- wlug - list.wlug.org.nz

Linux Malware Sees 35% Growth During 2021
by Peter Reutemann 18 Jan '22

18 Jan '22

'The number of malware infections targeting Linux devices rose by 35% in 2021, most commonly to recruit IoT devices for DDoS (distributed denial of service) attacks. BleepingComputer reports: A Crowdstrike report looking into the attack data from 2021 summarizes the following: - In 2021, there was a 35% rise in malware targeting Linux systems compared to 2020. - XorDDoS, Mirai, and Mozi were the most prevalent families, accounting for 22% of all Linux-targeting malware attacks observed in 2021. - Mozi, in particular, had explosive growth in its activity, with ten times more samples circulating in the wild the year that passed compared to the previous one. - XorDDoS also had a notable year-over-year increase of 123%. [...] The Crowstrike findings aren't surprising as they confirm an ongoing trend that emerged in previous years. For example, an Intezer report analyzing 2020 stats found that Linux malware families increased by 40% in 2020 compared to the previous year. In the first six months of 2020, a steep rise of 500% in Golang malware was recorded, showing that malware authors were looking for ways to make their code run on multiple platforms. This programming, and by extension, targeting trend, has already been confirmed in early 2022 cases and is likely to continue unabated. ' -- source: https://linux.slashdot.org/story/22/01/17/2239204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why is Android 12 So Buggy?
by Peter Reutemann 18 Jan '22

18 Jan '22

'Android 12 is one of the platform's most ambitious updates in recent history, bringing a major design overhaul to every corner of the operating system. It has also been one of the rockiest Android OS launches in the past few years. From a report: Both Samsung and OnePlus paused the rollout of their stable Android 12-based updates amid reports of serious bugs. Google itself has addressed a laundry list of bug reports from Pixel 6 owners, just as it's trying to convince them it's finally figured out how to build a truly premium phone. What in the heck is going on? The short answer is that there are some unique complicating factors at play this year but also that Android is inherently a little bit messy -- that just comes with the territory when you're designing a delightful public park compared to Apple's walled garden. Despite a refreshed look and some appealing new high-end handsets, Android is still Android -- the good and the bad. To try and figure out what the heck is going on, we talked to Mishaal Rahman, former editor-in-chief of XDA Developers, who's well known for digging into Android codebases and discovering Google's secrets. Speaking to the Pixel 6 bugs in particular, Rahman guesses that it has a lot to do with the unusually large size of the update. "Many people have called it, myself included, the biggest OS update to Android since Android 5.0 Lollipop, and that was many years ago. There are just so many massive changes to the interface and to the feature set." He also suggests that Google's commitment to issue a new Android update every year can make things worse when it's trying to do so much, and the self-imposed one-year development cycle doesn't leave much wiggle room in the timeline. "They started immediately after Android 11 was released to the public -- and they have a hard cutoff date... After that, they just focus on fixing bugs." Delay any longer, and they'd risk bumping into next year's development cycle. It's also possible that the attempt to bring timely Android updates to non-Google devices wound up backfiring. Android phone owners have been asking for faster updates for a long time -- outside of Google's Pixel phones and pricey flagships, many devices face long waits for OS updates. Sure enough, the updates have come faster this year. Case in point: Samsung users are accustomed to waiting about three months after an Android stable release to get their finished One UI update with the new version of the OS, but this year, One UI 4.0 arrived just one and a half months after Android 12. But the way things have gone this year, many users would likely have opted for a slower, stable update rather than a fast one riddled with bugs.' -- source: https://mobile.slashdot.org/story/22/01/17/2026239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF praises Android’s new 2G kill switch, wants Apple to follow suit
by Peter Reutemann 17 Jan '22

17 Jan '22

'The Electronic Frontier Foundation is celebrating Google's addition of a 2G kill switch to Android 12. The digital rights group has been campaigning against the dated, insecure 2G cellular standard since 2020, and Android is the first mobile OS to take the group's advice and let users completely disable 2G. In the US, carriers shut down 2G years ago, and the 3G shutdown is already underway. Phones have not really gotten the message, though, and modems still try to connect to any nearby 2G signals automatically. The problem is that 2G is very old, and it's a lot like connecting to a WEP-secured Wi-Fi hotspot—the security is obsolete, so it's easy to crack. If you're in a country where legitimate uses of 2G are long dead, the standard only serves as an attack vector via fake cell phone towers, so why not just shut it off?' -- source: https://arstechnica.com/gadgets/2022/01/eff-praises-androids-new-2g-kill-sw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russia says it has neutralized the cutthroat REvil ransomware gang
by Peter Reutemann 17 Jan '22

17 Jan '22

'Russian law enforcement authorities said on Friday that they have arrested 14 people associated with REvil, a top ransomware group that has disrupted critical operations of wealthy targets and held their data hostage. The action, carried out by Russia’s FSB, the successor agency to the KGB, is a rare example of the country’s government cracking down on cybercrime by its citizens. The US and Russia have no extradition treaty in place, and critics have said the Kremlin routinely harbors cybercriminals as long as they don’t target organizations located in the former Soviet Union. The arrests come as tensions between Russia and the US escalate over a standoff involving Ukraine.' -- source: https://arstechnica.com/information-technology/2022/01/russia-says-it-has-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor RAT for Windows, macOS, and Linux went undetected until now
by Peter Reutemann 17 Jan '22

17 Jan '22

'Researchers have uncovered a never-before-seen backdoor malware written from scratch for systems running Windows, macOS, or Linux that remained undetected by virtually all malware scanning engines. Researchers from security firm Intezer said they discovered SysJoker—the name they gave the backdoor malware—on the Linux-based Webserver of a “leading educational institution.” As the researchers dug in, they found SysJoker versions for both Windows and macOS as well. They suspect the cross-platform RAT—short for remote access trojan—was unleashed in the second half of last year. The discovery is significant for several reasons. First, fully cross-platform malware is something of a rarity, with most malicious software being written for one specific operating system. The RAT was also written from scratch and made use of four separate command-and-control servers, an indication that the people who developed and used it were part of an advanced threat actor that invested significant resources. It’s also unusual for previously unseen Linux malware to be found in a real-world attack.' -- source: https://arstechnica.com/information-technology/2022/01/backdoor-for-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Restores Account of Developer Who Intentionally Corrupted His Libraries
by Peter Reutemann 17 Jan '22

