting Big Tech 'Surveillance'
by Peter Reutemann 15 Sep '22

15 Sep '22

'A group of privacy-focused organizations have signed a letter imploring US Congress leaders to schedule a vote on a bill that would hamper data collection by tech giants and promote user access to online privacy tools. From a report: In its letter to Congress, addressed to the likes of Mitch McConnell and Nancy Pelosi, the alliance argued that the continued suppression of the American Innovation and Choice Online Act (AICOA) allows "dominant firms" to "limit competition and restrict user choice" when accessing privacy-focused technologies and products. It also accused tech giants of forcing users into accepting their policies of "perpetual surveillance" because of their positions as "gatekeepers," and of using their "influence in society" to steer users away from rival services more committed to privacy. Signatories included the likes of DuckDuckGo, Proton, Brave and Mozilla, among others, representing sectors ranging from VPN and search to web browsers, office software, and more. The letter to Congress fighting for the revival of the AICOA hit back at the idea that the US technology industry is a free market. The 13 signatories, all of which are relatively small in stature, claim the tech giants deliberately wield the depth and breadth of their product portfolios to establish unassailable monopolies.' -- source: https://yro.slashdot.org/story/22/09/14/1644244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Announces the OpenWallet Foundation To Develop Interoperable Digital Wallets
by Peter Reutemann 14 Sep '22

14 Sep '22

'The Linux Foundation has announced plans for a new collaborative initiative designed to support interoperability across digital wallets, built on an open source bedrock. From a report: The OpenWallet Foundation (OWF), as the new effort is called, is the brainchild of Daniel Goldscheider, CEO of open banking startup Yes.com, though today's announcement reveals a broad gamut of buy-ins from multiple industry players including Okta, Ping Identity, Accenture, CVS Health, OpenID Foundation, among several other public and private bodies. With the Linux Foundation serving as the project's host, this gives OWF sizeable clout as it strives to enable what Goldscheider calls a "plurarity of wallets based on a common core," according to a press release. The news also comes as regulatory bodies across the globe are moving to support competition through enforcing interoperability across systems, including Europe which is currently trying to make messaging interoperability a thing.' -- source: https://news.slashdot.org/story/22/09/13/1350232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi OS improves menus, networking, camera possibilities
by Peter Reutemann 14 Sep '22

14 Sep '22

'The latest Raspberry Pi OS version adds menu search, a more mainstream network and VPN manager, and plenty of camera and machine learning possibilities through a new open source camera package.' -- source: https://arstechnica.com/gadgets/2022/09/raspberry-pi-os-adds-easier-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Article: 10 Best Self-Hosted Apps for Your Raspberry Pi
by Peter Reutemann 12 Sep '22

12 Sep '22

It's actually 10 categories with several applications listed for each: 1. Media Server 2. File Sync Server 3. Virtualization Platform 4. Ads Blocker 5. Image Hub 6. Home Automation 7. Security Center 8. News Aggregator 9. Password Manager 10. Gaming Console Full details in the following article: https://linuxiac.com/best-self-hosted-raspberry-pi-apps/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux malware combines unusual stealth with a full suite of capabilities
by Peter Reutemann 11 Sep '22

11 Sep '22

'Researchers this week unveiled a new strain of Linux malware that's notable for its stealth and sophistication in infecting both traditional servers and smaller Internet-of-things devices. Dubbed Shikitega by the AT&T Alien Labs researchers who discovered it, the malware is delivered through a multistage infection chain using polymorphic encoding. It also abuses legitimate cloud services to host command-and-control servers. These things make detection extremely difficult. "Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection," AT&T Alien Labs researcher Ofer Caspi wrote. "Shikitega malware is delivered in a sophisticated way, it uses a polymorphic encoder, and it gradually delivers its payload where each step reveals only part of the total payload. In addition, the malware abuses known hosting services to host its command and control servers."' -- source: https://arstechnica.com/information-technology/2022/09/new-linux-malware-co… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Android 13 Raises Minimum System Requirement To 2GB of RAM, 16GB of storage
by Peter Reutemann 10 Sep '22

10 Sep '22

'Android 13 has recently hit the streets, and with it, Google is raising the minimum requirements for Android phones. From a report: Google's latest blog post announced that the minimum amount of RAM for Android Go, the low-end version of Android, is now 2GB for Android 13, whereas previously, it was 1GB. Esper's Mishaal Rahman and Google Product Expert Jason Bayton also claim the minimum storage requirements have been bumped up to 16GB, though Google doesn't seem to have publicly documented this anywhere. The increase in system requirements means any phone that doesn't meet the minimum specs won't be able to update to Android 13. New phones launching with Android 13 will need to meet the minimum requirements to be eligible for Play Store licensing, though launching with an older version of Android (with lower requirements) will still be an option for a while. Technically, anyone can grab the Android source code and build anything with it, but if you want to license the Google apps and have access to the Google-trademarked brand "Android," you'll need to comply with Google's rules.' -- source: https://tech.slashdot.org/story/22/09/09/1742200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Zealand programming contest
by Peter Reutemann 09 Sep '22

09 Sep '22

Hi everyone I just got notified that the New Zealand programming contest is on tomorrow. More information on the Hamilton event is available from here: https://www.cs.waikato.ac.nz/~tl108/nzpc-hamilton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New wave of data-destroying ransomware attacks hits QNAP NAS devices
by Peter Reutemann 08 Sep '22

08 Sep '22

'Network hardware-maker QNAP is urging customers to update their network-attached storage devices immediately to protect them from a new wave of ongoing ransomware attacks that can destroy terabytes of data in a single stroke. Singapore-based QNAP said recently that it has identified a new campaign from a ransomware group known as DeadBolt. The attacks take aim at QNAP NAS devices that use a proprietary feature known as Photo Station. The advisory instructs customers to update their firmware, suggesting there is a vulnerability that’s under exploit, but the company makes no explicit mention of a CVE designation that security professionals use to track such security flaws.' -- source: https://arstechnica.com/information-technology/2022/09/new-wave-of-data-des… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NASA Going RISC-V
by Lawrence D'Oliveiro 07 Sep '22

07 Sep '22

NASA’s space probes have been using a PowerPC-based computing architecture going back over two decades, so it’s about time for a refresh. So now SiFive <https://www.theregister.co.uk/2022/09/06/nasas_spaceflight_computer_risc_v/> is going to supply NASA with a new computing platform based on its X280 RISC-V CPU. “RISC” is supposed to stand for “Reduced Instruction Set Computing”. However, many current RISC architectures (including ARM and POWER/PowerPC) have seen a large blowout of their instruction-set size when they started adding SIMD vector operations. These instructions operate on fixed-length sets of around 4, 8 or 16 operands, performing the same operation on all operands simultaneously (hence “SIMD”, standing for “Single Instruction, Multiple Data”). Trouble is, you need a lot of different variants of each instruction for coping with different data types. While vector operations are important for many uses, RISC-V takes a different approach, harking back to the old supercomputers designed by the legendary Seymour Cray: instead of having to operate on all operands simultaneously, the instructions operate elementwise on variable-length arrays (the original Cray-1 design allowed for arrays of up to 64 elements at a time), with operands being processed sequentially through a multi-stage pipeline. This should help keep things simpler, while still making it fast.

1 0

Google Chrome Emergency Update Fixes New Zero-Day Used in Attacks
by Peter Reutemann 07 Sep '22

07 Sep '22

'Google has released Chrome 105.0.5195.102 for Windows, Mac, and Linux users to address a single high-severity security flaw, the sixth Chrome zero-day exploited in attacks patched this year. From a report: "Google is aware of reports that an exploit for CVE-2022-3075 exists in the wild," the company said in a security advisory published on Friday. This new version is rolling out in the Stable Desktop channel, with Google saying that it will reach the entire user base within a matter of days or weeks. It was available immediately when BleepingComputer checked for new updates by going into the Chrome menu > Help > About Google Chrome. The web browser will also auto-check for new updates and automatically install them after the next launch.' -- source: https://it.slashdot.org/story/22/09/06/1424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slick new phishing-as-a-service kit emerges
by Peter Reutemann 06 Sep '22

06 Sep '22

'itnews reports: Security researchers at Resecurity have detailed a new phishing-as-a-service kit, EvilProxy, that provides an easy to use interface to attack users with accounts for major online brands, and the ability to bypass multifactor authentication (MFA). Reverse proxies to attack multifactor authentication, such as Modlishka, have been available for several years, but EvilProxy makes it it possible to easily create and deliver advanced phishing links through a graphical user interface, Resecurity said. EvilProxy sits between a victim and the real site the user is trying to connect to, capturing their valid session cookies, to bypass the need to authenticate with user names, passwords, and / or two-factor authentication tokens, the security vendor explained. This includes accounts that have MFA enabled with short messaging text service, or application tokens.' -- source: https://www.itnews.com.au/news/slick-new-phishing-as-a-service-kit-emerges-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Peter Eckersley, Co-Creator of Let's Encrypt, Dies at 43
by Peter Reutemann 06 Sep '22

06 Sep '22

'Seven years ago, Slashdot reader #66,542 announced "Panopticlick 2.0," a site showing how your web browser handles trackers. But it was just one of the many privacy-protecting projects Peter Eckersley worked on, as a staff technologist at the EFF for more than a decade. Eckersley also co-created Let's Encrypt, which today is used by hundreds of millions of people. Friday the EFF's director of cybersecurity announced the sudden death of Eckersley at age 43. "If you have ever used Let's Encrypt or Certbot or you enjoy the fact that transport layer encryption on the web is so ubiquitous it's nearly invisible, you have him to thank for it," the announcement says. "Raise a glass." Peter Eckersley's web site is still online, touting "impactful privacy and cybersecurity projects" that he co-created, including not just Let's Encrypt, Certbot, and Panopticlick, but also Privacy Badger and HTTPS Everywhere. And in addition, "During the COVID-19 pandemic he convened the the stop-covid.tech group, advising many groups working on privacy-preserving digital contact tracing and exposure notification, assisting with several strategy plans for COVID mitigation." You can also still find Peter Eckersley's GitHub repositories online. But Peter "had apparently revealed recently that he had been diagnosed with cancer," according to a tribute posted online by security company Sophos, noting his impact is all around us: If you click on the padlock in your browser [2022-09-0T22:37:00Z], you'll see that this site, like our sister blog site Sophos News, uses a web certificate that's vouched for by Let's Encrypt, now a well-established Certificate Authority (CA). Let's Encrypt, as a CA, signs TLS cryptographic certificates for free on behalf of bloggers, website owners, mail providers, cloud servers, messaging services...anyone, in fact, who needs or wants a vouched-for encryption certificate, subject to some easy-to-follow terms and conditions.... Let's Encrypt wasn't the first effort to try to build a free-as-in-freedom and free-as-in-beer infrastructure for online encryption certificates, but the Let's Encrypt team was the first to build a free certificate signing system that was simple, scalable and solid. As a result, the Let's Encrypt project was soon able to to gain the trust of the browser making community, to the point of quickly getting accepted as a approved certificate signer (a trusted-by-default root CA, in the jargon) by most mainstream browsers.... In recent years, Peter founded the AI Objectives Institute, with the aim of ensuring that we pick the right social and economic problems to solve with AI: "We often pay more attention to how those goals are to be achieved than to what those goals should be in the first place. At the AI Objectives Institute, our goal is better goals." ' -- source: https://yro.slashdot.org/story/22/09/05/0241217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attacks on Linux Servers Rose 75% Over Last Year, Warn Security Researchers
by Peter Reutemann 05 Sep '22

05 Sep '22

'"There's been a big rise in ransomware attacks targeting Linux," reports ZDNet, "as cyber criminals look to expand their options and exploit an operating system that is often overlooked when businesses think about security." According to analysis by cybersecurity researchers at Trend Micro, Linux servers are "increasingly coming under fire" from ransomware attacks, with detections up by 75% over the course of the last year as cyber criminals look to expand their attacks beyond Windows operating systems. Linux powers important enterprise IT infrastructure including servers, which makes it an attractive target for ransomware gangs — particularly when a perceived lack of threat to Linux systems compared with Windows means that cybersecurity teams might choose to focus on defending Windows networks against cybercrime. Researchers note that ransomware groups are increasingly tailoring their attacks to focus specifically on Linux systems. For example, LockBit is one of the most prolific and successful ransomware operations of recent times and now offers the option of a Linux-based variant that is designed to target Linux systems and has been used to conduct attacks in the wild.... And it isn't just ransomware groups that are increasingly turning their attentions towards Linux — according to Trend Micro, there's been a 145% increase in Linux-based cryptocurrency-mining malware attacks, where cyber criminals secretly exploit the power of infected computers and servers to mine for cryptocurrency for themselves. One of the ways cyber criminals are compromising Linux systems is by exploiting unpatched vulnerabilities. According to the report, these flaws include CVE-2022-0847 — also known as Dirty Pipe — a bug that affects the Linux kernel from versions 5.8 and up, which attackers can use to escalate their privileges and run code. Researchers warn that this bug is "relatively easy to exploit". The article recommends installing all security patches as soon as they're available — and implementing multi-factor authentication across your organization.' -- source: https://linux.slashdot.org/story/22/09/03/1940245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

policy.nz
by Lawrence D'Oliveiro 05 Sep '22

05 Sep '22

Thought I’d mention this handy website <https://policy.nz/2022> which happens to be relevant to the NZ situation right now, namely the upcoming local-body elections. It’s a compilation of relevant policy info that election candidates of all persuasions up and down the country were able and willing to supply. Go look up the elections in your own area, and see what your candidates are standing for, so you can make a more informed choice. (Or more rationalizations for the choice you’ve already made. But hey, I won’t judge...) Participation in local-body elections in NZ is typically pretty poor, even with mail-in voting. Yes, there are some gaps in their coverage, but still, maybe this will help raise the numbers who vote. Go, be informed!

3 2

TIL: Shiny Apps
by Lawrence D'Oliveiro 04 Sep '22

04 Sep '22

Came across this article <https://www.nzherald.co.nz/nz/covid-19-what-nz-flu-data-is-revealing-about-…> about improving the accuracy of tracking Covid-19 rates by looking at self-reporting data on general flu-like symptoms. By careful analysis, they can estimate numbers of Covid-19 cases versus influenza cases, and tell if dropping reported case numbers are actually a result of dropping infections, versus lower rates of testing. The software they developed is called a “Shiny app”. Digging a bit further, I discovered that “Shiny” <https://shiny.rstudio.com/> is a framework for building web-based apps in the R statistical-analysis language.