17 Jan '22

'What happened after a developer intentionally corrupted two of their libraries which collectively had more than 20 million weekly downloads and thousands of dependent projects? Mike Melanson's "This Week in Programming" column reports: In response to the corrupted libraries, Microsoft quickly suspended his GitHub access and reverted the projects on npm.... While this might seem like an open and shut case to some — the developer committed malicious code and GitHub and npm did what it had to do to protect its users — a debate broke out around a developer's rights to do what they wish with their code, no matter how many projects and dependencies it may have. "GitHub suspending someone's account for modifying their own code in a project they own however they want spooks me a lot more than NPM reverting a package," [tweeted one company's Director of Engineering & Technology]. "I kind of love what Marak did to make a point and protest to be honest." An article on iProgrammer further outlines the dilemma present in what might otherwise seem like a clear-cut case.... "Yes, it is open source in that you can fork it and can contribute to it but does this mean that GitHub is justified in denying you the right to change or even destroy your own code?" As of last night, however, it would appear that the entire affair is merely one for intellectual debate, as GitHub has indeed lived up to what some might view as its end of the bargain: the developer's account is active, he has been allowed to remove his faker.js library on GitHub (depended upon as it might be), and has since offered an update that he does "not have Donkey Brains".' -- source: https://developers.slashdot.org/story/22/01/15/212234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Host of Youtube-dl Web Site Sued by Major Record Labels
by Peter Reutemann 17 Jan '22

17 Jan '22

'"As part of their growing battle against popular open source software tool youtube-dl, three major music labels are now suing Uberspace, the company that currently hosts the official youtube-dl homepage," reports TorrentFreak: According to plaintiffs Sony, Universal and Warner, youtube-dl circumvents YouTube's "rolling cipher" technology, something a German court found to be illegal in 2017.... While the RIAA's effort to take down youtube-dl from GitHub grabbed all the headlines, moves had already been underway weeks before that in Germany. Law firm Rasch works with several major music industry players and it was on their behalf that cease-and-desist orders were sent to local hosting service Uberspace. The RIAA complained that the company was hosting the official youtube-dl website although the tool itself was hosted elsewhere. "The software itself wasn't hosted on our systems anyway so, to be honest, I felt it to be quite ridiculous to involve us in this issue anyway — a lawyer specializing in IT laws should know better," Jonas Pasche from Uberspace said at the time. In emailed correspondence today Uberspace informed TorrentFreak that, following the cease-and-desist in October 2020, three major music labels are now suing the company in Germany... According to the labels, youtube-dl poses a risk to their business and enables users to download their artists' copyrighted works by circumventing YouTube's technical measures. As a result, Uberspace should not be playing a part in the tool's operations by hosting its website if it does not wish to find itself liable too.... The alleged illegality of youtube-dl is indeed controversial. While YouTube's terms of service generally disallow downloading, in Germany there is the right to make a private copy, with local rights group GEMA collecting fees to compensate for just that. Equally, when users upload content to YouTube under a Creative Commons license, for example, they agree to others in the community making use of that content. "Even if YouTube doesn't provide video download functionality right out of the box, the videos are not provided with copy protection," says former EU MP Julia Reda from the Society for Freedom Rights (GFF) to NetzPolitik. "Not only does YouTube pay license fees for music, we all pay fees for the right to private copying in the form of the device fee, which is levied with every purchase of smartphones or storage media," says Reda. "Despite this double payment, Sony, Universal and Warner Music want to prevent us from exercising our right to private copying by saving YouTube videos locally on the hard drive."' -- source: https://news.slashdot.org/story/22/01/16/025217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's Newest Linux Smartphone 'PinePhone Pro Explorer Edition' Now Available for Pre-Order
by Peter Reutemann 17 Jan '22

17 Jan '22

'"Linux fans rejoice!" writes Hot Hardware. " Pine64's newest smartphone is officially available for pre-order." PinePhone Pro Explorer Edition pre-orders opened up Tuesday. Devices that are pre-ordered before January 18th will be shipped from Pine64's Hong Kong warehouse by January 24th and should arrive by early February.... According to Pine64, the PinePhone Pro Explorer Edition is the "fastest mainline Linux smartphone on the market." It uses a Rockchip RK3399S SoC that is composed of two ARM A72 cores (1.5GHz) and four A53 efficiency cores (1.5GHz).... Consumers will also likely be pleased with the price of the device. The PinePhone Pro Explorer Edition currently rings in at $399 USD. The production run is purportedly "large" and interested consumers should therefore be able to easily purchase the device at this price. Liliputing adds: While the PinePhone Pro has better hardware than the original PinePhone, Pine64 plans to continue selling both phones indefinitely. The first-gen phone will continue to sell for $150 to $200, offering an entry-level option for folks that want to experiment with mobile Linux, while the higher-priced PinePhone Pro should offer a hardware experience closer to what folks would expect from a modern mid-range phone.... In addition to the PinePhone Keyboard, the recently launched PinePhone wireless charging case, fingerprint reader case, and LoRa cases should all work with either phone. But the new phone has a faster processor, more memory and storage, higher-resolution cameras, a higher-speed USB-C port and support for WiFi 5 and Bluetooth 4.1. And those features should make it a little more viable as a replacement for an iPhone or Android device... if you're comfortable running work-in-progress software. They also add that "Thanks to the recent launch of the $50 PinePhone Keyboard, you can also think of the PinePhone Pro as a $400 phone that can be used as a $449 mini-laptop...." And the Pine64 site's January update also points out that "Pico 8 Raspberry Pi port works on the PinePhone," adding "yes, it does run DOOM."' -- source: https://mobile.slashdot.org/story/22/01/16/0051226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64's 'PineNote' E-Ink Tablet Now Available for $399 for Developers
by Peter Reutemann 17 Jan '22

17 Jan '22

'"The PineNote is a tablet with a 10.1 inch grayscale E Ink display and pen support," reports Liliputing. "It's designed to be a hackable, Linux-friendly device and it's one of the latest products from the makers of the PinePhone and PineBook line of devices." First introduced last summer, the PineNote began shipping to developers in limited quantities in December. Now it's available for anyone to purchase for $399 — no invitation required. But it's probably only a good idea to buy one if you're a developer or very early adopter because there's very little software available for the PineNote so far. At this point, Pine64 is shipping the PineNote without an operating system installed. It will have only a bootloader, allowing developers and enthusiasts to load their own software... [D]evelopers have already made some progress in getting builds Alpine and Debian Linux to run on the E Ink slate, and according to Pine64, there are ports for NixOS and other operating systems on the way. There's already a partially working display driver, but it's still a work in progress. The goal is to allow developers to port mainline Linux operating systems and applications to play well with a monochrome display with a slow refresh rate. Developers have also figured out how to enable support PineNote's touchscreen, audio playback, and USB port, making it possible to use USB keyboards, storage devices, and other peripherals.' -- source: https://hardware.slashdot.org/story/22/01/16/012231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adhole, the Massive Public Pi-hole Instance, Shuts Down
by Peter Reutemann 14 Jan '22

14 Jan '22

'segaboy81 writes: I've been running Pihole for years (for myself), but this guy was running one for everybody! Since 2017, those not so savvy who still wanted the experience of Pi-hole, could turn to Adhole.org. That is, until now. Adhole.org is shutting down, citing issues with maintenance and stability' -- source: https://it.slashdot.org/story/22/01/13/1858208 Haven't used Pi-Hole myself, but maybe someone here would be willing to demo it at one of our up-coming meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nikola Static Website Generator now supports Māori language
by Ian Stewart 13 Jan '22

13 Jan '22

Kia ora, The developers of the Nikola static website and blog generator ( https://getnikola.com/ ) recently released version 8.2.0. The website generator is written in python and is an open-source project that is developed on a github repository ( https://github.com/getnikola/nikola ) Nikola V8.2.0 supports 55 languages and now includes support for Māori. Thus a website may be built that is only in Māori. Alternatively a website may default to displaying English and then have the options to select Māori, French or Chinese, etc. For details on how to install Nikola refer to: https://getnikola.com/getting-started.html Kia pārekareka, Ian.

1 0

Raspberry Pi Can Detect Malware By Scanning For Electromagnetic Waves
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: A team of researchers at France's Research Institute of Computer Science and Random Systems created an anti-malware system centered around a Raspberry Pi that scans devices for electromagnetic waves. As reported by Tom's Hardware, the security device uses an oscilloscope (Picoscope 6407) and H-Field probe connected to a Raspberry Pi 2B to pick up abnormalities in specific electromagnetic waves emitted by computers that are under attack, a technique the researchers say is used to "obtain precise knowledge about malware type and identity." The detection system then relies on Convolution Neural Networks (CNN) to determine whether the data gathered indicates the presence of a threat. Using this technique, researchers claims they could record 100,000 measurement traces from IoT devices infected by genuine malware samples, and predicted three generic and one benign malware class with an accuracy as high as 99.82%. Best of all, no software is needed and the device you're scanning doesn't need to be manipulated in any way. As such, bad actors won't be successful with their attempts to conceal malicious code from malware detection software using obfuscation techniques. "Our method does not require any modification on the target device. Thus, it can be deployed independently from the resources available without any overhead. Moreover, our approach has the advantage that it can hardly be detected and evaded by the malware authors," researchers wrote in the paper.' -- source: https://hardware.slashdot.org/story/22/01/12/2214257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Reinvention Of The Chord Keyboard
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

Someone else has invented a new chord keyboard <https://www.nzherald.co.nz/technology/the-end-of-the-qwerty-keyboard-new-ga…>. The idea of being able to type using multiple fingers for each keystroke, instead of just one, is not new. There is also the convenience aspect, for example being able to mount the two halves on the sides of your body, so you can use the keyboard on the go. And adding a predictive system allows it to exceed the speeds of the world’s fastest typists on a conventional keyboard. But the drawback is always the same: it needs special training to use, and most people simply cannot be bothered. Come to think of it, is there any reason you cannot add chord recognition to a conventional typewriter-style keyboard? As in holding down multiple non-modifier keys at once.

2 1

Something Is Jamming Our Remote Car Locks ...
by Lawrence D'Oliveiro 13 Jan '22

13 Jan '22

This is such a weird story <https://www.nzherald.co.nz/nz/hamilton-customers-unable-to-lock-cars-after-…>, and right in our neighbourhood, too: Customers at a Hamilton shopping complex were mysteriously unable to lock their cars on the weekend after a rather bizarre fault in the centre's system. ... On January 11, The Base Shopping Centre confirmed the issue on social media. "We have received reports of an issue that interfered with vehicle remote locking over the weekend. "This has been linked to an incident off-site which was out of our control and is being addressed. No malicious or intentional signal blocking activity was involved." The next day: "An external electrical event had caused a fault to onsite equipment resulting in the interference - this equipment has now been reset and checked by authorities. ..." No mention of what exactly the “system” or “equipment” was, or the “event” was about ... Were any readers of this list there at the time?

2 1

Hotel Chain Switches To Chrome OS To Recover From Ransomware Attack
by Peter Reutemann 13 Jan '22

13 Jan '22

'A Scandinavian hotel chain that fell victim to a ransomware attack last month said it took a novel approach to recover from the incident by switching all affected systems to Chrome OS. The Record reports: Nordic Choice Hotels, which operates 200 hotels across Northern Europe, fell victim to a ransomware attack on December 2, when hackers encrypted some of its internal systems using the Conti ransomware strain. The attack prevented staff from accessing guest reservation data and from issuing key cards to newly arriving guests, as one of the hotel's guests told The Record in an interview last month. But in a press release today, Nordic Choice said that instead of contacting the hackers and negotiating a ransom for the decryption key that would have unlocked the infected devices, the hotel chose to migrate its entire PC fleet from Windows to Chrome OS. "[I]n less than 24 hours, the first hotel was operating in the Chrome OS ecosystem from Google. And in the following two days, 2000 computers were converted all over the company consisting of 212 hotels in five different countries," the hotel chain explained. Kari Anna Fiskvik, VP Technology at Nordic Choice Hotels, said the hotel had already run a pilot program to test the tool before the attack as a way to save money by reusing old computers with a less-demanding OS. "So when we suddenly had to deal with the cyberattack, the decision to go all in and fasttrack the project was made in seconds," Fiskvik said. Nordic Choice said it plans to migrate another 2,000 computers to Chrome OS, on top of the 2,000 it migrated during the attack. The hotel chain said they expect to save $6.7 million by converting old computers to Chrome OS instead of buying new hardware.' -- source: https://yro.slashdot.org/story/22/01/11/227251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Going To Track Facebook Tracking You
by Peter Reutemann 13 Jan '22