1 0

Chrome Extensions With 1.4M Installs Covertly Track Visits and Inject Code
by Peter Reutemann 02 Sep '22

02 Sep '22

'Google has removed browser extensions with more than 1.4 million downloads from the Chrome Web Store after third-party researchers reported they were surreptitiously tracking users' browsing history and inserting tracking code into specific ecommerce sites they visited. ArsTechnica: The five extensions flagged by McAfee purport to offer various services, including the ability to stream Netflix videos to groups of people, take screenshots, and automatically find and apply coupon codes. Behind the scenes, company researchers said, the extensions kept a running list of each site a user visited and took additional actions when users landed on specific sites. The extensions sent the name of each site visited to the developer-designated site d.langhort.com, along with a unique identifier and the country, city, and zip code of the visiting device. If the site visited matched a list of ecommerce sites, the developer domain instructed the extensions to insert JavaScript into the visited page. The code modified the cookies for the site so that the extension authors receive affiliate payment for any items purchased. To help keep the activity covert, some of the extensions were programmed to wait 15 days after installation before beginning the data collection and code injection.' -- source: https://yro.slashdot.org/story/22/09/01/1647229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian Replaces Google with DuckDuckGo as Chromium's Default Search Engine
by Peter Reutemann 30 Aug '22

30 Aug '22

'A story from the Linux/Open Source news site It's FOSS: While Firefox is still the default web browser in Debian, you can find the Chromium browser in the repositories. Chromium is the open source project upon which Google has built its Chrome web browser. It is also preferred by many Linux users as it provides almost the same features as Google Chrome. Earlier, Chromium used Google as the default search engine in Debian. However, Debian is going to use DuckDuckGo as the default search engine for Chromium. It all started when bug report #956012 was filed in April 2020, stating to use DuckDuckGo as the default search engine for the Chromium package. You can see the decision was not taken in any hurry, as the maintainers took more than two years to close the bug report. The reason for the change goes as stated in the official package update announcement. Change default search engine to DuckDuckGo for privacy reasons. Set a different search engine under Settings -> Search Engine (closes: #956012). ' -- source: https://linux.slashdot.org/story/22/08/29/0443230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Morello Runs CheriBSD
by Lawrence D'Oliveiro 29 Aug '22

29 Aug '22

“CHERI” is a project at Cambridge University based on a very old concept for implementing memory/process protection on computer hardware: that of “capabilities”. Instead of having specially-trusted kernel code run in a privileged mode that is allowed to do pretty much anything, capabilities allow for a more decentralized model, with distribution and separation of different areas of trust. The capability concept fell out of favour, because its implementation overhead was greater than the processor-privilege-level (also often described as “privilege rings”) concept that is so commonplace today. But with the increase in security vulnerabilities like Meltdown and Spectre, there is increasing interest in alternative approaches that might reduce complexity, hopefully with less of a performance cost than the fixes that were needed to mitigate those vulnerabilities. ARM Ltd’s experimental “Morello” chip is an implementation of the CHERI concept. And it has got as far as running CheriBSD, which is a specially-adapted variant of FreeBSD. This now includes Wayland as the GUI server, and it provides a KDE Plasma desktop on top of that, according to <https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/>. All this code has been tweaked, where appropriate, to remove the assumptions of arbitrary access to process memory allowed by conventional C pointers, in favour of the more restricted access controlled by capabilities. The CHERI project started with MIPS-based hardware, and besides being on ARM now, it looks to be coming to RISC-V as well. By the way, the Linux kernel has already (mis)used the term ”capability” to refer to an entirely different concept <https://manpages.debian.org/bullseye/manpages/capabilities.7.en.html>. Those familiar with the process-privilege system on old VMS from DEC may notice some resemblance ...

1 1

Will Google's 'Cross-Device' Development Kit Bring Android Apps to Non-Android Devices?
by Peter Reutemann 29 Aug '22

29 Aug '22

'Google is trying "to make it easier for developers to create Android apps that connect in some way across a range of devices," reports the Verge. Documentation for the software development kit says it will simplify development for "multi-device experiences." "The Cross device SDK is open-source and will be available for different Android surfaces and non-Android ecosystem devices (Chrome OS, Windows, iOS)," explains the documentation, though the current developer preview only works with Android phones and tablets, according to the Verge. But they report that Google's new SDK "contains the tools developers need to make their apps play nice across Android devices, and, eventually non-Android phones, tablets, TVs, cars, and more." The SDK is supposed to let developers do three key things with their apps: discover nearby devices, establish secure connections between devices, and host an app's experience across multiple devices. According to Google, its cross-device SDK uses Wi-Fi, Bluetooth, and ultra-wideband to deliver multi-device connectivity.... [I]t could let multiple users on separate devices choose items from a menu when creating a group food order, saving you from passing your phone around the room. It could also let you pick up where you left off in an article when swapping from your phone to a tablet, or even allow the passengers in a car to share a specific map location with the vehicle's navigation system. It almost sounds like an expansion of Nearby Share, which enables users on Android to transfer files to devices that use Chrome OS and other Androids. In April, Esper's Mishaal Rahman spotted an upcoming Nearby Share update that could let you quickly share files across the devices that you're signed into Google with. Google also said during a CES 2022 keynote that it will bring Nearby Share to Windows devices later this year. "This SDK abstracts away the intricacies involved with working with device discovery, authentication, and connection protocols," argues Google's blog post, "allowing you to focus on what matters most — building delightful user experiences and connecting these experiences across a variety of form factors and platforms."' -- source: https://developers.slashdot.org/story/22/08/27/219224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian Considers Changing How It Handles Non-Free Firmware
by Peter Reutemann 29 Aug '22

29 Aug '22

'"Debian currently doesn't load non-free firmware by default on its systems," reports Phoronix, "even when it means no working hardware support/acceleration without those binary elements. Not loading the non-free firmware can also mean missing out on security updates or for addressing usability issues." Now the Debian community is discussing three proposals on how non-free firmware should be handled going forward (before a vote in September). Proposal A and B both start with the same two paragraphs: We will include non-free firmware packages from the "non-free-firmware" section of the Debian archive on our official media (installer images and live images). The included firmware binaries will normally be enabled by default where the system determines that they are required, but where possible we will include ways for users to disable this at boot (boot menu option, kernel command line etc.). When the installer/live system is running we will provide information to the user about what firmware has been loaded (both free and non-free), and we will also store that information on the target system such that users will be able to find it later. The target system will also be configured to use the non-free-firmware component by default in the apt sources.list file. Our users should receive security updates and important fixes to firmware binaries just like any other installed software. But Proposal A adds that "We will publish these images as official Debian media, replacing the current media sets that do not include non-free firmware packages," while Proposal B says those images "will not replace the current media sets," but will instead be offered alongside them. And Proposal C? "The Debian project is permitted to make distribution media (installer images and live images) containing packages from the non-free section of the Debian archive available for download alongside with the free media in a way that the user is informed before downloading which media are the free ones.' -- source: https://linux.slashdot.org/story/22/08/28/0242228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Touts Its RISC-V-Based Single-Board Computer and Soldering Irons
by Peter Reutemann 29 Aug '22

29 Aug '22

'PINE64's August update included photos of their first prototype for its upcoming Star64 single-board computer, "the first true RISC-V single-board computer from us...but as I wrote last month it certainly isn't the last RISC-V piece of hardware you'll be seeing from us." Just as a short recap: Star64 comes with a StarFive JH7110 64bit CPU sporting quad SiFive FU740 cores clocked at 1.5GHz. The SOC is equipped with BXE-2-32 from Imagination Technologies, which is said to be a solid mid-range GPU. Star64 will be available in two configurations — with 4Gb and 8GB of RAM, similarly to the Quartz64. Both hardware versions include USB 3.0 and a PCIe slot as well as two native Gigabit Ethernet NICs.... Along the long leading edges you'll find PCIe on one end and GPIO on the other. At one end of the board you'll find a digital video output, a double-stacked Gigabit Ethernet port and a 12V barrel plug for power. On the opposite side, you'll find 3x USB 2.0, 1x USB 3.0, an audio jack as well as a power button. There are also two U.FL ports for antennas — one for bluetooth and the other for WiFi.... The Star64 also has an MiPi display output complete with a touch panel (TP) input, a 12V power port, a CSI camera port and an eMMC slot. A micro SD card slot can be found at the bottom of the PCB. Similarly to the RockPro64 and Quartz64, the 12V port on the Star64 can be used for powering other hardware directly from the board — a popular example is powering one or multiple SSDs connected to a PCIe SATA adapter. I'll add that, at least in theory, the Star64 would make a great network-attached storage device because of its SoCs low thermals and idle power. I am looking forward to seeing NAS-focused Linux or BSD* OSes available for the board. Speaking of software, efforts to support the SoC in Linux have already begun. I've been told that both Debian and Fedora are already being ported to the StarFive JH7110, which is great news. We are certain that many other OSes will follow swiftly — especially once we start delivering the Star64 to interested developers. On the subject of availability: the Star64 will be available in a few weeks time, and will initially be available to developers. Given the interest in the Star64's and the SoC powering I hope to see functional distributions available for the board soon after launch. The announcement also included an update on their PinecilV2 smart mini portable soldering iron (built with a 32-bit RISC-V SoC). "The Pinecil V2 landed earlier this month and sold out almost instantly. The next production run of the ought to be available soon however..."' -- source: https://hardware.slashdot.org/story/22/08/28/1759238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Heroku Announces Plans To Eliminate Free Plans, Blaming 'Fraud and Abuse'
by Peter Reutemann 29 Aug '22

29 Aug '22

'After offering them for over a decade, Heroku announced this week that it will eliminate all of its free services -- pushing users to paid plans. From a report: Starting November 28, the Salesforce-owned cloud platform as a service will stop providing free product plans and shut down free data services and soon (on October 26) will begin deleting inactive accounts and associated storage for accounts that have been inactive for over a year. In a blog post, Bob Wise, Heroku general manager and Salesforce EVP, blamed "abuse" on the demise of the free services, which span the free plans for Heroku Dynos and Heroku Postgres as well as the free plan for Heroku Data for Redis. [...] Wise went on to note that Heroku will be announcing a student program at Salesforce's upcoming Dreamforce conference in September, but the details remain a mystery at this point. For the uninitiated, Heroku allows programmers to build, run and scale apps across programming languages including Java, PHP, Scala and Go. Salesforce acquired the company for $212 million in 2010 and subsequently introduced support for Node.js and Clojure and Heroku for Facebook, a package to simplify the process of deploying Facebook apps on Heroku infrastructure. Heroku claims on its website that it's been used to develop 13 million apps to date.' -- source: https://developers.slashdot.org/story/22/08/26/188231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google's Fuchsia OS is Taking Over Smart Displays, Now on Its Second Device
by Peter Reutemann 26 Aug '22

26 Aug '22

'The kingdom of Google's third major operating system, Fuchsia, is growing a little wider today. ArsTechnica: 9to5Google reports Google completed the rollout of Fuchsia to the Google Nest Hub Max. Along with the original Nest Hub/Google Home Hub, that puts two of Google's three smart displays on the new OS, with the one holdout being the 2nd Gen Nest Hub. The Nest Hub Max is the first device running Fuchsia that Google is currently selling -- the Home Hub only got Fuchsia after it had been discontinued. The Google smart display user interface is written in Flutter, a Google programming language designed for portability, which runs on Android, iOS, Fuchsia, and the weird cast platform Nest Hubs typically use. So it's not right to describe the user interface as "similar" after the OS swap -- it's the exact same code because Flutter runs on nearly everything. You are getting a slightly newer code version, though, and it comes with a Bluetooth menu. If you dive into the settings and hit "about device," you'll see a "Fuchsia Version" field that will say something like "6.20211109.1.3166243." It's a bit weird to do an entire OS switch to the futuristic, secretive Fuchsia project and then have basically nothing to show (or say) for it in terms of obvious improvements in performance or security. You can dive into the minutia of the Fuchsia source code, but it continues to be a mystery in terms of what practical benefits it offers consumers. Google never talks about Fuchsia, so not much is known about what, exactly, Google is accomplishing here.' -- source: https://tech.slashdot.org/story/22/08/25/1856206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux 6.1 Will Make It A Bit Easier To Help Spot Faulty CPUs
by Peter Reutemann 26 Aug '22

26 Aug '22

'While mostly of benefit to server administrators with large fleets of hardware, Linux 6.1 aims to make it easier to help spot problematic CPUs/cores by reporting the likely socket and core when a segmentation fault occurs, which can help in spotting any trends if routinely finding the same CPU/core is causing problems. Queued up now in TIP's x86/cpu branch for the Linux 6.1 merge window in October is a patch to print the likely CPU at segmentation fault time. Printing the likely CPU core and socket when a seg fault occurs can be beneficial if routinely finding seg faults happening on the same CPU package or particular core.' -- source: https://linux.slashdot.org/story/22/08/25/1841209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo now offers anti-tracking email service to everyone
by Peter Reutemann 26 Aug '22

26 Aug '22

'DuckDuckGo's tracker-removing email service, which has been available in private beta for a year, is now open to anyone who uses a DuckDuckGo mobile app, browser extension, or Mac browser. It has also added a few more privacy tools. The service provides you a duck.com email address, one intended to be given out for the kind of "Subscribe to our newsletter for 20 percent off" emails you know exist only to harvest data and target you for ads. Email sent to your duck.com address forwards to your chosen primary email—but with trackers removed. Email Protection now also fixes up links, strips them of tracking modifiers, upgrades unencrypted HTTP URLs to HTTPS where possible, and, for the rare necessary reply, allows you to send directly from your duck address instead of exposing your primary email. During their closed beta, DuckDuckGo claims that 85 percent of the emails it processed contained hidden trackers.' -- source: https://arstechnica.com/gadgets/2022/08/duckduckgo-now-offers-anti-tracking… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Warn of Widespread Exploitation Involving Hikvision Cameras
by Peter Reutemann 25 Aug '22

25 Aug '22

'Both government and criminal hacking groups are still targeting Hikvision cameras with a vulnerability from 2021, according to reports from several security researchers. From a report: Cybersecurity firm CYFIRMA released a report this week saying Russian cybercriminal forums are awash with hackers looking to collaborate on exploiting Hikvision cameras using the command injection vulnerability CVE-2021-36260. "Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale," the company's researchers said. "These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization's environment." CYFIRMA reported they found that more than 80,000 Hikvision cameras are still vulnerable to the critical command injection flaw, which carries a CVSS score of 9.8 out of 10. Of the more than 80,000 vulnerable cameras, more than 100 nations and 2,300 organizations are impacted.' -- source: https://tech.slashdot.org/story/22/08/24/1856244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSearch 0.2 File Search Utility Removes Snap Support
by Peter Reutemann 24 Aug '22

24 Aug '22

Since we were discussing find during this week's meeting, I thought some of you might be interested in this post: 'FSearch, the GTK-based lightning-fast file search tool, now has a new version, 0.2, that significantly improves its functionality. Many Linux users believe the only options for searching for files are those built into the operating system. Of course, the ‘find’ command or the file search capability provided by the file manager does an excellent job. But what if you could go to the next level using a handy graphical tool that searches for files at the speed of light? Meet FSearch. FSearch is an open-source standalone file search utility based on GTK3 inspired by Everything Search Engine. Because it is written in C, FSearch offers incredibly fast search speed, which is the application’s main advantage.' -- source: https://linuxiac.com/fsearch-0-2-file-search-utility/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can You Ban Source Code?
by Lawrence D'Oliveiro 24 Aug '22

24 Aug '22

Let me see if I understand what’s going on here <https://www.theregister.com/2022/08/24/github_eff_tornado_cash/>: * “Tornado Cash” is a cryptocurrency “mixing” service. This takes input cryptocoins and outputs the same value again, but in a mix of different cryptocoins that makes it harder to trace where the input came from. * Tornado Cash is also the name of the open-source software written to implement this service. * The US Treasury Department’s Office of Foreign Assets Control has designated the Tornado Cash service as an illegal money-laundering operation. It also appears the principal developers (of the service and the software) are wanted internationally by financial crime investigators, and one has already been arrested. * Presumably in response to this, GitHub has shut down the accounts of those developers, and also removed the original Tornado Cash source code repo. * However, it’s not clear that GitHub was legally obliged to do any of this -- did the OFAC sanctions include the source code as well? Or were they contravening the GitHub terms and conditions somehow--if so, which one(s)? * In any case, lots of other copies of the Tornado Cash source code remain available on GitHub, untouched. And no doubt there are copies elsewhere.