13 Jan '22

'Gizmodo reports: Researchers at Mozilla announced this week the launch of its "Facebook Pixel Hunt" study, which seeks to track the company's immense web-wide tracking network and investigate the intel it's collecting on users. As the name suggests, this study is focused on a piece of tracking tech known as the "Facebook pixel." Chances are, you've visited a site that uses it; these tiny pieces of tech are buried in literally millions of sites across the web, from online stores to news outlets to... well, you name it. In exchange for onboarding a free pixel on their site, these sites can then track their own visitors and microtarget ads with the same sort of precision you'd expect from a data-hungry company like Facebook. In exchange for giving these sites the power to track every pageview, purchase, search query, and much, much more, Facebook (naturally) requires that this data be shared with it, too. In cases where the website visitor has an account on some Facebook platform, this offsite data just gets glombed onto whatever Facebook already knows about that person. If they don't have a Facebook account, then the company collects that data anyway, and uses it to create a "shadow profile" of that particular person. These are the sorts of shadowy practices that Mozilla's team wants to research with this study -- and you can help them do it if you're a Firefox user. Mozilla teamed up with reporters from the Markup to gather details about Facebook tracking using a free-to-download browser extension, Mozilla Rally, that will hoover up data sent out by Facebook's pixels as you browse across the web. Aside from that data, the extension also keeps track of the time spent on different web pages, the URLs that the browser visits, and more. Mozilla was quick to note in its announcement that the only data being exported from the extension will be de-identified, and not shared with any third parties besides the Markup's reporters.' -- source: https://news.slashdot.org/story/22/01/11/2257237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Will Limit Access To Private Networks, Citing Security Reasons
by Peter Reutemann 13 Jan '22

13 Jan '22

'Google says that its Chrome browser will soon block internet websites from querying and interacting with devices and servers located inside local private networks, citing security reasons and past abuse from malware operations. From a report: The change will take place through the implementation of a new W3C specification called Private Network Access (PNA) that will be rolled out in the first half of the year. The new PNA specification adds a mechanism inside the Chrome browser through which internet sites can ask systems inside local networks for permission before establishing a connection. If local devices, such as servers or routers fail to respond, internet websites will be blocked from connecting.' -- source: https://it.slashdot.org/story/22/01/12/2012211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 96 Yields Less Load On The Main Thread, WebP Encoder For Canvas
by Peter Reutemann 12 Jan '22

12 Jan '22

'Firefox 96.0 is officially shipping today as the first update of 2022 for this open-source web browser. From a report: Firefox 96.0 has "significantly" reduced the amount of load placed on the browser's main thread and there is also "significant" improvements in noise suppression and auto-gain-control and improvements in echo cancellation. In addition to that performance work, there are also WebRTC improvements, an improved cookie policy to reduce the likelihood of Cross-Site Request Forgery (CSRF) attacks, video quality degradation fixes, and other fixes. Over on developer.mozilla.org are some of the web developer changes with Firefox 96 including CSS color value function hwb() support for specifying the hue/whiteness/blackness, support for the CSS color-scheme property, the Web Locks API is enabled by default, image encoder support for WebP for exporting HTML5 canvas elements, and other additions.' -- source: https://news.slashdot.org/story/22/01/11/1639243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chip Shortage Has Canon Telling Customers How To Defeat Its DRM
by Peter Reutemann 11 Jan '22

11 Jan '22

'Ars Technica: For years, printers have been encumbered with digital rights management systems that prevent users from buying third-party ink and toner cartridges. Printer companies have claimed that their chip-enabled cartridges can "enhance the quality and performance" of their equipment, provide the "best consumer experience," and "protect [the printers] from counterfeit and third-party ink cartridges." Left unsaid is the fact that requiring first-party cartridges also ensures a recurring revenue stream. It's an old business model -- Gillette sold its razor handles cheaply to sell more razors, for example -- and it's one that printer companies have enthusiastically embraced. Lexmark, HP, Canon, Brother, and others all effectively require users to purchase first-party ink and toner. To enforce the use of first-party cartridges, manufacturers typically embed chips inside the consumables for the printers to "authenticate." But when chips are in short supply, like today, manufacturers can find themselves in a bind. So Canon is now telling German customers how to defeat its printers' warnings about third-party cartridges. "Due to the worldwide continuing shortage of semiconductor components, Canon is currently facing challenges in procuring certain electronic components that are used in our consumables for our multifunction printers (MFP)," a Canon support website says in German. "In order to ensure a continuous and reliable supply of consumables, we have decided to supply consumables without a semiconductor component until the normal supply takes place again." [...] The software on these printers comes with a relatively simple way to defeat the chip checks. Depending on the model, when an error message occurs after inserting toner, users can press either "I Agree," "Close," or "OK." When users press that button, the world does not end. Rather, Canon says users may find that their toner cartridge doesn't give them a low-toner warning before running empty. "Although there are no negative effects on print quality when consumables are used without electronic components, certain additional functions, such as the detection of the toner level, may be impaired," Canon's support site says.' -- source: https://hardware.slashdot.org/story/22/01/10/1959243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Antivirus Software More Trouble Than It’s Worth?
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

<https://www.theregister.com/2022/01/10/opinion_column_consumer_av/>: Game knows game. Thus it came as little surprise that Norton's consumer security software not only sprouted a cryptominer that slurps your computer's life essence and skims a cut, but that it's hard to turn it off. ... Now? Even the meanest computer has hardware and software architectures that can be, and often are, configured for very high resilience against classic virus attacks. The observant may have noted that data security has not been solved – but the attacks aren't the sort of thing that resident consumer AV software can do much about. Endpoint protection managed in the cloud, whether explicit anti-malware services or OS-led protection as seamless as Chrome OS or through aggressive online patching, is as good as it's going to get. Keep up to date, and third-party security software you have to manage has no right to your system at all. Obvious question: how long before proprietary “OS-managed” or “cloud-managed” antimalware starts resorting to the same sharp practices as the consumer-grade stuff? Just consider how often Microsoft has tricked or strong-armed users into installing things they may not want, and made it hard to remove them ...

2 1

Source Of The Famous “Now You Have Two Problems” Quote
by Lawrence D'Oliveiro 11 Jan '22

11 Jan '22

Lots of us have come across this: Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems. -- usually attributed to Jamie Zawinski The form of this joke is also versatile enough to adapt to dumping on other things that the speaker might not like, e.g. “Some people, when confronted with a memory-management programming problem, think ‘I know, I’ll use a garbage-collected language.’ Now they have two problems.” Some time back, a guy named Jeffrey Friedl published a book called “Mastering Regular Expressions”, and the Slashdot discussion† got flooded with posts quoting this at him. So he took the trouble to track down the precise provenance of the quote, and how it had spread. His report is here <http://regex.info/blog/2006-09-15/247>. While his original blog post was put up in 2006, the last update is from the end of 2020. Some reader comments are interesting, too. By the way, something I didn’t know before, is that Jamie Zawinski really, really hates Perl. Or at least he used to. †I told you it was some time back.

1 0

Linux Mint Sells Out for Mozilla Money
by Peter Reutemann 11 Jan '22

11 Jan '22

'Brian Fagioli, reporting for BetaNews: The developers of the Ubuntu-based operating system have agreed to accept an undisclosed amount of money from Mozilla in exchange for making significant changes to Linux Mint. This includes removal of modifications to Firefox and a big change for search. The devs share the upcoming changes to Firefox in Linux Mint 19 and higher. The default start page no longer points to https://www.linuxmint.com/start/ The default search engines no longer include Linux Mint search partners (Yahoo, DuckDuckGo...) but Mozilla search partners (Google, Amazon, Bing, DuckDuckGo, Ebay...) The default configuration switches from Mint defaults to Mozilla defaults. Firefox no longer includes code changes or patches from Linux Mint, Debian or Ubuntu.' -- source: https://linux.slashdot.org/story/22/01/10/1930243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Invents The “Year 2022” Bug
by Lawrence D'Oliveiro 04 Jan '22

04 Jan '22

Microsoft released a new version of Exchange Server at the start of the new year, which promptly caused everybody’s on-premises servers to crash. The reason? The version number. There is apparently code somewhere in the bowels of the software that interprets that number as a signed 32-bit integer, computed as the (year - 2000) × 100 million + additional digits for the month and day etc. Spot the problem with that? The largest representable such integer is 2147483647, so the top two digits can’t be greater than 21. So it can’t actually represent the correct version number for any version released after 2021. Why does the code do that? Who knows... Microsoft’s fix? Change the version number to restrict the top two digits to 21, and increment the lower digits instead, beyond their usual range (e.g. so the release date becomes effectively something like “33 December 2021”). They released a PowerShell script to automate the fix, but it might not work properly, so there is an option for a manual fix as well. <https://arstechnica.com/information-technology/2022/01/exchange-server-bug-…>

1 1

Developer creates ‘Quite OK Image Format’ – but it performs better than just OK
by Peter Reutemann 27 Dec '21

27 Dec '21

'A developer named Dominic Szablewski has given the world a new file format with a splendid name: the Quite OK Image Format (QOI). The file format might be better than that. Szablewski explained that he decided the world needed a new image format because the likes of PNG, JPEG, MPEG, MOV and MP4 “burst with complexity at the seams.” “Every tiny aspect screams ‘design by consortium’,” he added, going on to lament the fact that most common codecs are old, closed, and “require huge libraries, are compute hungry and difficult to work with.” Szablewski thought he could do better and appears to have achieved that objective by cooking up some code, floating it on GitHub, and paying attention to the 500-plus comments it generated. While Szablewski admits that QOI will not compress images as well as an optimized PNG encoder, he claims it “losslessy compresses images to a similar size of PNG, while offering 20x-50x faster encoding and 3x-4x faster decoding.”' -- source: https://www.theregister.com/2021/12/21/quite_ok_image_format/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

1 0

Second Ransomware Family Exploiting Log4j Spotted In US, Europe
by Peter Reutemann 23 Dec '21

23 Dec '21

'Researchers say a second family of ransomware has been growing in usage for attack attempts that exploit the critical vulnerability in Apache Log4j, including in the U.S. and Europe. VentureBeat reports: A number of researchers, including at cybersecurity giant Sophos, have now said they've observed the attempted deployment of a ransomware family known as TellYouThePass. Researchers have described TellYouThePass as an older and largely inactive ransomware family -- which has been revived following the discovery of the vulnerability in the widely used Log4j logging software. TellYouThePass is the second family of ransomware that's been observed to exploit the vulnerability in Log4j, known as Log4Shell, joining the Khonsari ransomware, according to researchers. While previous reports indicated that TellYouThePass was mainly being directed against targets in China, researchers at Sophos told VentureBeat that they've observed the attempted delivery of TellYouThePass ransomware both inside and outside of China -- including in the U.S. and Europe. "Systems in China were targeted, as well as some hosted in Amazon and Google cloud services in the U.S. and at several sites in Europe," said Sean Gallagher, a senior threat researcher at Sophos Labs, in an email to VentureBeat on Tuesday. Sophos detected attempts to deliver TellYouThePass payloads by utilizing the Log4j vulnerability on December 17 and December 18, Gallagher said. TellYouThePass has versions that run on either Linux or Windows, "and has a history of exploiting high-profile vulnerabilities like EternalBlue," said Andrew Brandt, a threat researcher at Sophos, in an email. The Linux version is capable of stealing Secure Socket Shell (SSH) keys and can perform lateral movement, Brandt said. Sophos initially disclosed its detection of TellYouThePass ransomware in a December 20 blog post. The first report of TellYouThePass ransomware exploiting the Log4j vulnerability appears to have come from the head of Chinese cybersecurity group KnownSec 404 Team on December 12. The attempted deployment of TellYouThePass in conjunction with Log4Shell was subsequently confirmed by additional researchers, according to researcher community Curated Intelligence. In a blog post Tuesday, Curated Intelligence said its members can now confirm that TellYouThePass has been seen exploiting the vulnerability "in the wild to target both Windows and Linux systems." TellYouThePass had most recently been observed in July 2020, Curated Intelligence said. It joins Khonsari, a new family of ransomware identified in connection with exploits of the Log4j vulnerability. ' -- source: https://it.slashdot.org/story/21/12/22/2255231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch fixing critical Log4J 0-day has its own vulnerability that’s under exploit
by Peter Reutemann 20 Dec '21