1 0

Unix legend, who owes us nothing, keeps fixing foundational AWK code
by Peter Reutemann 24 Aug '22

24 Aug '22

'A Princeton professor, finding a little time for himself in the summer academic lull, emailed an old friend a couple months ago. Brian Kernighan said hello, asked how their US visit was going, and dropped off hundreds of lines of code that could add Unicode support for AWK, the text-parsing tool he helped create for Unix at Bell Labs in 1977. "I have tested this a fair amount but clearly more tests are needed," Kernighan wrote in the email, posted in late May as a kind of pseudo-commit on the onetrueawk repo by longtime maintainer Arnold Robbins. "Once I figure out how ... I will try to submit a pull request. I wish I understood git better, but in spite of your help, I still don't have a proper understanding, so this may take a while."' -- source: https://arstechnica.com/gadgets/2022/08/unix-legend-who-owes-us-nothing-kee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Lightweight Linux laptop crams a 99 Wh battery inside
by Peter Reutemann 24 Aug '22

24 Aug '22

'Ultralight laptops are great for slipping into a bag and traveling with, and they look pretty stylish. However, a trim build often comes with trade-offs. Battery capacity is a common one, as companies struggle to fit larger batteries into machines that are under an inch thick. German PC-maker Tuxedo Computers' latest ultralight InfinityBook Pro 14 seeks to address that challenge with a massive battery. The InfinityBook Pro 14 - Gen7 announced today comes with either big storage or a big battery. The company is selling it with the option for a 99 watt-hour (Wh) battery, which is about as big as a lithium battery can be while being allowed on an airplane (100 Wh).' -- source: https://arstechnica.com/gadgets/2022/08/lightweight-linux-laptop-crams-a-99… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hyundai Uses Example Keys For Encryption System
by Peter Reutemann 23 Aug '22

23 Aug '22

'"Hyundai predictably fails in attempting to secure their car infotainment system with a default key lifted from programming examples," writes Slashdot reader sinij. "This level of security is unfortunately expected from auto manufacturers, who also would like to sell you always-connected Car2Car self-driving automobiles." Cryptographer and security experience Bruce Schneier writes: "Turns out the [AES] encryption key in that script is the first AES 128-bit CBC example key listed in the NIST document SP800-38A [PDF]," writes an unidentified developer under the name "greenluigi1." Luck held out, in a way. "Greenluigi1" found within the firmware image the RSA public key used by the updater, and searched online for a portion of that key. The search results pointed to a common public key that shows up in online tutorials like "RSA Encryption & Decryption Example with OpenSSL in C." Two questions remain: 1.) How did the test key get left behind? 2) Was it by accident or design?' -- source: https://it.slashdot.org/story/22/08/22/227245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 23 Aug '22

23 Aug '22

Hi everyone We have a meeting next Monday with the following topic: "Command-line tools under Linux are the bread and butter of sysadmins, but any user can benefit from a wide variety of hidden gems. In this meetup, we will explore essential command-line tools that one should be aware of. Please join us if you would like to learn about them or even demo your personal set of useful tools!" Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776695/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 3

The New USB Rubber Ducky Is More Dangerous Than Ever
by Peter Reutemann 21 Aug '22

21 Aug '22

'The USB Rubber Ducky "has a new incarnation, released to coincide with the Def Con hacking conference this year," reports The Verge. >From the report: To the human eye, the USB Rubber Ducky looks like an unremarkable USB flash drive. Plug it into a computer, though, and the machine sees it as a USB keyboard -- which means it accepts keystroke commands from the device just as if a person was typing them in. The original Rubber Ducky was released over 10 years ago and became a fan favorite among hackers (it was even featured in a Mr. Robot scene). There have been a number of incremental updates since then, but the newest Rubber Ducky makes a leap forward with a set of new features that make it far more flexible and powerful than before. With the right approach, the possibilities are almost endless. Already, previous versions of the Rubber Ducky could carry out attacks like creating a fake Windows pop-up box to harvest a user's login credentials or causing Chrome to send all saved passwords to an attacker's webserver. But these attacks had to be carefully crafted for specific operating systems and software versions and lacked the flexibility to work across platforms. The newest Rubber Ducky aims to overcome these limitations. It ships with a major upgrade to the DuckyScript programming language, which is used to create the commands that the Rubber Ducky will enter into a target machine. While previous versions were mostly limited to writing keystroke sequences, DuckyScript 3.0 is a feature-rich language, letting users write functions, store variables, and use logic flow controls (i.e., if this... then that). That means, for example, the new Ducky can run a test to see if it's plugged into a Windows or Mac machine and conditionally execute code appropriate to each one or disable itself if it has been connected to the wrong target. It also can generate pseudorandom numbers and use them to add variable delay between keystrokes for a more human effect. Perhaps most impressively, it can steal data from a target machine by encoding it in binary format and transmitting it through the signals meant to tell a keyboard when the CapsLock or NumLock LEDs should light up. With this method, an attacker could plug it in for a few seconds, tell someone, "Sorry, I guess that USB drive is broken," and take it back with all their passwords saved. ' -- source: https://it.slashdot.org/story/22/08/19/2136257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Upgrades Now Arrive with a Simple Prompt (and Security Fixes)
by Peter Reutemann 21 Aug '22

21 Aug '22

'"After a slight delay due to an installer issue, the first point release for Ubuntu 22.04 has been officially released," swrites Jack Wallen for TechRepublic. "Although point releases are often overlooked by users, because they aren't major upgrades, this time around you should certainly run the upgrade immediately." The biggest reason is that this point release combines all of the security fixes and improvements that have been added since the initial release of Jammy Jellyfish. So, if you haven't bothered to upgrade Ubuntu 22.04 since you first installed it, which you should have been doing all along, this point upgrade will add everything you've missed in one fell swoop. One of the biggest upgrades for end users will be the ability of 20.04 users to upgrade to the latest release without having to touch the command line. At some point, users of 20.04 will see an upgrade prompt on their desktops, allowing them to easily make the jump to 22.04.1. This is a big deal because previously such upgrades would have required running several commands. That means no more: sudo apt-get update sudo apt-get upgrade -y sudo apt-get dist-upgrade -y sudo do-release-upgrade -y Another point release found in 22.04.1 is GNOME 42, which features a new enhanced dark mode and switches to Wayland by default, with the inclusion of Xorg for unsupported hardware.' -- source: https://linux.slashdot.org/story/22/08/20/021216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Are Stealing Session Cookies To Bypass Multi-factor Authentication
by Peter Reutemann 21 Aug '22

21 Aug '22

'Hackers are stealing cookies from current or recent web sessions to bypass multi-factor authentication (MFA), according to an eSecurity Planet report. The attack method, reported by Sophos researchers, is already growing in use. The "cookie-stealing cybercrime spectrum" is broad, the researchers wrote, ranging from "entry-level criminals" to advanced adversaries, using various techniques. Cybercriminals collect cookies or buy stolen credentials "in bulk" on dark web forums. Ransomware groups also harvest cookies and "their activities may not be detected by simple anti-malware defenses because of their abuse of legitimate executables, both already present and brought along as tools," the researchers wrote. Browsers allow users to maintain authentication, remember passwords and autofill forms. That might seem convenient, but attackers can exploit this functionality to steal credentials and skip the login challenge. Behind the scenes, browsers use SQLite database files that contain cookies. These cookies are composed of key-value pairs, and the values often contain critical information such as tokens and expiration dates. Adversaries know the exact name and location of these files for all major browsers such as Chrome, Firefox, and even Brave, on various operating systems. That's why the attack can be scripted. It's not uncommon to find such scripts along with other modules in info-stealing and other malware. For example, the latest version of the Emotet botnet targets cookies and credentials stored by browsers, which include saved credit cards. According to the Sophos researchers, "Google's Chrome browser uses the same encryption method to store both multi-factor authentication cookies and credit card data." To gain initial access, attackers can also perform phishing and spear-phishing campaigns to implant droppers that can deploy cookie-stealer malware stealthily. The cookies are then used for post-exploitation and lateral movements. Cybercriminals can use them to change passwords and emails associated with user accounts, or trick the victims into downloading additional malware, or even deploy other exploitation tools such as Cobalt Strike and Impacket kit. Users should not use built-in features to save passwords unless the browser encrypts them with, at least, a master password. It's recommended that users uncheck the setting called "remember passwords," and users should probably not allow persistent sessions as well. Developers can be part of the problem if they don't secure authentication cookies properly. Such cookies must have a short expiration date. Otherwise, the persistent authentication could turn into a persistent threat. You can have great security processes and still get hacked because the cookies do not have the necessary flags (e.g., HttpOnly, Secure attribute). For example, authentication cookies must be sent using SSL/TLS channels. Otherwise the data could be sent in plain text and attackers would only have to sniff traffic to intercept credentials.' -- source: https://it.slashdot.org/story/22/08/20/0332200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Free, Secure, and Open-Source: How FileZilla is Making an Old School Protocol Cool Again
by Peter Reutemann 21 Aug '22

21 Aug '22

'It's a free and open-source, cross-platform FTP application that allows secure file transfering — and it's making an old-school protocol cool again, according to a recent blog post. Started about 21 years ago — and downloaded by millions each year — FileZilla remains "committed to their role in liberating technology, by making it accessible, open and also secure," according to the blog post. But it also explains how FileZilla has beefed up that security through a collaboration with the internet freedom nonprofit, the Open Technology Fund (or "OTF"): Over the past year, FileZilla has utilised support from OTF to undertake two activities that enhanced and ensured the security of their tools. The first was integrating FileZilla Server with Let's Encrypt, a free, automated, and open source certificate authority that ensures secure communication between the two end-points sending or receiving a file via FileZilla.... Secondly, FileZilla ran a penetration test, a service offered by OTF's Red Team Lab. A team of independent researchers attempted to force access to the FileZilla server to see if they could gain control. These researchers were highly skilled, and the testing was extensive. The team conducting the test only found very minor security vulnerabilities that FileZilla were able to fix immediately. As a result of this process, anyone wanting to use the FileZilla software can trust that it has been cross-scrutinised by a third party and found to be secure.... FileZilla respects users' confidentiality: they do not track your behaviour, nor sell your data to other companies. While they do have advertisements on their website, they are posted exactly as advertisements would be posted in a newspaper. Nobody knows that you are reading the advertisements, or that you decided to call or connect to the advertised website. The advertisement has simply been attached to the webpage, without any underlying tracking.... . "Our mission hasn't changed in over 20 years: design, develop, maintain and enhance free tools to securely transfer files with ease and reliability," said Tim Kosse, FileZilla Lead Developer. This decision was a political one taken by FileZilla, to always preserve the freedom of their tools, and of their users. "We aren't the typical commercial open-source venture that starts doing things for free, and over time, closes this and that to make money" said Roberto Galoppini, FileZilla Director of Strategy. "While you might not see FileZilla listed at the NYSE [New York Stock Exchange] any time soon, the freedom of our tools will never be questioned...." [I]f you work in an industry that requires the secure transfer of sensitive files, or if you simply have personal photographs or videos you want to keep confidential, using proprietary platforms to share or store them can put your information at risk of being exposed.... FileZilla offers an alternative that is secure and private. Their tools are developed by a team that is deeply invested in protecting users' confidentiality, and liberating technology is central to their work and decision-making.... At the same time, projects like FileZilla remind us that there exists a global community of technologists, activists, coders, bloggers, journalists, software developers, and mindful internet users making internet freedom a lived reality and daily practice. Supporting, experimenting with and using free and open source tools, such as the FileZilla client and server, enables us to disinvest from the capitalist pursuit of corporate control of technology and unchecked surveillance of our data. Rather, we can step into alignment with an alternative, parallel narrative being created by a community of resistance that is grounded in principles of cooperation, solidarity, commons and openness.' -- source: https://news.slashdot.org/story/22/08/20/2031207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

eternal terminal
by Peter Reutemann 18 Aug '22

18 Aug '22

Hi everyone Facing recurring ssh connection interruptions with long running processes, my go-to solution is to use "screen" on the remote server. But that doesn't get around the problem of my ssh sessions being defunct or closed ("broken pipe"). Doing a quick internet search, I've just come across "eternal terminal": "Eternal Terminal (ET) is a remote shell that automatically reconnects without interrupting the session. " https://eternalterminal.dev/ https://github.com/MisterTea/EternalTerminal Does anybody have any experience with it? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Android could go 64-bit only in 2023, starting with the Pixel tablet
by Peter Reutemann 18 Aug '22

18 Aug '22

'Android 13 hit AOSP the other day, and included in the code source dump is an interesting commit spotted by Esper's Mishaal Rahman. It sounds like Google is planning to—or at least experimenting with—moving the upcoming Pixel tablet to a 64-bit-only build of Android. The commit doesn't beat around the bush, saying: "Move tangor to 64-bit only." "Tangor" is the codename for the already-announced Pixel tablet. iOS, with its single hardware manufacturer, has been 64-bit only since 2017. Android has a million moving parts split across a bunch of different companies, so getting to 64-bit only is going to be a long road. Getting there is worth the effort, though, with a promise of increased performance and additional security features. The Google Play app ecosystem is probably furthest along in supporting 64 bit. Any apps written entirely in Java or Kotlin already get automatic 64-bit compatibility from the system. Google mandated that Google Play apps using native code (usually these are games) needed to provide 64-bit versions back in 2019. There were exceptions for a few popular SDKs like Adobe Air and Unity, but these exceptions were ended in August 2021, when all apps were required to have 64-bit versions. As for hardware, every SoC should support 64-bit by now, and some flagship Android SoCs are actually reducing their ability to run 32-bit code. Any flagship chip following the recommended ARM design only supports 32-bit processing on three of the eight cores—the other five are 64-bit only. ARM wants to drop 32-bit support entirely from its 2023 flagship SoC design, but there are already rumors stating that Qualcomm doesn't want to follow that recommended design. The most likely reason is because of China. Google's 64-bit app requirements apply only to apps in Google Play, which doesn't exist in China. China has a big collection of competing app stores with more lax policies, so 32-bit apps have not been phased out as aggressively. China is working on this issue, though, with the top-five Chinese app stores—from Alibaba, Baidu, OPPO, Tencent, and Xiaomi—agreeing to ban 32-bit-only apps by the end of this month. There's also the issue of 64-bit compatibility among packed-in apps from OEM skins, which app store rules don't apply to. Rahman found another commit that suggests 64-bit-only support might be a regular feature of 2023's Android 14, so the Pixel tablet, which is already officially confirmed for next year, is looking like a test run to see how everything goes.' -- source: https://arstechnica.com/gadgets/2022/08/google-might-give-the-pixel-tablet-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Update Chrome now to patch actively exploited zero-day
by Peter Reutemann 18 Aug '22

18 Aug '22

'Google announced an update on Wednesday to the Stable channel of its Chrome browser that includes a fix for an exploit that exists in the wild. CVE-2022-2856 is a fix for "insufficient validation of untrusted input in Intents," according to Google's advisory. Intents are typically a way to pass data from inside Chrome to another application, such as the share button on Chrome's address bar. As noted by the Dark Reading blog, input validation is a common weakness in code. The exploit was reported by Ashley Shen and Christian Resell of the Google Threat Analysis Group, and that's all the information we have for now. Details of the exploit are currently tucked behind a wall in the Chromium bugs group and are restricted to those actively working on related components and registered with Chromium. After a certain percentage of users have applied the relevant updates, those details may be revealed. Google says the update—104.0.5112.101 for Mac and Linux and 104.0.5112.102/101 for Windows—will "roll out over the coming days/weeks," but you can (and should) manually update Chrome now (check the "About" section of your settings). There are 10 other security fixes included in the update. Dark Reading notes that this is Chrome's fifth zero-day vulnerability disclosed in 2022.' -- source: https://arstechnica.com/information-technology/2022/08/update-chrome-now-to… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VLC-Developer VideoLan Says India Blocking Site Endangers Its Own Citizens
by Peter Reutemann 17 Aug '22

17 Aug '22

'VideoLan, the developer of popular media player VLC, says Indian telecom operators have been blocking its website since February of this year in a move that is potentially impacting some users in one of the open source firm's largest markets. From a report: "Most major ISPs [internet service providers] are banning the site, with diverse techniques," VideoLan president and lead developer Jean-Baptiste Kempf said of the blocking in India, in an email to TechCrunch. India represents 10% of all VLC users worldwide, he said. The website's traffic has seen an overall drop of 20% as a result of the blocking in India. [...] VLC, downloaded over 3.5 billion times worldwide, is a local media player that doesn't require internet access or connection to any particular service online for the vast majority of its features. But by blocking the website, India is pushing its citizens to "shady websites that are running hacked version of VLC. So they are endangering their own citizens with this ban," Kempf added.' -- source: https://developers.slashdot.org/story/22/08/16/146257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Releases Android 13, Rolling Out First To Pixel Phones
by Peter Reutemann 16 Aug '22