20 Dec '21

'Last Thursday, the world learned of an in-the-wild exploitation of a critical code-execution zero-day in Log4J, a logging utility used by just about every cloud service and enterprise network on the planet. Open source developers quickly released an update that patched the flaw and urged all users to install it immediately. Now, researchers are reporting that there are at least two vulnerabilities in the patch, released as Log4J 2.15.0, and that attackers are actively exploiting one or both of them against real-world targets who have already applied the update. The researchers are urging organizations to install a new patch, released as version 2.16.0, as soon as possible to fix the vulnerability, which is tracked as CVE-2021-45046. ' -- source: https://arstechnica.com/information-technology/2021/12/patch-fixing-critica… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

This USB 'Kill Cord' Can Instantly Wipe Your Laptop if Snatched or Stolen
by Peter Reutemann 18 Dec '21

18 Dec '21

'Journalists, activists, and human rights defenders face a constant battle to keep files safe from a growing set of digital threats and surveillance. But physical attacks can be challenging to defend against, whether an opportunist snatch-and-grab thief or an oppressive government kicking down someone's door. This week, a project called BusKill launched a custom USB magnetic breakaway cable that acts as a "dead man's switch," locking a computer if someone physically snatches it and severs the magnetic connectors. BusKill has been in the works for more than two years as a do-it-yourself project. Anyone with the hardware could compile the source code, but it only worked on Linux and components quickly sold out. After a crowdsourcing effort, the cable is now available to buy starting at $59 and has an accompanying app that works on macOS, Windows, and Linux, allowing the person using the cable to easily arm and disarm the cable with a touch of a button.' -- source: https://tech.slashdot.org/story/21/12/17/1530254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pop!_OS 21.10 Review
by Lawrence D'Oliveiro 17 Dec '21

17 Dec '21

This review <https://www.theregister.com/2021/12/16/pop_os_2110_new_system76/> of the new version of the Ubuntu variant from System76 mentions a lot of trouble getting it to play nicely with other installed OSes on the same machine. One key difference is that it doesn’t boot with GRUB. Instead, it is EFI-only, and requires your kernel and initial RAM disk to live inside the “EFI System Partition” (ESP), where they can be found by systemd-boot. This typically requires the ESP to be enlarged beyond its initial size. And, depending on the tools you use, that can be problematic. This EFI-only boot procedure can also complicate coexistence with other OS installations on a multiboot system. But, interestingly, not Microsoft Windows, at least according to one of the reader comments. Indeed, a well-known issue where installing Windows on an MBR-based system destroys your ability to boot other OSes goes away with EFI-only booting. Seems Windows is well-enough behaved to only replace its own EFI state, leaving that for other OSes alone.

1 0

AGM next month
by Peter Reutemann 17 Dec '21

17 Dec '21

Hi everyone We have our Annual General Meeting (AGM) coming up on January 24th with the following (preliminary) agenda: - President's Report - Treasurer's Report - Election of 2022 Committee - General business - Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/282720630/ BTW Meeting venue (or whether to be held online due to COVID) will be confirmed closer to the date. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Is Building a New AR Device and OS
by Peter Reutemann 15 Dec '21

15 Dec '21

'According to job listings on LinkedIn, Google appears to be working on an augmented reality device and operating system to pair with it. Ars Technica reports: On LinkedIn, operating system engineering director Mark Lucovsky announced that he has joined Google. He previously headed up mixed reality operating system work for Meta, and before that he was one of the key architects of Windows NT at Microsoft. "My role is to lead the Operating System team for Augmented Reality at Google," he wrote. He also posted a link to some job listings at Google that give the impression Google is getting just as serious about AR as Apple or Meta. As 9to5Google discovered, one of the listings ("Senior Software Developer, Embedded, Augmented Reality OS") described Google's objective in clear terms: "Our team is building the software components that control and manage the hardware on our Augmented Reality (AR) products. These are the software components that run on the AR devices and are the closest to the hardware. As Google adds products to the AR portfolio, the OS Foundations team is the very first software team to work with new hardware." Other job listings say new hires will be working on an "innovative AR device." And one specifies that Google is "focused on making immersive computing accessible to billions of people through mobile devices." The roles are largely in the United States, but some are located in Waterloo, Ontario -- the HQ of Canadian smart glasses maker North, which Google acquired in 2020.' -- source: https://tech.slashdot.org/story/21/12/14/2233208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 12 Go Edition Brings New Speed, Battery, Privacy Features To Lower-end Phones
by Peter Reutemann 15 Dec '21

15 Dec '21

'Google's Pixel 6 line may have served as Android 12's big debut for higher-end phones, but Android 12 (Go edition) plans to bring many of the enhancements and features of Android 12 to lower-end phones, too. Google on Tuesday unveiled a host of new features for the Go edition that are set to roll out to devices in 2022. From a report: Google says that in addition to speed enhancements that'll help apps launch up to 30% faster, Android 12 (Go edition) will include a feature that'll save battery life and storage by automatically "hibernating apps that haven't been used for extended periods of time." And with the Files Go app, you'll be able to recover files within 30 days of deletion. Android 12 (Go edition) will also help you easily translate any content, listen to the news and share apps with nearby devices offline to save data, Google says. The company said Android Go has amassed 200 million users.' -- source: https://mobile.slashdot.org/story/21/12/14/1848213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Log4Shell Vuln Rated 10 Out Of 10
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

The Log4Shell vulnerability has been given the highest possible CVE severity rating <https://arstechnica.com/information-technology/2021/12/the-log4shell-zeroda…>. It’s a really, really stupid bug in a logging framework called Log4J, which is used by an incredible variety of Java-based applications, including Minecraft. Log messages are generated according to customizable format templates that the admin can specify. These templates allow the creation of a range of different messages, including all kinds of useful information which can aid in debugging, performance monitoring, usage statistics gathering etc. But one thing you should never, ever do is, having substituted some text from some random source (e.g. user input), go back and scan that text for format substitution codes. But that is what the buggy code does.