16 Aug '22

'This year's major Android update, Android 13, is officially releasing today for Googleâ(TM)s Pixel phones, the search giant has announced. >From a report: The annual update is getting an official release a little earlier than usual, following Android 12's release last October and Android 11's release in September 2020. The list of updates arriving with this year's version of Android is likely to be familiar if you've been keeping up with Android 13's beta releases. There's the ability to customize non-Google app icons to match your homescreen wallpaper that we saw in Android 13's first developer preview, a new permission to cut down on notification spam, and a new option to limit which of your photos and videos an app can access. Back in January, we wrote that Google planned to spend this year catching up with Apple's ecosystem integrations, and there's more evidence of this in Android 13's official release. The update includes support for spatial audio with head tracking, which is designed to make sounds appear as though they're coming from a fixed point in space when you move your head while wearing compatible headphones, similar to a feature Apple offers for its AirPods. Today's post doesn't say exactly which headphones this will work with, but Google previously announced it would be updating its Pixel Buds Pro to offer support for spatial audio. Secondly, there's the ability to stream messages from apps including Google Messages directly to a Chromebook, similar to iMessage on the Mac.' -- source: https://tech.slashdot.org/story/22/08/15/1747228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.0 Arrives With Performance Improvements and More Rust Coming
by Peter Reutemann 16 Aug '22

16 Aug '22

'Linux creator Linus Torvalds has announced the first release candidate for the Linux kernel version 6.0, but he says the major number change doesn't signify anything especially different about this release. ZDNet: While there is nothing fundamentally different about this release compared with 5.19, Torvalds noted that there were over 13,500 non-merge commits and over 800 merged commits, meaning "6.0 looks to be another fairly sizable release." According to Torvalds, most of the updates are improvements to the GPU, networking and sound. Torvalds stuck to his word after releasing Linux kernel 5.19 last month, when he flagged he would likely call the next release 6.0 because he's "starting to worry about getting confused by big numbers again." On Sunday's release of Linux 6.0 release candidate version 1 (rc-1), he explained his reasoning behind choosing a new major version number and its purpose for developers. Again, it's about avoiding confusion rather than signaling that the release has major new features. His threshold for changing the lead version number was .20 because it is difficult to remember incremental version numbers beyond that. "Despite the major number change, there's nothing fundamentally different about this release - I've long eschewed the notion that major numbers are meaningful, and the only reason for a 'hierarchical; numbering system is to make the numbers easier to remember and distinguish," said Torvalds. Torvalds lamented some Rust-enabling code didn't make it into the release. The Register adds: "I actually was hoping that we'd get some of the first rust infrastructure, and the multi-gen LRU VM, but neither of them happened this time around," he mused, before observing "There's always more releases. This is one of those releases where you should not look at the diffstat too closely, because more than half of it is yet another AMD GPU register dump," he added, noting that Intel's Gaudi2 Ai processors are also likely to produce plenty of similar kernel additions. "The CPU people also show up in the JSON files that describe the perf events, but they look absolutely tiny compared to the 'asic_reg' auto-generated GPU and AI hardware definitions," he added.' -- source: https://linux.slashdot.org/story/22/08/15/199255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 9.3: A 2022 OS That Can Run On Late-1980s Hardware
by Peter Reutemann 14 Aug '22

14 Aug '22

'Version 9.3 of NetBSD is here, able to run on very low-end systems and with that authentic early-1990s experience. The Register reports: Version 9.3 comes some 15 months after NetBSD 9.2 and boasts new and updated drivers, improved hardware support, including for some recent AMD and Intel processors, and better handling of suspend and resume. The next sentence in the release announcement, though, might give some readers pause: "Support for wsfb-based X11 servers on the Commodore Amiga." This is your clue that we are in a rather different territory from run-of-the-mill PC operating systems here. A notable improvement in NetBSD 9.3 is being able to run a graphical desktop on an Amiga. This is a 2022 operating system that can run on late-1980s hardware, and there are not many of those around. NetBSD supports eight "tier I" architectures: 32-bit and 64-bit x86 and Arm, plus MIPS, PowerPC, Sun UltraSPARC, and the Xen hypervisor. Alongside those, there are no less than 49 "tier II" supported architectures, which are not as complete and not everything works -- although almost all of them are on version 9.3 except for the version for original Acorn computers with 32-bit Arm CPUs, which is still only on NetBSD 8.1. There's also a "tier III" for ports which are on "life support" so there may be a risk Archimedes support could drop to that. This is an OS that can run on 680x0 hardware, DEC VAX minicomputers and workstations, and Sun 2, 3, and 32-bit SPARC boxes. In other words, it reaches back as far as some 1970s hardware. Let this govern your expectations. For instance, in VirtualBox, if you tell it you want to create a NetBSD guest, it disables SMP support. ' -- source: https://tech.slashdot.org/story/22/08/12/1958253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Urges Windows Users To Run Patch For DogWalk Zero-Day Exploit
by Peter Reutemann 14 Aug '22

14 Aug '22

'Computerworld reports: Despite previously claiming the DogWalk vulnerability did not constitute a security issue, Microsoft has now released a patch to stop attackers from actively exploiting the vulnerability. [...] The vulnerability, known as CVE-2022-34713 or DogWalk, allows attackers to exploit a weakness in the Windows Microsoft Support Diagnostic Tool (MSDT). By using social engineering or phishing, attackers can trick users into visiting a fake website or opening a malicious document or file and ultimately gain remote code execution on compromised systems. DogWalk affects all Windows versions under support, including the latest client and server releases, Windows 11 and Windows Server 2022. The vulnerability was first reported in January 2020 but at the time, Microsoft said it didn't consider the exploit to be a security issue. This is the second time in recent months that Microsoft has been forced to change its position on a known exploit, having initially rejected reports that another Windows MSDT zero-day, known as Follina, posed a security threat. A patch for that exploit was released in June's Patch Tuesday update. ' -- source: https://tech.slashdot.org/story/22/08/12/2037213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's New Bug Bounties Include Their Custom Linux Kernel's Experimental Security Mitigations
by Peter Reutemann 14 Aug '22

14 Aug '22

'Google uses Linux "in almost everything," according to the leader of Google's "product security response" team — including Chromebooks, Android smartphones, and even Google Cloud. "Because of this, we have heavily invested in Linux's security — and today, we're announcing how we're building on those investments and increasing our rewards." In 2020, we launched an open-source Kubernetes-based Capture-the-Flag (CTF) project called, kCTF. The kCTF Vulnerability Rewards Program lets researchers connect to our Google Kubernetes Engine (GKE) instances, and if they can hack it, they get a flag, and are potentially rewarded. All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability. We've learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder. Unfortunately, security mitigations are often hard to quantify, however, we think we've found a way to do so concretely going forward.... First, we are indefinitely extending the increased reward amounts we announced earlier this year, meaning we'll continue to pay $20,000 — $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the important work being done to understand and improve kernel security. This is in addition to our existing patch rewards for proactive security improvements. Second, we're launching new instances with additional rewards to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances will be used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations. Today, we are starting with a set of mitigations we believe will make most of the vulnerabilities (9/10 vulns and 10/13 exploits) we received this past year more difficult to exploit. For new exploits of vulnerabilities submitted which also compromise the latest Linux kernel, we will pay an additional $21,000 USD. For those which compromise our custom Linux kernel with our experimental mitigations, the reward will be another $21,000 USD (if they are clearly bypassing the mitigations we are testing). This brings the total rewards up to a maximum of $133,337 USD. We hope this will allow us to learn more about how hard (or easy) it is to bypass our experimental mitigations..... With the kCTF VRP program, we are building a pipeline to analyze, experiment, measure and build security mitigations to make the Linux kernel as safe as we can with the help of the security community. We hope that, over time, we will be able to make security mitigations that make exploitation of Linux kernel vulnerabilities as hard as possible. "We don't care about vulnerabilities; we care about exploits," Vela told the Register. "We expect the vulnerabilities are there, they will get patched, and that's nice and all. But the whole idea is what do to beyond just patching a couple of vulnerabilities." In total, Google paid out $8.7 million in rewards to almost 700 researchers across its various VPRs last year. "We are just one actor in the whole community that happens to have economic resources, financial resources, but we need the community to help us make the Kernel better," Vela said. "If the community is engaged and helps us validate the mitigations that we have, then, we will continue growing on top of that. But the whole idea is that we need to see where the community wants us to go with this...." [I]t's not always about the cash payout, according to Vela, and different bug hunters have different motivations. Some want money, some want fame and some just want to solve an interesting problem, Vela said. "We are trying to find the right combination to captivate people." ' -- source: https://linux.slashdot.org/story/22/08/13/064239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Find Vulnerability In Software Underlying Discord, Microsoft Teams, and Other Apps
by Peter Reutemann 12 Aug '22

12 Aug '22

'Motherboard reports: A group of security researchers found a series of vulnerabilities in the software underlying popular apps like Discord, Microsoft Teams, Spotify and many others, which are used by tens of millions of people all over the world. At the Black Hat cybersecurity conference in Las Vegas on Thursday, the researchers presented their findings, detailing how they could have hacked people who use Discord, Microsoft Teams, and the chat app Element by exploiting the software underlying all of them: Electron, which is a framework built on the open source Chromium and the cross-platform javascript environment Node JS. In all these cases, the researchers submitted vulnerabilities to Electron to get them fixed, which earned them more than $10,000 in rewards. The bugs were fixed before the researchers published their research. Aaditya Purani, one of the researchers who found these vulnerabilities, said that "regular users should know that the Electron apps are not the same as their day-to-day browsers," meaning they are potentially more vulnerable. In the case of Discord, the bug Purani and his colleagues found only required them to send a malicious link to a video. With Microsoft Teams, the bug they found could be exploited by inviting a victim to a meeting. In both cases, if the targets clicked on these links, hackers would have been able to take control of their computers, Purani explained in the talk. For him, one of the main takeaways of their research is that Electron is risky precisely because users are very likely to click on links shared in Discord or Microsoft Teams.' -- source: https://it.slashdot.org/story/22/08/11/211256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi-Powered Anti-Tracking Tool Checks If You're Being Followed
by Peter Reutemann 12 Aug '22

12 Aug '22

'Matt Edmondson, a hacker and digital forensics expert, built a Raspberry Pi-powered anti-tracking tool that "scans for nearby devices and alerts you if the same phone is detected multiple times within the past 20 minutes," reports Wired. The device, which can be carried around or placed in a car, consists of parts that cost around $200 in total. From the report: The homemade system works by scanning for wireless devices around it and then checking its logs to see whether they also were present within the past 20 minutes. It was designed to be used while people are on the move rather than sitting in, say, a coffee shop, where it would pick up too many false readings. The anti-tracking tool, which can sit inside a shoebox-sized case, is made up of a few components. A Raspberry Pi 3 runs its software, a Wi-Fi card looks for nearby devices, a small waterproof case protects it, and a portable charger powers the system. A touchscreen shows the alerts the device produces. Each alert may be a sign that you are being tailed. The device runs Kismet, which is a wireless network detector, and is able to detect smartphones and tablets around it that are looking for Wi-Fi or Bluetooth connections. The phones we use are constantly looking for wireless networks around them, including networks they've connected to before as well as new networks. Edmondson says Kismet makes a record of the first time it sees a device and then the most recent time it was detected. But to make the anti-tracking system work, he had to write code in Python to create lists of what Kismet detects over time. There are lists for devices spotted in the past five to 10 minutes, 10 to 15 minutes, and 15 to 20 minutes. If a device appears twice, an alert flashes up on the screen. The system can show a phone's MAC address, although this is not much use if it's been randomized. It can also record the names of Wi-Fi networks that devices around it are looking for -- a phone that's trying to connect to a Wi-Fi network called Langley may give some clues about its owner. "If you have a device on you, I should see it," he says. In an example, he showed WIRED that a device was looking for a network called SAMSUNGSMART. To stop the system from detecting your own phone or those of other people traveling with you, it has an "ignore" list. By tapping one of the device's onscreen buttons, it's possible to "ignore everything that it has already seen." Edmondson says that in the future, the device could be modified to send a text alert instead of showing them on the screen. He is also interested in adding the capability to detect tire-pressure monitoring systems that could show recurring nearby vehicles. A GPS unit could also be added so you can see where you were when you were being tracked, he says. [...] Edmondson has no plans to make the device into a commercial product, but he says the design could easily be copied and reused by anyone with some technical knowledge. Many of the parts involved are easy to obtain or may be lying around the homes of people in tech communities. For those interested, Edmondson open-sourced its underlying code and plans to present the research project at the Black Hat security conference in Las Vegas this week.' -- source: https://yro.slashdot.org/story/22/08/11/2143207 Anybody interested in exploring that project and demoing it at our September meeting slot? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGX, Intel's Supposedly Impregnable Data Fortress, Has Been Breached Yet Again
by Peter Reutemann 10 Aug '22

10 Aug '22

'Intel's latest generation of CPUs contains a vulnerability that allows attackers to obtain encryption keys and other confidential information protected by the company's software guard extensions, the advanced feature that acts as a digital vault for security users' most sensitive secrets. From a report: Abbreviated as SGX, the protection is designed to provide a fortress of sorts for the safekeeping of encryption keys and other sensitive data, even when the operating system or a virtual machine running on top is maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. SGX is a cornerstone of the security assurances many companies provide to users. Servers used to handle contact discovery for the Signal Messenger, for instance, rely on SGX to ensure the process is anonymous. Signal says running its advanced hashing scheme provides a "general recipe for doing private contact discovery in SGX without leaking any information to parties that have control over the machine, even if they were to attach physical hardware to the memory bus." The example is purely hypothetical. Signal spokesperson Jun Harada wrote in an email: "Intel alerted us to this paper... and we were able to verify that the CPUs that Signal uses are not impacted by the findings of this paper and therefore are not vulnerable to the stated attack." Key to the security and authenticity assurances of SGX is its creation of what are called "enclaves," or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU.' -- source: https://it.slashdot.org/story/22/08/09/1814258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVIDIA Publishes 73k Lines Worth Of 3D Header Files For Fermi Through Ampere GPUs
by Peter Reutemann 10 Aug '22

10 Aug '22

'In addition to NVIDIA being busy working on transitioning to an open-source GPU kernel driver, yesterday they made a rare public open-source documentation contribution... NVIDIA quietly published 73k lines worth of header files to document the 3D classes for their Fermi through current-generation Ampere GPUs. Phoronix's Michael Larabel reports: To NVIDIA's Open-GPU-Docs portal they have posted the 73k lines worth of 3D class header files covering RTX 30 "Ampere" GPUs back through the decade-old GeForce 400/500 "Fermi" graphics processors. These header files define the classes used to program the 3D engine of the GPU, the texture header and texture sampler layout are documented, and other 3D-related programming bits. Having all of these header files will be useful to the open-source Nouveau driver developers to save on their reverse-engineering and guessing/uncertainty over certain bits. NVIDIA's Open GPU Kernel Driver is for only GeForce RTX 20 "Turing" series and newer, so it's great seeing NVIDIA now posting this documentation going back to Fermi which is squarely to help the open-source community / Nouveau. [...] The timing of NVIDIA opening these 3D classes back to Fermi is interesting and potentially tied to SIGGRAPH 2022 happening this week. Those wanting to grab NVIDIA's latest open-source GPU documentation can find it via this GitHub repository. ' -- source: https://news.slashdot.org/story/22/08/09/2225215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Phone Carrier That Doesn't Track Your Browsing Or Location
by Peter Reutemann 10 Aug '22

10 Aug '22

'Wired reports: As marketers, data brokers, and tech giants endlessly expand their access to individuals' data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users' locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world. The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can't access or track customers' metadata, location information, or mobile browsing. Launching in beta today for Android, the company's Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users' movements. And it will also offer a Relay service that disassociates a user's IP address from their web browsing. PGPP's ability to mask your phone's identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a "yes" or "no" about whether a device should get service. On the PGPP "Mobile Pro" plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There's also a "Mobile Core" plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month. Both of these plans also include PGPP's Relay service. Similar to Apple's iCloud Private Relay, PGPP's Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you're looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay -- in this case, Invisv -- but the information about the page you're trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you're trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay. In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. The carrier is still working to bring its services to Apple's iOS. It's also worth noting that Invisv only offers mobile data; there are no voice calling services.' -- source: https://yro.slashdot.org/story/22/08/08/219258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Amazon's Roomba Deal Is Really About Mapping Your Home
by Peter Reutemann 09 Aug '22

09 Aug '22

'Bloomberg: Amazon.com hasn't just bought a maker of robot vacuum cleaners. It's acquired a mapping company. To be more precise: a company that can make maps of your home. The company announced a $1.7 billion deal on Friday for iRobot, the maker of the Roomba vacuum cleaner. And yes, Amazon will make money from selling those gadgets. But the real value resides in those robots' ability to map your house. As ever with Amazon, it's all about the data. A smart home, you see, isn't actually terribly smart. It only knows that your Philips Hue lightbulbs and connected television are in your sitting room because you've told it as much. It certainly doesn't know where exactly the devices are within that room. The more it knows about a given space, the more tightly it can choreograph the way they interact with you. The smart home is clearly a priority for Amazon. Its Echo smart speakers still outsell those from rivals Apple and Google, with an estimated 9.9 million units sold in the three months through March, according to the analysis firm Strategy Analytics. It's complemented that with a $1 billion deal for the video doorbell-maker Ring in 2018, and the wi-fi company Eero a year later. But you still can't readily buy the Astro, Amazon's household robot that was revealed with some fanfare last year, is still only available in limited quantities. That, too, seemed at least partly an effort to map the inside of your property, a task that will now fall to iRobot. The Bedford, Mass.-based company's most recent products include a technology it calls Smart Maps, though customers can opt out of sharing the data. Amazon said in a statement that protecting customer data is "incredibly important." Slightly more terrifying, the maps also represent a wealth of data for marketers. The size of your house is a pretty good proxy for your wealth. A floor covered in toys means you likely have kids. A household without much furniture is a household to which you can try to sell more furniture. This is all useful intel for a company such as Amazon which, you may have noticed, is in the business of selling stuff.' -- source: https://slashdot.org/story/22/08/08/2039234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's 'Librem 5 USA' Smartphone Achieves Major New Shipping Milestone
by Peter Reutemann 08 Aug '22

08 Aug '22

'Purism posted an announcement Thursday about their privacy-focused "Librem 5 USA" smartphones. "New orders placed today will ship within our standard 10-business-day window." The Librem 5 USA now joins the Librem Mini and Librem 14 as a post-Just In Time product, one where instead of relying on Just In Time supply chains to manufacture a product just as we need it, we have invested in maintaining much larger inventories so that we can better absorb future supply chain issues that may come our way. For anyone who is new to the product, the Librem 5 USA is our premium phone that shares the same hardware design and features as our mass-produced Librem 5, but with electronics we make in the USA using a separate electronics supply chain that sources from US suppliers whenever possible. This results in a tighter, more secure supply chain for the Librem 5 USA. The Librem 5 USA uses the same PureOS as our other computers and so it runs the same desktop Linux applications you might be used to, just on a small screen. PureOS on the Librem 5 USA demonstrates real convergence, where the device becomes more than just a phone, it becomes a full-featured pocket-sized computer that can act like a desktop when connected to a monitor, keyboard and mouse, or even a laptop (or tablet!) when connected to a laptop docking station. All of your files and all of your software remains the same and follows you where you go. Applications just morph from the smaller screen to the larger screen when docked, just like connecting a external monitor to a laptop. Everyone who has backed the Librem 5 and Librem 5 USA projects hasn't just supported the production of the hardware itself, they have also supported a massive, multi-year software development effort to bring the traditional Linux desktop to a phone form-factor. Projects such as Phosh (the GUI), Phoc (the Compositor), Squeekboard (the Keyboard), Calls (for calling), Chats (for texting and messaging), and libhandy/libadwaita (libraries to make GTK applications adaptive) all required massive investment and many of these projects have already been moved to the GNOME infrastructure to better share our effort with a larger community. We are delighted to see that many other mobile projects have recognized the quality of our efforts and adopted our software into their own projects.... The Librem 5 USA was designed for longevity and because we support right to repair, we also offer a number of spare parts in our shop, including replacement modems so you can make sure you support all the cellular bands in a particular continent, replacement batteries for when you ultimately wear out your existing battery, and plenty of other spare parts that haven't had sufficient demand to post formally on our shop (yet). If you need a spare part that isn't yet on the shop, just ask.' -- source: https://linux.slashdot.org/story/22/08/07/0528255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Development Suddenly Resumes on Linux Distro CutefishOS
by Peter Reutemann 08 Aug '22

08 Aug '22

'Last month fans were worried about CuteFish OS, with its domain timing out, emails going unanswered, and a Twitter feed that hadn't posted anything since March. But "now it looks like the original development team behind CuteFishOS is coming back to life," according to this report from The New Stack — with a Reddit user planning a fork now saying that's been put on hold, since "I'd be duplicating work for no reason." Last Sunday — on July 31st — CuteFish's official repository on GitHub was updated with a new announcement in its profile. "Your Favorite CutefishOS are back now!" [sic] It also promised "New website in the works (coming soon)." and pointed to a new URL. You can see the changes happening right before your eyes. That website's domain — OpenFish.org — was registered just ten days ago, on Thursday, July 28th — and it's still a work in progress. On Thursday afternoon it was pointing to a non-English-language page hosted on the Pakistani cloud platform QCloud — but by Thursday night it was showing a testing page for a NGNIX HTTP server running Red Hat Enterprise Linux. And there's now also a new README file in CuteFish's GitHub repository listing five items as "progressing." The first item is "official website preparation," but other items include collating the previous pull requests and issues, "fix the existing problem," and eventually adding new features. The sole contributor to the repository appears to be a Chinese coder going under the name of Biukang. "We are preparing for the restart of CutefishOS," says Biukang's GitHub profile now. But the article still hails last month's discussion of a fork as "a chance to see open source communities mobilizing into action just to fill a perceived void."' -- source: https://linux.slashdot.org/story/22/08/06/0019243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DreamWorks Animation To Release Renderer As Open-Source Software
by Peter Reutemann 07 Aug '22

07 Aug '22

'With annual CG confab SIGGRAPH slated to start Monday in Vancouver, DreamWorks Animation announced its intent to release its proprietary renderer, MoonRay, as open-source software later this year. Hollywood Reporter reports: MoonRay has been used on feature films such as How to Train Your Dragon: The Hidden World, Croods: A New Age, The Bad Guys and upcoming Puss in Boots: The Last Wish. MoonRay uses DreamWorks' distributed computation framework, Arras, also to be included in the open-source code base. "We are thrilled to share with the industry over 10 years of innovation and development on MoonRay's vectorized, threaded, parallel, and distributed code base," said Andrew Pearce, DWA's vp of global technology. "The appetite for rendering at scale grows each year, and MoonRay is set to meet that need. We expect to see the code base grow stronger with community involvement as DreamWorks continues to demonstrate our commitment to open source."' -- source: https://news.slashdot.org/story/22/08/05/229228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Backlash, GitLab U-Turns on Deleting Dormant Projects
by Peter Reutemann 07 Aug '22

07 Aug '22

'"GitLab has reversed its decision to automatically delete projects that are inactive for more than a year and belong to its free-tier users," reports the Register. Thursday GitLab tweeted: "We discussed internally what to do with inactive repositories. We reached a decision to move unused repos to object storage. Once implemented, they will still be accessible but take a bit longer to access after a long period of inactivity." But the Register says they've seen internal documents from "well-placed sources" showing that GitLab had originally "hoped the move would save it up to $1 million a year and help make its SaaS business sustainable." And the company had spent a long time preparing for such a move: Documents we have seen gave staff notice of an internal meeting scheduled for August 9. The agenda for the meeting lays out the plan to delete dormant code repositories... Other internal documents seen by The Register mention the possible use of object storage to archive projects but express concerns that doing so would increase GitLab's costs by creating a need for multiple redundant backups. We have also seen internal discussions confirming the automation code to delete inactive projects was completed by the end of July, and was ready to roll out after months of debate and development work. One of our sources told us [Thursday] that it was online pressure, led by The Register's reporting, that forced a dramatic rethink at the GitHub rival. Word of the deletion policy as a money-saving exercise sparked fury on Twitter and Reddit. On GitLab's Twitter feed Thursday, someone raised an interesting point about GitLab's new promise to move inactive repos into object storage. "Wait, does 'inactive' mean repositories that have no new commits? Or only those without new commits AND without read access by cloning / fetching?" And GitLab's CEO/co-founder Sid Sijbrandij replied, "We're not sure yet. Probably all write operations would keep a project active, creating an issue, a merge request, pushing changes to a branch, etc. We might also keep it active as long as people are doing read operations such as cloning, forking, etc." Friday Sijbrandij tweeted this status update: "Archived projects is a user activated state that signals intent. We're not sure yet but very likely the storage type used is orthogonal to that. Our current plan for object storage would keep the repos visible to everyone."' -- source: https://developers.slashdot.org/story/22/08/06/0417218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Browser's Stricter Privacy Protection Will Also Apply To Microsoft Scripts Now
by Peter Reutemann 06 Aug '22

06 Aug '22

'After a revelation in May that DuckDuckGo's (DDG) privacy-focused web browser allows Microsoft tracking scripts on third-party websites, the company now says it will start blocking those too. From a report: DuckDuckGo's browser had third-party tracker loading protection by default that already blocked scripts embedded on websites from Facebook, Google, and others, but until now Microsoft's scripts from the Bing and LinkedIn domains (but not its third-party cookies) had a pass. A security researcher named Zach Edwards pointed out the exclusion that he apparently uncovered while auditing the browser's privacy claims, and noted it is especially curious because Microsoft is the partner that delivers ads in DDG's search engine (while promising not to use that data to create a monitored profile of users to target ads, instead relying on context to decide which ones it should show). DuckDuckGo CEO Gabe Weinberg said at the time that the reason for it was a search syndication agreement with Microsoft, and that more updates on third-party tracker preventions were coming. A backlash ensued, with some seizing on DuckDuckGo's own words that "tracking is tracking," a phrase the company used against Google's cookie-replacing "privacy sandbox" ad technology. Now Weinberg writes in a blog post, "I've heard from a number of users and understand that we didn't meet their expectations around one of our browser's web tracking protections." DuckDuckGo is vowing to be more transparent about what trackers its browser and extensions are protecting users from, making its tracker blocklists available and offering users more information on how its tracking protections with a new help page.' -- source: https://yro.slashdot.org/story/22/08/05/173203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mint 20: disappearing window decorations (MATE)
by Peter Reutemann 05 Aug '22

05 Aug '22

Hi everyone Since a few weeks, I've been getting these random events where all my window decorations are disappearing and I basically have to restart my X session. This happens under Linux Mint 20, MATE edition. Looking through systemd journals, I noticed core dumps and I ran the following command to just list core dumps: sudo coredumpctl list I noticed that "/usr/bin/marco" (the MATE window manager) was causing some of the crashes. After a bit of duckduckgoing, I came across some posts on the Mint forums that mention a bug in marco 1.24, which apparently got fixed in 1.24.1: https://forums.linuxmint.com/viewtopic.php?t=354845 And I'm running indeed that version of the window manager ("dpkg -l | grep marco"): 1.24.0-1ubuntu1 One suggestion was to switch from "marco+compositing" to "metacity+compositing", which I'm trialing now (Control Center -> Desktop settings -> Windows -> Window manager). Maybe this will help other people experiencing this issue... :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

GitLab Plans To Delete Dormant Projects in Free Accounts
by Peter Reutemann 05 Aug '22

05 Aug '22

'GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier, The Register reported Thursday. From the report: The Register has learned that such projects account for up to a quarter of GitLab's hosting costs, and that the auto-deletion of projects could save the cloudy coding collaboration service up to $1 million a year. The policy has therefore been suggested to help GitLab's finances remain sustainable. People with knowledge of the situation, who requested anonymity as they are not authorized to discuss it with the media, told The Register the policy is scheduled to come into force in September 2022. GitLab is aware of the potential for angry opposition to the plan, and will therefore give users weeks or months of warning before deleting their work. A single comment, commit, or new issue posted to a project during a 12-month period will be sufficient to keep the project alive. The Register understands some in the wider GitLab community worry that the policy could see projects disappear before users have the chance to archive code on which they rely. As many open-source projects are widely used, it is feared that the decision could have considerable negative impact.' -- source: https://developers.slashdot.org/story/22/08/04/1919231 Ouch... I have a bunch of projects that haven't been touched for years, as they are plugins to stable APIs (and didn't require any fixes/updates). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Expands 3D Potential With Vulkan Update
by Peter Reutemann 03 Aug '22

03 Aug '22

'The Raspberry Pi 4 has hit a major graphics milestone, adding support for a more modern Vulkan 3D APIa. Ars Technica reports: Raspberry Pi CEO Eben Upton announced the Pi 4's Vulkan 1.2 conformance on Monday. Support isn't available yet in downloadable Pi-friendly operating systems but should be coming soon. For most people using their Pi as a server, a DIY controller, or a light desktop, Vulkan 1.2 conformance won't be noticeable. Desktop graphics on the standard Raspberry Pi OS are powered by OpenGL, the older graphics API that Vulkan is meant to replace. There is one group that benefits, says Upton: games and other 3D Android applications. Android uses Vulkan as its low-overhead graphics API. As with most Raspberry Pi advancements, there could be unforeseen opportunities unleashed by this seemingly tiny change. Vulkan 1.2 support gives developers the same 3D-graphics interface (if not anywhere near the same power) as 2019 NVIDIA graphics cards, 2020 Intel chips with integrated graphics, and dozens of other devices. With a Vulkan 1.0 driver installed, developer Iago Toral was able in 2020 to get the original Quake trilogy mostly running on a Pi 4, with not-too-shabby frame rates. ' -- source: https://tech.slashdot.org/story/22/08/02/226200 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Gmail Attack Bypasses Passwords and 2FA To Read All Email
by Peter Reutemann 03 Aug '22

03 Aug '22

'Forbes: According to cyber security firm Volexity, the threat research team has found the North Korean 'SharpTongue' group, which appears to be part of, or related to, the Kimsuky advanced persistent threat group, deploying malware called SHARPEXT that doesn't need your Gmail login credentials at all. Instead, it "directly inspects and exfiltrates data" from a Gmail account as the victim browses it. This quickly evolving threat, Volexity says it is already on version 3.0 according to the malware's internal versioning, can steal email from both Gmail and AOL webmail accounts, and works across three browsers: Google Chrome, Microsoft Edge, and a South Korean client called Whale. The U.S. Cybersecurity & Infrastructure Security Agency, CISA, reports that Kimsuky has been operating since 2012, and is "most likely tasked by the North Korean regime with a global intelligence gathering mission." While CISA sees Kimsuky most often targeting individuals and organizations in South Korea, Japan, and the U. S., Volexity says that the SharpTongue group has frequently been seen targeting South Korea, the U. S. and Europe. The common denominator between them is that the victims often " work on topics involving North Korea, nuclear issues, weapons systems, and other matters of strategic interest to North Korea." The report says that SHARPEXT differs from previous browser extensions deployed by these hacking espionage groups in that it doesn't attempt to grab login credentials but bypasses the need for these and can grab email data as the user reads it. The good news is that your system needs to be compromised by some means before this malicious extension can be deployed. Unfortunately, we know all too well that system compromise is not as difficult as it should be. Once a system has been compromised by phishing, malware, unpatched vulnerabilities, whatever, the threat actors can install the extension using a malicious VB script that replaces the system preference files. Once that's done and the extension runs quietly in the background, it is tough to detect. The user logs in to their Gmail account from their normal browser on the expected system. The security researchers recommend "enabling and analyzing PowerShell ScriptBlock logging" to detect whether you've been targeted by this attack, reports Forbes. Additionally, they recommend reviewing installed extensions regularly, especially looking for ones you don't recognize or are not available from the Chrome Web Store.' -- source: https://it.slashdot.org/story/22/08/02/2041205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Dirty Carbon Secret Behind Solid State Memory Drives
by Peter Reutemann 03 Aug '22