1 1

VPOTUS Getting Flak For Her Bluetooth Aversion
by Lawrence D'Oliveiro 14 Dec '21

14 Dec '21

Seems US Vice President Kamala Harris is copping a fair amount of ridicule after saying she prefers wired headphones to wireless Bluetooth ones, for security reasons <https://www.theregister.com/2021/12/13/in_brief_security/>. She’s just listening to her security advisors, folks. And their advice makes sense.

1 0

n-dimensional image tool powers up Python
by Matthew Skiffington 08 Dec '21

08 Dec '21

>From the nature science briefing: A free, open-source and extensible image viewer for arbitrarily complex (‘ <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> *n* <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…>-dimensional’) data <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> fills a gap in the Python scientific ecosystem. napari — whose name refers to a Pacific island village midway between the developers’ bases in San Francisco and Melbourne — features a simple graphical interface with a built-in Python console. Early adopters are using it to streamline everything from visualizing atmospheric jet streams to identifying cells in tissue. Nature | 4 min read <https://nature.us17.list-manage.com/track/click?u=2c6057c528fdc6f73fa196d9d…> Cheers,Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>**, University of Waikato* *Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

1 0

A Mysterious Threat Actor is Running Hundreds of Malicious Tor Relays
by Peter Reutemann 07 Dec '21

07 Dec '21

'Since at least 2017, a mysterious threat actor has run thousands of malicious servers in entry, middle, and exit positions of the Tor network in what a security researcher has described as an attempt to deanonymize Tor users. The Record: Tracked as KAX17, the threat actor ran at its peak more than 900 malicious servers part of the Tor network, which typically tends to hover around a daily total of up to 9,000-10,000. Some of these servers work as entry points (guards), others as middle relays, and others as exit points from the Tor network. Their role is to encrypt and anonymize user traffic as it enters and leaves the Tor network, creating a giant mesh of proxy servers that bounce connections between each other and provide the much-needed privacy that Tor users come for. Servers added to the Tor network typically must have contact information included in their setup, such as an email address, so Tor network administrators and law enforcement can contact server operators in the case of a misconfiguration or file an abuse report. However, despite this rule, servers with no contact information are often added to the Tor network, which is not strictly policed, mainly to ensure there's always a sufficiently large number of nodes to bounce and hide user traffic.' -- source: https://it.slashdot.org/story/21/12/06/1941209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF's Anti-DRM Campaign Plans Bad-Review Protest Against Disney+
by Peter Reutemann 07 Dec '21

07 Dec '21

'For their fifteenth International Day Against DRM this Friday, the Free Software Foundation's "Defective by Design" campaign is "calling on you to help us send a message to purveyors of Digital Restrictions Management (DRM)". And this year they're targeting Disney+ The ongoing pandemic has only tightened the stranglehold streaming services have as some of the most dominant forms of entertainment media, and Disney+ is among the worst of them. After years of aggressive lobbying to extend the length of copyright, based on their perceived need to keep a certain rat from entering the public domain, they've now set their sights on "protecting" their various franchises in a different way: by shackling them with digital restrictions. If Disney's stated mission is to keep "inspiring hope and sparking the curiosity of all ages", using DRM to limit that curiosity remains the wrong move. This year, we'll be using one of Disney's own means of spreading their "service" and the DRM bundled with it: their mobile app. If you're an existing user of the Google Play (Android) or Apple App Stores, you can support the International Day Against DRM by voicing your objection to Disney's subjugation of their users. Streaming services like Netflix and Peacock have the same issues, but by targeting a newer one with such massive investment and capital behind it, we can make sure that we're heard. Disney+ is new: that gives it time to change. Disney+ is placed near the top of the most frequently downloaded apps on both the Google Play and Apple App Stores. We invite you to write a well-thought objection to Disney's use of DRM, with a fitting review. It is the perfect way to let the corporation, and other users intending to use its services know Disney's grievous mistake in using DRM to restrict customers who already want to view their many films and television shows. It will give you a chance to give them the exact rating that any service that treats its users so poorly: a single star. DRM isn't the only problem with the Disney+ app. It's also nonfree software. If you're not already an Android or iOS user, we don't recommend starting an account just to participate in this action. You can also choose to send an email to Disney executives following our template. They're urging supporters to also share the actions they've taken on social media using the tag #DayAgainstDRM. (And there's also an IRC channel "to discuss and share strategies for anti-DRM activism," with more anti-DRM actions still to come. "While some aspects of the struggle have changed, the core principles remain the same: users should not be forced to surrender their digital autonomy in exchange for media."' -- source: https://slashdot.org/story/21/12/04/187207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 95 Will Include RLBox Sandboxing for Added Security
by Peter Reutemann 07 Dec '21

07 Dec '21

'Mozilla has announced through its Mozilla Hacks blog that it plans to ship a 'novel sandboxing technology' called RLBox with Firefox 95 which it has been developing alongside researchers from the University of California San Diego and the University of Texas. From a report: It said RLBox makes it easier to isolate subcomponents of the browser efficiently and gives Mozilla more options than traditional sandboxing granted it. Mozilla said this new method of sandboxing, which uses WebAssembly to isolate potentially-buggy code, builds on a prototype that was shipped in Firefox 74 and Firefox 75 to Linux and Mac users respectively. With Firefox 95, RLBox will be deployed on all supported Firefox platforms including desktop and mobile to isolate three different modules: Graphite, Hunspell, and Ogg. With Firefox 96, two more modules, Expat and Woff2, will also be isolated.' -- source: https://news.slashdot.org/story/21/12/06/1558251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blender 3.0 Is Out
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

A new major release of Blender, the 3D modelling/animation/sculpting/rendering software, finally hit stable earlier today. The version numbering is now taking bigger jumps. This is a far cry from the old days, when, for example, major new features would come out with only small version number changes (e.g. the Cycles ray-traced renderer appearing in 2.61, geometry nodes in 2.92 etc). My only worry is that the file format only has a single digit for the major version number. What happens after 9.99? Get it from <https://www.blender.org/>. Release notes are at <https://wiki.blender.org/wiki/Reference/Release_Notes/3.0>.