03 Aug '22

'Solid state drives use far less power than hard disc drives. But a new study unexpectedly reveals that their lifetime carbon footprint is much higher than their hard disc cousins, raising difficult questions for the computer industry. From a report: The benefits of SSDs over HDDs are legion. They are smaller, mechanically simpler, faster to read and write data than their hard disc cousins. They are also more energy efficient. So with many computer manufacturers and datacenter operators looking to reduce their carbon footprints, it's easy to imagine that all this makes the choice of memory easy. But all is not as it seems, say Swamit Tannu at University of Wisconsin in Madison and Prashant Nair at the University of British Columbia in Vancouver. SSDs have a dirty secret. Tannu and Nair have measured the carbon footprint per gigabyte of these devices across their entire lifetimes and, unexpectedly, it turns out that SSDs are significantly dirtier. "Compared to SSDs, the embodied [carbon] cost of HDDs is at least an order of magnitude lower," say the researchers. Tannu and Nair come to their conclusion by adding up the amount of carbon emitted throughout the estimated 10-year lifespans of these devices. This includes the carbon emitted during manufacture, during operation, for transportation and for disposal. The carbon emitted during operation is straightforward to calculate. To read and write data, HDDs consume 4.2 Watts versus 1.3W for SSDs. The researchers calculate that a 1 terabyte HDD emits the equivalent of 159 kilograms of carbon dioxide during a 10-year operating lifespan. By comparison, a 1 terabyte SSD emits just 49.2 kg over 10 years. But SSDs are significantly more carbon intensive to manufacture. That's because the chip fabrication facilities for SSDs operate at extreme temperatures and pressures that are energy intensive to maintain. And bigger memories require more chips, which increases the footprint accordingly. All this adds up to a significant carbon footprint for SSD manufacture. Tannu and Nair calculate that manufacturing a 1 terabyte SSD emits the equivalent of 320 kg of carbon dioxide. By comparison, a similar HDD emits just 40 kg. So the lifetime footprint for a 1 terabyte SSD is 369.2 kg of carbon dioxide equivalent versus 199 kg for an HDD. So HDDs are much cleaner. That's a counterintuitive result with important implications. At the very least, it suggests that computer manufacturers and cloud data storage operators should reconsider the way they use SSDs and HDDs. For example, almost 40 per cent of the carbon footprint of a desktop computer comes from its SSD, compared to just 4 per cent from the CPU and 11 per cent from the GPU.' -- source: https://hardware.slashdot.org/story/22/08/02/1837229 I wish my drives would last 10 years, neither HDD or SSD seem to last that long... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Releases Linux 5.19 - From an Apple Silicon MacBook
by Peter Reutemann 01 Aug '22

01 Aug '22

'"Linus Torvalds just released Linux 5.19 as stable for the newest version of the Linux kernel..." reports Phoronix. But they also note that on the Linux kernel mailing list, "Torvalds went on to write about his Arm-based MacBook [running an AArch64 Apple M1 SoC]... now under Linux thanks to the work of the Asahi Linux project." Torvalds wrote: [T]he most interesting part here is that I did the release (and am writing this) on an arm64 laptop. It's something I've been waiting for for a _loong_ time, and it's finally reality, thanks to the Asahi team. We've had arm64 hardware around running Linux for a long time, but none of it has really been usable as a development platform until now. It's the third time I'm using Apple hardware for Linux development — I did it many years ago for powerpc development on a ppc970 machine. And then a decade+ ago when the Macbook Air was the only real thin-and-lite around. And now as an arm64 platform. Not that I've used it for any real work, I literally have only been doing test builds and boots and now the actual release tagging. But I'm trying to make sure that the next time I travel, I can travel with this as a laptop and finally dogfooding the arm64 side too. ' -- source: https://apple.slashdot.org/story/22/07/31/2326216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux Mint 21 Cinnamon
by Peter Reutemann 01 Aug '22

01 Aug '22

'Today saw the release of Linux Mint 21 "Vanessa" Cinnamon Edition, a long term support release (supported until 2027). Release notes at LinuxMint.com promise that it comes with "refinements and many new features to make your desktop experience more comfortable." Among the highlights: its Bluetooth manager is now Blueman (instead of Blueberry). Blueberry depended on gnome-bluetooth, which was developed exclusively for GNOME. In contrast, Blueman relies on the standard Bluez stack which works everywhere and can even be used or queried from the command line. The Blueman manager and tray icon provide many features that weren't available in Blueberry and a lot more information which can be used to monitor your connection or troubleshoot Bluetooth issues. Out of the box Blueman features better connectivity, especially when it comes to headsets and audio profiles. In preparation for Linux Mint 21 the Blueman user interface was improved and received support for symbolic icons. Upstream, Blueman and Bluez are actively developed and used in many environments. The lack of thumbnails for some common file types was identified as a usability issue. To address it a new Xapp project called xapp-thumbnailers was started and is now featured in Linux Mint 21. The project brings support for the following mimetypes: - AppImage - ePub - MP3 (album cover) - RAW pictures (most formats) - Webp Automated tasks are great to keep your computer safe but they can sometimes affect the system's performance while you're working on it. A little process monitor was added to Linux Mint to detect automated updates and automated system snapshots running in the background. Whenever an automated task is running the monitor places an icon in your system tray. Your computer might still become slow momentarily during an update or a snapshot, but with a quick look on the tray you'll immediately know what's going on.... Linux Mint 21 uses IPP, also known as Driverless Printing and Scanning (i.e. a standard protocol which communicates with printers/scanners without using drivers). For most printers and scanners no drivers are needed, and the device is detected automatically. And there's also a fabulous collection of new backgrounds.' -- source: https://linux.slashdot.org/story/22/07/31/1922217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next month
by Peter Reutemann 29 Jul '22

29 Jul '22

Hi everyone For next month's meeting (I know, I'm early this time round!), I was thinking of the following topic: Essential command-line tools like find, grep, cat, less/more, bc, head/tail, etc. Rather than just one person demoing tools, I'm thinking more of a joint effort, where everyone can demo one or more tools. Doesn't matter if the same tool comes up more than once. There will be always useful options to hear about! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Costs Of Mobile Data By Country
by Lawrence D'Oliveiro 27 Jul '22

27 Jul '22

Report on a table compiled in the UK <https://www.theregister.com/2022/07/26/mobile_data_survey/>, on comparative mobile data costs in different countries, puts NZ at 210th place out of 233 countries surveyed. We are paying USD6.72 per gigabyte (NZD11.00), with entries lower down going to over USD40, while ones at the top go down to mere cents. Australia is paying about a tenth of what we are.

1 0

Discovery of new UEFI rootkit exposes an ugly truth: The attacks are invisible to us
by Peter Reutemann 27 Jul '22

27 Jul '22

'Researchers have unpacked a major cybersecurity find—a malicious UEFI-based rootkit used in the wild since 2016 to ensure computers remained infected even if an operating system is reinstalled or a hard drive is completely replaced. The firmware compromises the UEFI, the low-level and highly opaque chain of firmware required to boot up nearly every modern computer. As the software that bridges a PC’s device firmware with its operating system, the UEFI—short for Unified Extensible Firmware Interface—is an OS in its own right. It’s located in an SPI-connected flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch the code. Because it’s the first thing to run when a computer is turned on, it influences the OS, security apps, and all other software that follows. On Monday, researchers from Kaspersky profiled CosmicStrand, the security firm’s name for a sophisticated UEFI rootkit that the company detected and obtained through its antivirus software. The find is among only a handful of such UEFI threats known to have been used in the wild. Until recently, researchers assumed that the technical demands required to develop UEFI malware of this caliber put it out of reach of most threat actors. Now, with Kaspersky attributing CosmicStrand to an unknown Chinese-speaking hacking group with possible ties to cryptominer malware, this type of malware may not be so rare after all. “The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016—long before UEFI attacks started being publicly described,” Kaspersky researchers wrote. “This discovery begs a final question: If this is what the attackers were using back then, what are they using today?” While researchers from fellow security firm Qihoo360 reported on an earlier variant of the rootkit in 2017, Kaspersky and most other Western-based security firms didn’t take notice. Kaspersky’s newer research describes in detail how the rootkit—found in firmware images of some Gigabyte or Asus motherboards—is able to hijack the boot process of infected machines. The technical underpinnings attest to the sophistication of the malware.' -- source: https://arstechnica.com/information-technology/2022/07/researchers-unpack-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Sours On Creative Commons 'No Rights Reserved' License
by Peter Reutemann 27 Jul '22

27 Jul '22

'Fedora, the popular Linux distribution, will no longer incorporate software licensed under CC0, the Creative Commons "No Rights Reserved" license. In order to support the wide re-use of copyrighted content in new works, CC0 provides authors "a way to waive all their copyright and related rights in their works to the fullest extent allowed by law." The license arose in response to the 1998 Sonny Bono Copyright Term Extension Act (CTEA), which extended the duration of copyright by 20 years at the expense of the public domain. But CC0 explicitly says the licensor does not waive patent rights, which for free and open source software (FOSS) is a potential problem. That means, for instance as described here, if you use CC0-licensed code in your project, and the author of that code later claims your project is infringing a patent they own regarding that code, your defense will be limited. Avoiding the use of CC0-licensed code is one way to steer clear of these so-called submarine patents that could years later torpedo you. In a message to The Fedora Project's mailing list for legal issues, Richard Fontana, a technology lawyer for Red Hat (which sponsors Fedora), explained that while CC0 is cited as a "good license," it won't be for much longer. "We plan to classify CC0 as allowed-content only, so that CC0 would no longer be allowed for code," said Fontana. "This is a fairly unusual change and may have an impact on a nontrivial number of Fedora packages (that is not clear to me right now), and we may grant a carveout for existing packages that include CC0-covered code." Fontana said there's a growing consensus in the FOSS community that licenses without any form of patent licensing or forbearance aren't suitable. CC0, he said, like other Creative Commons licenses, includes a clause that explicitly states no patent rights are waived by the licensor.' -- source: https://linux.slashdot.org/story/22/07/26/2028205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Coding Mistake Made Intel GPUs 100X Slower in Ray Tracing
by Peter Reutemann 26 Jul '22

26 Jul '22

'Intel Linux GPU driver developers have released an update that results in a massive 100X boost in ray tracing performance. This is something to be celebrated, of course. However, on the flip side, the driver was 100X slower than it should have been because of a memory allocation oversight. Tom's Hardware reports: Linux-centric news site Phoronix reports that a fix merged into the open-source Intel Mesa Vulkan driver was implemented by Intel Linux graphics driver engineering stalwart Lionel Landwerlin on Thursday. The developer wryly commented that the merge request, which already landed in Mesa 22.2, would deliver "Like a 100x (not joking) improvement." Intel has been working on Vulkan raytracing support since late 2020, but this fix is better late than never. Usually, the Vulkan driver would ensure temporary memory used for Vulkan raytracing work would be in local memory, i.e., the very fast graphics memory onboard the discrete GPU. A line of code was missing, so this memory allocation housekeeping task wasn't set. Thus, the Vulkan driver would shift ray tracing data to slower offboard system memory and back. Think of the continued convoluted transfers to this slower memory taking place, slowing down the raytracing performance significantly. It turns out, as per our headline, that setting a flag for "ANV_BO_ALLOC_LOCAL_MEM" ensured that the VRAM would be used instead, and a 100X performance boost was the result. "Mesa 22.2, which includes the new code, is due to be branched in the coming days and will be included in a bundle of other driver refinements, which should reach end-users by the end of August," adds the report.' -- source: https://tech.slashdot.org/story/22/07/25/2316244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: Framework’s next-gen Laptop follows through on its upgradeable promises
by Peter Reutemann 26 Jul '22

26 Jul '22

'It's one thing to say you're making a fully user-serviceable, upgradeable laptop. It's another thing to actually follow through with it. The original Framework Laptop we reviewed last year did a lot of things right. It's easy to open and work on, the ports can be swapped out to suit your needs, and it's sturdy and well-built enough to stand up to traditional, less-upgradeable-and-repairable ultrabooks like Dell's XPS 13 or Lenovo's ThinkPad X1 Carbon. But making "one surprisingly good laptop" isn't the same as creating a laptop ecosystem with upgradeable, interchangeable, user-serviceable parts. To do that, you need to keep up with new component releases. You need to address the shortcomings of your original design (or even release new revisions) without ending support for or breaking compatibility with previous versions of your design. And your small, independent company needs to continue to exist so it can keep getting all that work done, year after year, for a few years. I can't say what the next year or two will bring, but I can say that the second-generation Framework Laptop is still doing almost everything right. It's a lightly revised version of the original chassis designed around a 12th-generation Intel Core CPU rather than an 11th-gen version, and the motherboard exists as a drop-in upgrade for anyone who has already bought a Framework Laptop. The Framework Laptop does have problems, especially when it comes to battery life. But overall, it's a thoughtfully designed computer that treats do-it-yourselfers and PC builders like adults who can make their own decisions. There still isn't another laptop quite like it.' -- source: https://arstechnica.com/gadgets/2022/07/review-frameworks-next-gen-laptop-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 26 Jul '22

26 Jul '22

Hi everyone We have a meeting on Monday with the following topic: 'Open source software is always about choice. Whereas Windows users can't really do much about the desktop experience that gets dictated by Microsoft, Linux users can choose from a wide variety of desktop environments. Tonight, we will explore a range of these: MATE, Cinnamon, Gnome, KDE, LXDE, XFCE and maybe more. If your favorite environment is not listed, then please join in and demo it!' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776683/ Virtual meeting link: https://bbb2.nzoss.nz/b/pet-w7y-nxe-vxh Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Zero-day used to infect Chrome users could pose threat to Edge and Safari users, too
by Peter Reutemann 22 Jul '22

22 Jul '22

'A secretive seller of cyberattack software recently exploited a previously unknown Chrome vulnerability and two other zero-days in campaigns that covertly infected journalists and other targets with sophisticated spyware, security researchers said. CVE-2022-2294, as the vulnerability is tracked, stems from memory corruption flaws in Web Real-Time Communications, an open-source project that provides JavaScript programming interfaces to enable real-time voice, text, and video communications capabilities between web browsers and devices. Google patched the flaw on July 4 after researchers from security firm Avast privately notified the company it was being exploited in watering hole attacks, which infect targeted websites with malware in hopes of then infecting the users known to frequent them. Microsoft and Apple have since patched the same WebRTC flaw in their Edge and Safari browsers, respectively.' -- source: https://arstechnica.com/information-technology/2022/07/exploit-seller-used-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell’s XPS 13 Plus Developer Edition gets Ubuntu 22.04 LTS certified
by Peter Reutemann 21 Jul '22

21 Jul '22

'Dell is extending its love for Linux to the Dell XPS 13 Plus. The Developer Edition of the laptop has been Ubuntu 22.04 LTS-certified, Canonical announced today. That means the laptop will be sold starting in August with the latest version of Ubuntu, and owners of the XPS 13 Plus Developer Edition can download Ubuntu 22.04 LTS today (even if they bought it with Windows 11) for guaranteed performance. The XPS 13 Plus Developer Edition is the first 22.04 LTS-certified laptop, joining only some Raspberry Pi devices in certification. However, Dell has been certifying some of its XPS laptops, as well as other machines, for Ubuntu for generations. HP and Lenovo also have Ubuntu-certified systems. Of course, Ubuntu certification means all the components will "work as expected," as Canonical's announcement today put it. Further, Ubuntu LTS certification means the device will have support for at least 10 years. Ubuntu's release cycle page states that LTS (long-term support) releases include 10 years of "Base Package" maintenance and security updates. "Certified devices also include specific software or drivers that differ from the default distribution where required. These are defined in a meta-package that automatically [installs] the optimal configuration of packages, drivers, and kernel to deliver the best experience on that device," Canonical's announcement said.' -- source: https://arstechnica.com/gadgets/2022/07/dells-xps-13-plus-developer-edition… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google, Oracle Cloud Servers Wilt in UK Heatwave, Take Down Websites
by Peter Reutemann 20 Jul '22

20 Jul '22

'Cloud services and servers hosted by Google and Oracle in the UK have dropped offline due to cooling issues as the nation experiences a record-breaking heatwave. From a report: When the mercury hit 40.3C (104.5F) in eastern England, the highest ever registered by a country not used to these conditions, datacenters couldn't take the heat. Selected machines were powered off to avoid long-term damage, causing some resources, services, and virtual machines to became unavailable, taking down unlucky websites and the like. Multiple Oracle Cloud Infrastructure resources are offline, including networking, storage, and compute provided by its servers in the south of UK. Cooling systems were blamed, and techies switched off equipment in a bid to prevent hardware burning out, according to a status update from Team Oracle. "As a result of unseasonal temperatures in the region, a subset of cooling infrastructure within the UK South (London) Data Centre has experienced an issue," Oracle said on Tuesday at 1638 UTC. "As a result some customers may be unable to access or use Oracle Cloud Infrastructure resources hosted in the region.' -- source: https://it.slashdot.org/story/22/07/19/204256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Denmark Bans Chromebooks, Google Workspace In Schools Over Data Transfer Risks
by Peter Reutemann 20 Jul '22

20 Jul '22

'Denmark is effectively banning Google's services in schools, after officials in the municipality of Helsingor were last year ordered to carry out a risk assessment around the processing of personal data by Google. TechCrunch reports: In a verdict published last week, Denmark's data protection agency, Datatilsynet, revealed that data processing involving students using Google's cloud-based Workspace software suite -- which includes Gmail, Google Docs, Calendar and Google Drive -- "does not meet the requirements" of the European Union's GDPR data privacy regulations. Specifically, the authority found that the data processor agreement -- or Google's terms and conditions -- seemingly allow for data to be transferred to other countries for the purpose of providing support, even though the data is ordinarily stored in one of Google's EU data centers. Google's Chromebook laptops, and by extension Google Workspace, are used in schools across Denmark. But Datatilsynet focused specifically on Helsingor for the risk assessment after the municipality reported a "breach of personal data security" back in 2020. While this latest ruling technically only applies to schools in Helsingor for now, Datatilsynet notes that many of the conclusions it has reached will "probably apply to other municipalities" that use Google Chromebooks and Workspace. It added that it expects these other municipalities "to take relevant steps" off the back of the decision it reached in Helsingor. The ban is effective immediately, but Helsingor has until August 3 to delete user data. A Google spokesperson told TechCrunch in a statement: "We know that students and schools expect the technology they use to be legally compliant, responsible, and safe. That's why for years, Google has invested in privacy best practices and diligent risk assessments, and made our documentation widely available so anyone can see how we help organizations to comply with the GDPR. Schools own their own data. We only process their data in accordance with our contracts with them. In Workspace for Education, students' data is never used for advertising or other commercial purposes. Independent organizations have audited our services, and we keep our practices under constant review to maintain the highest possible standards of safety and compliance."' -- source: https://news.slashdot.org/story/22/07/18/2059204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disentangling The Debian Derivatives: Which Should You Use?
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Intro to just a few <https://www.theregister.com/2022/07/18/disentangling_the_debian_derivatives/> members of the sprawling family of Debian derivatives. I think one of the reasons it has spawned so many offshoots is because the maintainers have made a point of ensuring the tools they use to create the distro itself are easy to use, adapt and configure, not just for themselves, but for others, too.

1 0

Servers running Digium Phones VoiP software are getting backdoored
by Peter Reutemann 19 Jul '22

19 Jul '22

'Servers running the open source Asterisk communication software for Digium VoiP services are under attack by hackers who are managing to commandeer the machines to install web shell interfaces that give the attackers covert control, researchers have reported. Researchers from security firm Palo Alto Networks said they suspect the hackers are gaining access to the on-premises servers by exploiting CVE-2021-45461. The critical remote code-execution flaw was discovered as a zero-day vulnerability late last year, when it was being exploited to execute malicious code on servers running fully updated versions of Rest Phone Apps, aka restapps, which is a VoiP package sold by a company called Sangoma. The vulnerability resides in FreePBX, the world's most widely used open source software for Internet-based Private Branch Exchange systems, which enable internal and external communications in organizations' private internal telephone networks. CVE-2021-45461 carries a severity rating of 9.8 out of 10 and allows hackers to execute malicious code that takes complete control of servers.' -- source: https://arstechnica.com/information-technology/2022/07/servers-running-digi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple’s Windows 10
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Fred Brooks predicted long ago that complex pieces of software would eventually reach the point of irreducible entropy, where any attempt to fix a bug would simply introduce a new one. Microsoft’s Windows 10 seems to be about there, and it’s now clear that Apple’s macOS 10.15 “Catalina” has also joined that elite group <https://www.theregister.co.uk/2020/05/27/apple_catalina_update/>: The first spin of Catalina, officially released in October 2019, was a mess. ... The biggest issue was that all kinds of apps simply stopped working. ... Peripherals like mice, keyboards and printers stopped working. Email went missing; iCloud backups failed; users were constantly harassed by login requests; updates didn’t update ... ... So came for the first update to its new system one week after the main launch which fixed some, but not all, of the issues. ... Version two came in December 2019 and fixed some of those issues, but not all. ... More bug fixes came with version three in January 2020, but the OS seemed to have finally stabilized; something that was then spectacularly undone with version .4. ... Then we had the “supplemental update” to version 10.15.4, which fixed some, but not all, of the problems – most significantly the problem with Finder and transferring large files. And, amazingly, appeared to undo the good work that had been done with website security and broke SSH for some users. But now, with version point-five this week, that problem appears to have been sorted and, of course, your battery might last longer too.

1 1

Linux distro for Apple silicon Macs is already up and running on the brand-new M2
by Peter Reutemann 19 Jul '22

19 Jul '22

'Unlike Intel Macs, Apple silicon Macs were designed to run only Apple's software. But the developers on the Asahi Linux team have been working to change that, painstakingly reverse-engineering support for Apple's processors and other Mac hardware and releasing it as a work-in-progress distro that can actually boot up and run on bare metal, no virtualization required. The Asahi Linux team put out a new release today with plenty of additions and improvements. Most notably, the distro now supports the M1 Ultra and the Mac Studio and has added preliminary support for the M2 MacBook Pro (which has been tested firsthand by the team) and the M2 MacBook Air (which hasn't been tested but ought to work). Preliminary Bluetooth support for all Apple silicon Macs has also been added, though the team notes that it works poorly when connected to a 2.4GHz Wi-Fi network because "Wi-Fi/Bluetooth coexistence isn't properly configured yet." There are still many other things that aren't working properly, including the USB-A ports on the Studio, faster-than-USB-2.0 speeds from any Type-C/Thunderbolt ports, and GPU acceleration, but progress is being made on all of those fronts. GPU work in particular is coming along, with a "prototype driver" that is "good enough to run real graphics applications and benchmarks" already up and running, though it's not included in this release.' -- source: https://arstechnica.com/gadgets/2022/07/linux-distro-for-apple-silicon-macs… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Defence Of Swap: Common Misconceptions
by Lawrence D'Oliveiro 19 Jul '22

19 Jul '22

Came across this page <https://chrisdown.name/2018/01/02/in-defence-of-swap.html>, which gives an overview of the point of swap space. Some people (including myself) think “we have so much RAM on our systems nowadays, why bother allocating any swap space at all?” But really it’s more than just an overflow area for when you run out of RAM, it is a basis for more efficiently managing that RAM, no matter how much you might have. Actually I found the above linked from this <https://www.freedesktop.org/software/systemd/man/systemd-oomd.service.html> manual page on systemd-oomd. This service (available via an additional package on Debian) tries to take corrective action when the system starts running low on memory, before things get bad enough to wake up the kernel’s dreaded “OOM-killer”.

1 0

topic for next Monday?
by Peter Reutemann 19 Jul '22

19 Jul '22

Hi everyone We have a meeting coming up next Monday, but no topic/speaker at this stage. Any suggestions/volunteers? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Report: Facebook has Started Encrypting Links to Counter Browsers' Anti-Tracking Measures
by Peter Reutemann 19 Jul '22

19 Jul '22

'"Facebook has started to use a different URL scheme for site links," writes the technology blog Ghacks, "to combat URL stripping technologies that browsers such as Firefox or Brave use to improve privacy and prevent user tracking." Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties. Mozilla introduced support for URL stripping in Firefox 102, which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser's Tracking Protection feature is set to strict. Firefox users may enable URL stripping in all Firefox modes, but this requires manual configuration. Brave Browser strips known tracking parameters from web addresses as well.... It is no longer possible to remove the tracking part of the URL, as Facebook merged it with part of the required web address.' -- source: https://tech.slashdot.org/story/22/07/18/0433238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can a Fork Save Cutefish OS (or Its Desktop)?
by Peter Reutemann 18 Jul '22

18 Jul '22

'In April ZDNet called its beta "the cutest Linux distro you'll ever use," praising the polished "incredible elegance" of Debian-based Cutefish OS, with its uncluttered, MacOS-like "Cutefish DE" desktop. But now CutefishOS.com times out, with at least one Reddit user complaining "their email is not responding" and seeking contributors for a fork. But meanwhile, the technology site DebugPoint.com shares another update: It looks like the OpenMandriva project is already continuing with the development of the Cutefish DE (not the OS) for its own OS. For more details, visit the Matrix discussion page. Besides, it's worth mentioning that Arch Linux already have the Cutefish desktop packages in the community repo. You can even install it as a standalone desktop environment in Arch Linux with easy steps. As you can see, it is easier to maintain the desktop environment to continue its development because the structure is already out there. I have tested and reviewed hundreds of distros for years, and Cutefish OS is the promising one with its stunning desktop environment. It was written from the ground up with QML and C++ and took advantage of KWin. It would have been an attractive desktop as a separate component and could have been another great option besides KDE Plasma or GNOME. Many open-source projects are born and die every year, and it's unfortunate to see the situation of Cutefish OS. I hope an official fork comes up soon, and we all can contribute to it.' -- source: https://linux.slashdot.org/story/22/07/17/0143210 It's been a while to see another desktop environment in action. Anyone keen presenting Cutefish DE next Monday? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google says you can now turn these 400 Macs, PCs into reliable Chromebooks
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google today announced in a blog post that ChromeOS Flex, a version of its Chromebook operating system suitable for most hardware, has moved from early access to general availability. It also said it certified "over 400" devices, including systems from Apple, Dell, and HP, to run the OS smoothly and stably. Google announced ChromeOS Flex in February, building upon its 2020 acquisition of CloudReady (CloudReady becomes ChromeOS Flex now that the latter is stable). Cloud OS Flex is downloadable to a USB drive for free, allowing you to install it on a Mac or Windows PC. The most obvious use for ChromeOS Flex is to bring new life to a dated machine that may be too old to get software updates for its native OS. Our ChromeOS Flex beta review found the OS to be an interesting alternative for people content with doing most of their computing in a browser and for getting a budget-level Chromebook experience from an 8-to 9-year-old system.' -- source: https://arstechnica.com/gadgets/2022/07/google-says-you-can-now-turn-these-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 13 marches toward release with final beta version
by Peter Reutemann 18 Jul '22

18 Jul '22

'Google is quickly marching toward the next release of Android. The company announced the "final" Android 13 beta yesterday, beta 4, with word that an official release is "coming in the weeks ahead." After the massive overhaul of Android 12, Android 13 seems to be a smaller release focusing on various improvements and tablet features. A lot of Android 13 is building on the work from Android 12 and the tablet-focused mini-release, Android 12L. There are more Material You color options and more tweaks to the new notification media player. The tablet interface has a new app-drawer button for the taskbar and split-screen drag-and-drop support for notifications. You get more control over apps with a foreground app task manager and a new permission that requires apps to ask for notification access. Under the hood there is some serious virtualization power and support for Bluetooth LE Audio. There's even finally a standard QR Code reader now.' -- source: https://arstechnica.com/gadgets/2022/07/android-13-marches-toward-release-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

techradar: "I've started using Mozilla Firefox and now I can never go back to Google Chrome"
by Peter Reutemann 18 Jul '22

18 Jul '22

'The year is 2008 and I had been using Mozilla Firefox for two years after my painful but inevitable breakup with Internet Explorer. But, out of school and professional necessity, I had to make the switch to Google Chrome. For the most part, it worked out for me. It had features that Firefox at the time didn’t, like being able to sync and access tabs from other devices or saving all my bookmarks under a single profile that I could transfer to other PCs. Then over the years, Google became more invasive. It, like many other major corporations, started tracking and compiling data and creating detailed profiles that it could sell to marketing firms. Lucrative business for them, but a nail in the coffin for internet privacy. The other nail is the fact that Chrome’s market share has absolutely skyrocketed during this period of time. Back in 2008 when I first made the switch, Google and Mozilla weren’t too far apart but now, thanks to most other browsers using some form of Chromium to power them, the gap might as well be an ocean. But I’m here to tell you that it doesn’t have to be that way. I finally switched back to Mozilla Firefox in 2019 and found it to be an incredible browser that had every feature Chrome had and more.' -- source: https://www.techradar.com/in/features/ive-started-using-mozilla-firefox-and… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Microsoft Screws Up Linux
by Lawrence D'Oliveiro 17 Jul '22

17 Jul '22

Remember that version 1.0 of WSL (“Windows Services for Linux”) tried to emulate Linux APIs on top of the Windows kernel, but that turned out to be impossible to get right. (Why not? Windows kernel not functional enough?) So WSL 2.0 abandoned this approach, to bring in a true-blue Linux kernel running under a cut-down version of Microsoft’s Hyper-V virtualization system. Problem solved, right? You’d think having an actual Linux kernel would be sufficient to implement actual Linux APIs. And so Microsoft can offer regular Linux distros like Ubuntu to run on Windows, under WSL. But it turns out WSL actually relies on a specially-patched Microsoft version of the Linux kernel. So you can’t just take any old Linux distro and install it. Which is why you only have the option of distros specially packaged for the Microsoft Store. Furthermore, this special WSL kernel has some bugs in it that a regular Linux kernel does not. I discovered this while browsing through the open-issues list for libffi <https://github.com/libffi/libffi>. This library offers a “foreign-function interface”, which high-level languages can use to call functions written in C. For example, this library is the basis of Python’s ever-handy ctypes module. Look at this issue <https://github.com/libffi/libffi/issues/552>, where the script for building libffi fails under WSL. One participant has narrowed the problem down to this: The following shell script which performs the issued part in a generated configure file is as follows: #!/bin/bash exec 5>>my.log { touch my.log mkdir -p workdir cd workdir test -f ../my.log && mv ../my.log . stat my.log } On a Linux system single partition, the stat call will show expected data. In a WSL environment on an NTFS mount, the call will fail. The only real subtlety is that the enclosing block has a file open for writing that the code inside the block is moving to a different directory. But all this has perfectly-defined behaviour according to the POSIX spec. This applies even if the destination directory is on a separate filesystem, so that the “mv” command has to turn the rename into a copy-then-delete. I tried that script on my genuine Linux system, with and without “workdir” being a separate filesystem. I even tried formatting the separate filesystem as an NTFS volume. The code worked fine in all cases. So what’s going wrong? It could be the age-old Windows bugbear, where you cannot access a file that has already been opened somewhere else, because it is “locked”. Somehow Microsoft has transplanted this limitation into its own version of the Linux kernel. This may be a “feature” under Windows, but it is no longer conforming to POSIX filesystem semantics!

1 0

Network Un-Neutrality Coming To Europe?
by Lawrence D'Oliveiro 14 Jul '22

14 Jul '22

Seems some ISPs are lobbying the European Commission to allow them to charge fees to companies such as Google, Meta and Netflix for providing their content to the ISPs’ paying customers <https://arstechnica.com/tech-policy/2022/07/eu-lawmakers-slam-idea-of-forci…>. Because the ISPs aren’t already charging their customers enough? They claim that the big content providers are somehow getting a “free ride” (even though they have to pay for their own Internet connections)? Our previous discussion about the consequences of such policies: <https://list.waikato.ac.nz/hyperkitty/list/wlug(a)list.waikato.ac.nz/thread…> (Seems the list archive was moved to a different system at some point, invalidating all previous archive links.)

1 0

X.Org Server Hit By New Local Privilege Escalation, Remote Code Execution Vulnerabilities
by Peter Reutemann 13 Jul '22

13 Jul '22

'Getting things started for this "Patch Tuesday" are the disclosure of two new X.Org Server vulnerabilities. Phoronix reports: These issues affecting out-of-bounds accesses with the X.Org Server can lead to local privilege elevation on systems where the X.Org Server is running privileged and remote code execution for SSH X forwarding sessions. CVE-2022-2319 and CVE-2022-2320 were made public this morning and both deal with the X.Org Server's Xkb keyboard extension not properly validating input that could lead to out-of-bounds memory writes. Fixes for these XKB vulnerabilities have been patched in X.Org Server Git and xorg-server 21.1.4 point release is expected soon with these fixes. Both vulnerabilities were discovered by Trend Micro's Zero Day Initiative. ' -- source: https://it.slashdot.org/story/22/07/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Working Speculative Execution Attack Sends Intel and AMD Scrambling
by Peter Reutemann 13 Jul '22

13 Jul '22

'Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability. Ars Technica reports: Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, also known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they're about to receive and automatically execute it before the prediction is confirmed. Spectre works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled. [...] The ETH Zurich researchers have conclusively shown that retpoline is insufficient for preventing speculative execution attacks. Their Retbleed proof-of-concept works against Intel CPUs with the Kaby Lake and Coffee Lake microarchitectures and AMD Zen 1, Zen 1+, and Zen 2 microarchitectures. In response to the research, both Intel and AMD advised customers to adopt new mitigations that the researchers said will add as much as 28 percent more overhead to operations. [...] Both Intel and AMD have responded with advisories. Intel has confirmed that the vulnerability exists on Skylake-generation processors that don't have a protection known as enhanced Indirect Branch Restricted Speculation (eIBRS) in place. "Intel has worked with the Linux community and VMM vendors to provide customers with software mitigation guidance which should be available on or around today's public disclosure date," Intel wrote in a blog post. "Note that Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment." AMD, meanwhile, has also published guidance. "As part of its ongoing work to identify and respond to new potential security vulnerabilities, AMD is recommending software suppliers consider taking additional steps to help guard against Spectre-like attacks," a spokesman wrote in an email. The company has also published a whitepaper. [Research Kaveh Razavi added:] "Retbleed is more than just a retpoline bypass on Intel, specially on AMD machines. AMD is in fact going to release a white paper introducing Branch Type Confusion based on Retbleed. Essentially, Retbleed is making AMD CPUs confuse return instructions with indirect branches. This makes exploitation of returns very trivial on AMD CPUs." The mitigations will come at a cost that the researchers measured to be between 12 percent and 28 percent more computational overhead. Organizations that rely on affected CPUs should carefully read the publications from the researchers, Intel, and AMD and be sure to follow the mitigation guidance.' -- source: https://hardware.slashdot.org/story/22/07/12/2052224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo are now shipping (some) laptops that only boot Windows by default
by Eliot Blennerhassett 13 Jul '22

13 Jul '22

"Starting in 2022 for Secured-core PCs it is a Microsoft requirement for the 3rd Party Certificate to be disabled by default. The apparent secured-core requirement for 2022 is that the second of these CAs should not be trusted by default. As a result, drivers or bootloaders signed with this certificate will not run on these systems. This means that, out of the box, these systems will not boot anything other than Windows[1]." https://mjg59.dreamwidth.org/60248.html ... are we surprised? -- Eliot

2 1

Two-Factor Authentication Doesn’t Help Against Phishing Attacks
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

This article <https://arstechnica.com/information-technology/2022/07/microsoft-details-ph…> points out that using a second authentication factor cannot really guard against “man-in-the-middle” attacks. If the fake site is passing on your credentials to carry out a logon to the real site, then it can also pass on any extra authentication factors that are coming through alternative channels: One of the few visually suspicious elements in the scam is the domain name used in the proxy site landing page. Still, given the opaqueness of most organization-specific login pages, even the sketchy domain name might not be a dead giveaway. Too often, it seems, this use of obscure login URLs neuters the effectiveness of the only real clue that the user might have to a phishing attack. My own insurance company is doing this sort of thing. They send me a renewal reminder e-mail, and all the links in it go through some online Adobe-run service for tracking the clicks. (Why can it not go through their own domain name, at least?) I told them about it last year and again this year: this year I finally got a response asking me to send them the offending message, which I did.

1 0

Rentware Comes To Cars
by Lawrence D'Oliveiro 13 Jul '22

13 Jul '22

Korean BMW owners can now pay a monthly fee to activate features in their cars such as heated seats, automatic high-beam switching, or being able to save video from the car’s cameras <https://www.theregister.com/2022/07/12/bmw_locks_korean_car_owners/>. Customers have expressed their dislike of this idea, which means you can expect to see it spread more widely.

1 0

Microsoft Resorts To Registry Hack To Keep Outlook From Using Windows 11 Search
by Lawrence D'Oliveiro 12 Jul '22

12 Jul '22

The catalogue of sadness here <https://www.theregister.com/2022/07/11/outlook_search/> just goes on: The indexing service is infamously fragile ... A temporary workaround is to simply switch off Windows Desktop Search to force Outlook to use its built-in service. Users that choose this option will be warned that Search will be impacted because a group policy has turned off the Windows Search service, but let's face it, less-than-slick performance has long been a hallmark of the Windows Search services. ... Windows Search has long blighted Microsoft's flagship operating system, and behind the scenes Windows Search continues to cause grief for some.

1 0

Hackers Uncover Ways To Unlock and Start Nearly All Modern Honda-Branded Vehicles
by Peter Reutemann 12 Jul '22

12 Jul '22

'The Drive: Hackers have uncovered ways to unlock and start nearly all modern Honda-branded vehicles by wirelessly stealing codes from an owner's key fob. Dubbed "Rolling Pwn," the attack allows any individual to "eavesdrop" on a remote key fob from nearly 100 feet away and reuse them later to unlock or start a vehicle in the future without owner's knowledge. Despite Honda's dispute that the technology in its key fobs "would not allow the vulnerability," The Drive has independently confirmed the validity of the attack with its own demonstration. Older vehicles used static codes for keyless entry. These static codes are inherently vulnerable, as any individual can capture and replay them at will to lock and unlock a vehicle. Manufacturers later introduced rolling codes to improve vehicle security. Rolling codes work by using a Pseudorandom Number Generator (PRNG). When a lock or unlock button is pressed on a paired key fob, the fob sends a unique code wirelessly to the vehicle encapsulated within the message. The vehicle then checks the code sent to it against its internal database of valid PRNG-generated codes, and if the code is valid, the car grants the request to lock, unlock, or start the vehicle. The database contains several allowed codes, as a key fob may not be in range of a vehicle when a button is pressed and may transmit a different code than what the vehicle is expecting to be next chronologically. This series of codes is also known as a "window," When a vehicle receives a newer code, it typically invalidates all previous codes to protect against replay attacks. This attack works by eavesdropping on a paired keyfob and capturing several codes sent by the fob. The attacker can later replay a sequence of valid codes and re-sync the PRNG. This allows the attacker to re-use older codes that would normally be invalid, even months after the codes have been captured. [...] Contrary to Honda's claim, I independently confirmed the vulnerability by capturing and replaying a sequence of lock and unlock requests with my 2021 Honda Accord and a Software-Defined Radio. Despite being able to start and unlock the car, the vulnerability doesn't allow the attacker to actually drive off with the vehicle due to the proximity functionality of the key fob. However, the fact that a bad actor can get this far is already a bad sign. At this time, the following vehicles may be affected by the vulnerability: 2012 Honda Civic, 2018 Honda X-RV, 2020 Honda C-RV, 2020 Honda Accord, 2021 Honda Accord, 2020 Honda Odyssey, 2021 Honda Inspire, 2022 Honda Fit, 2022 Honda Civic, 2022 Honda VE-1, and 2022 Honda Breeze. It's not yet clear if this affects any Acura-branded vehicles. "[W]e've looked into past similar allegations and found them to lack substance," said a Honda spokesperson in a statement to The Drive. "While we don't yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."' -- source: https://tech.slashdot.org/story/22/07/11/2023254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Toward a Future We Want to Live In' - EFF Celebrates 32nd Birthday
by Peter Reutemann 11 Jul '22

11 Jul '22

'"Today at the Electronic Frontier Foundation, we're celebrating 32 years of fighting for technology users around the world," reads a new announcement posted at EFF.org: If you were online back in the 90s, you might remember that it was pretty wild. We had bulletin boards, FTP, Gopher, and, a few years later, homespun websites. You could glimpse a future where anyone, anywhere in the world could access information, float new ideas, and reach each other across vast distances. It was exciting and the possibilities seemed endless. But the founders of EFF also knew that a better future wasn't automatic. You don't organize a team of lawyers, technologists, and activists because you think technology will magically fix everything — you do it because you expect a fight. Three decades later, thanks to those battles, the internet does much of what it promised: it connects and lifts up major grassroots movements for equity, civil liberties, and human rights and allows people to connect and organize to counteract the ugliness of the world. But we haven't yet won that future we envisioned. Just as the web connects us, it also serves as a hunting ground for those who want to surveil and control our actions, those who wish to harass and spread hate, as well as others who seek to monetize our every move and thought. Information collected for one purpose is freely repurposed in ways that oppress us, rather than lift us up. The truth is that digital tools allow those with horrible ideas to connect with each other just as it does those with beautiful, healing ones. EFF has always seen both the beauty and destructive potential of the internet, and we've always put our marker down on the side of justice, freedom, and innovation. We work every day toward a future we want to live in, and we don't do it alone. Support from the public makes every one of EFF's activism campaigns, software projects, and court filings possible. Together, we anchor the movement for a better digital world, and ensure that technology supports freedom, justice, and innovation for all people of the world. In fact, I invite every digital freedom supporter to join EFF during our summer membership drive. Right now, you can be a member for as little as $20, get some special new gear, and ensure that tech users always have a formidable defender in EFF. So how does the EFF team celebrate this auspicious anniversary? EFF does what it does best: stand up for users and innovators in the courts, in the halls of power, in the public conversation. We build privacy-protecting tools, teach skills to community members, share knowledge with allies, and preserve the best aspects of the wild web. In other words, we use every tool in our deep arsenal to fight for a better and brighter digital future for all. Thank you for standing with EFF when it counts.' -- source: https://yro.slashdot.org/story/22/07/10/199234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Six Ground-Breaking New Linux Laptops Released in the Last Two Weeks
by Peter Reutemann 11 Jul '22

11 Jul '22

'In the last two weeks six new Linux laptops have hit the market (or were announced). "The Linux hardware scene is getting better by the day," writes the site FOSS Weekly: - Star Labs teases its new StarFighter Linux Laptop with a 4K (10-bit IPS) display. - MNT Research introduces a "more affordable" 7-inch mini Linux laptop, the MNT Pocket Reform. - KDE's Slimbook 4 is here with AMD Ryzen 7 5700U processor and a better battery, starting from $1,000. "Buying from Slimbook supports KDE development too," notes Gaming on Linux, adding that there's a choice of 14 or 15.6 inch displays. - TUXEDO's Pulse 15 — Gen2 (also with an AMD Ryzen 7 5700U processor) has a 15-inch HiDPI WQHD 165Hz display, along with eight cores and 16 threads. (And the Register notes its twin cooling fans, "allowing them to overclock the chip and run it at 35W," and a choice of distros.) - Pre-orders have opened for the Roma — the first RISC-V Laptop (which may ship in September). Ars Technica reports they're offering "free Silicon upgrades" — that is free system-on-a-chip and system-on-module upgrades for its quad-core RISC-V CPU. And there's also a companion NPU/GPU, notes a blog post at RISCV.org, "for the fastest, seamless RISC-V native software development available." (As well as "early access to next-generation laptop and accessory upgrades at generous discounts or for free.") The blog post calls it a "Web3-friendly platform with NFT creation and publication plus integrated MetaMask-style wallet." - System 76's "Lemur" Alder Lake- and coreboot-powered laptop arrives with 14 hours of battery life.' -- source: https://linux.slashdot.org/story/22/07/10/2019230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Microsoft Ban Commercial Open Source from Its App Store?
by Peter Reutemann 10 Jul '22

10 Jul '22

'Microsoft has "delayed enforcement" of what could be a controversial policy change, according to the Software Freedom Conservancy: A few weeks ago, Microsoft quietly updated its Microsoft [app] Store Policies, adding new policies (which go into effect next week), that include this text: all pricing ... must ... [n]ot attempt to profit from open-source or other software that is otherwise generally available for free [meaning, in price, not freedom]. Wednesday, a number of Microsoft Store users discovered this and started asking questions. Quickly, those of us (including our own organization) that provide Free and Open Source Software (FOSS) via the Microsoft Store started asking our own questions too.... Since all (legitimate) FOSS is already available (at least in source code form) somewhere "for free" (as in "free beer"), this term (when enacted) will apply to all FOSS... Sadly, these days, companies like Microsoft have set up these app stores as gatekeepers of the software industry. The primary way that commercial software distributors reach their customers (or non-profit software distributors reach their donors) is via app stores. Microsoft has closed its iron grasp on the distribution chain of software (again) — to squeeze FOSS from the marketplace. If successful, even app store users will come to believe that the only legitimate FOSS is non-commercial FOSS. This is first and foremost an affront to all efforts to make a living writing open source software. This is not a merely hypothetical consideration. Already many developers support their FOSS development (legitimately so, at least under the FOSS licenses themselves) through app store deployments that Microsoft recently forbid in their Store.... Microsoft counter-argues that this is about curating content for customers and/or limiting FOSS selling to the (mythical) "One True Developer". But, even a redrafted policy (that Giorgio Sardo [General Manager of Apps at Microsoft] hinted at publicly early Thursday) will mandate only toxic business models for FOSS (such as demo-ware, less-featureful versions available as FOSS, while the full-featured proprietary version is available for a charge). The Conservancy argues that FOSS "was designed specifically to allow both the original developers and downstream redistributors to profit fairly from the act of convenient redistribution (such as on app stores)." But it also speculates about the sincerity of Microsoft's intentions. "We're cognizant that Microsoft probably planned all this, anyway — including the community outrage followed by their usual political theater of feigned magnanimity." The Conservancy's post Thursday received an update Friday about Microsoft's coming policy update: After we and others pointed out this problem, a Microsoft employee claimed via Twitter that they would "delay enforcement" of their new anti-FOSS regulation [giving as their reason that "it could be perceived differently than intended."] We do hope Microsoft will ultimately rectify the matter, and look forward to the change they intend to enact later. Twitter is a reasonable place to promote such a change once it's made, but an indication of non-enforcement by one executive on their personal account is a suboptimal approach. This is a precarious situation for FOSS projects who currently raise funds on the Microsoft Store; they deserve a definitive answer. Given the tight timetable (just five days!) until the problematic policy actually does go into effect, we call on Microsoft to officially publish a corrected policy now that addresses this point and move the roll-out date at least two months into the future. (We suggest September 16, 2022.) This will allow FOSS projects to digest the new policy with a reasonable amount of time, and give Microsoft time to receive feedback from the impacted projects and FOSS experts.' -- source: https://news.slashdot.org/story/22/07/09/0247213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0