1 0

Regulators Flocking To Block Nvidia’s ARM Acquisition
by Lawrence D'Oliveiro 04 Dec '21

04 Dec '21

The US FTC has joined in <https://arstechnica.com/tech-policy/2021/12/ftc-sues-nvidia-to-preserve-arm…> the growing list of Government regulators from various countries looking askance at Nvidia’s plans to buy ARM. I like their description of ARM as being the “Switzerland” of semiconductors. Also found this interesting fact mentioned: Last year, companies sold 25 billion ARM chips, an increase of more than four-fold since 2010. That’s nearly four chips for every person on the planet. Per year.

2 1

JupyterHub 2.0 Is Out
by Lawrence D'Oliveiro 03 Dec '21

03 Dec '21

Just saw this report <https://devclass.com/2021/12/02/jupyterhub-2/> on the new release of JupyterHub. This is the version of Jupyter designed to support multiuser deployments with proper access control. The new version supports role-based access control with delegation of admin responsibilities, so you can have group admins with control over their particular users but no privileges outside of that. For those new to Jupyter: <https://jupyter.org>.

1 0

70 Years Ago, LEO
by Lawrence D'Oliveiro 01 Dec '21

01 Dec '21

Seventy years ago, in 1951, the world’s first computer built for business use was put into production <https://www.theregister.com/2021/11/30/leo_70/>. It was called “LEO”, short for “Lyons Electronic Office”. The J Lyons company ran a string of teashops across the UK, and an ongoing problem that the shop managers (and central office) faced was how to accurately predict the supplies needed for the next day’s business, given that much of it (cakes etc) was highly perishable, and so had to be manufactured on a few hours’ notice. This “bakery valuation” was a statistical problem, based on crunching a lot of raw data, looking at past demand, seasonal variations etc, and it was still a novel concept that a computer turned out to be better than humans at doing the necessary calculations. The computer turned out to be so useful that the UK Ministry of Supply hired it to get some ballistic calculations done. Later it also did other jobs at the company, like payroll. Actually, a lot of this (except the payroll) sounds to me very much like number-crunching, which would surely have been considered more of a “scientific” than a “business” computing application. Remember, there was this dichotomy between “scientific” and “business” computing use back then, that continued right into about the 1970s. This division existed in hardware (e.g. decimal arithmetic for “business” use, binary for “scientific”) and software (COBOL being the preferred programming language for “business” use, things like FORTRAN and ALGOL for “scientific”). The teashop company spun off the computer business as a separate operation in 1954, which went on to bring out the LEO II and LEO III machines before being acquired by English Electric, which in turn later merged with ICT to create ICL. According to the article linked above, the last LEO machine was decommissioned in 1981, and the last Lyons teashop closed that same year. I first learned about LEO and the Lyons teashops some decades ago, from a book called “Early British Computers”, by Simon Lavington, published in 1980.

1 0

Raspberry Pi Trading Could Go Public This Spring
by Peter Reutemann 30 Nov '21

30 Nov '21

'"According to a report in The Telegraph, Raspberry Pi Trading, the arm responsible for the creation of the Raspberry Pi 4, Raspberry Pi Pico and the new Raspberry Pi Zero 2 W could soon be listed with a value of more than £370m ($493m)," reports Tom's Hardware: Raspberry Pi Trading has hired advisors from two investment banks, Stifel and Liberum to advise on floating the company in spring 2022. The news comes just a few months after Raspberry Pi received a £45m ($60m) investment from Lansdowne Partners and the Ezrah Charitable Trust which was used to fund the development of new products as demand increased during the global pandemic. A source close to The Telegraph has valued Raspberry Pi at a premium of $500m... "Obviously, the $45m we raised in September takes away some of the urgency around figuring out how we fund the future. On the other hand, we have great plans for what we are going to do over the next five years." Eben Upton, talking to The Telegraph.' -- source: https://hardware.slashdot.org/story/21/11/28/2328201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Play apps downloaded 300,000 times stole bank credentials
by Peter Reutemann 30 Nov '21

30 Nov '21

'Researchers said they’ve discovered a batch of apps downloaded from Google Play more than 300,000 times before the apps were revealed to be banking trojans that surreptitiously siphoned user passwords and two-factor authentication codes, logged keystrokes, and took screenshots. The apps—posing as QR scanners, PDF scanners, and cryptocurrency wallets—belonged to four separate Android malware families that were distributed over four months. They used several tricks to sidestep restrictions that Google has devised in an attempt to rein in the unending distribution of fraudulent apps in its official marketplace. Those limitations include restricting the use of accessibility services for sight-impaired users to prevent the automatic installation of apps without user consent.' -- source: https://arstechnica.com/information-technology/2021/11/google-play-apps-dow… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nvidia's DLSS Has Come To Linux Gaming
by Peter Reutemann 29 Nov '21

29 Nov '21

'Years after its failed Steam Machines, Valve is slowly but surely improving the state of Linux gaming. From a report: The company's upcoming Steam Deck handheld runs atop Linux, and its Proton compatibility layer lets it -- and other computers -- play Windows games as well. Now, Valve has officially added support for Nvidia's DLSS machine learning temporal upscaling technique to Proton, potentially bringing big FPS boosts and less flicker in games that support the technology. Proton 6.3-8 is the first stable release to include support for DLSS, after the feature previously hit experimental builds in October, though it appears you'll still need to set PROTON_ENABLE_NVAPI=1 and dxgi.nvapiHack = False to turn it on. DLSS won't come to the AMD-powered Steam Deck, of course, since it requires proprietary Nvidia machine learning silicon, but we recently learned the Steam Deck will support AMDâ(TM)s arguably much less capable FSR.' -- source: https://linux.slashdot.org/story/21/11/27/0325250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AWS Embraces Fedora Linux for Its Cloud-Based 'Amazon Linux'
by Peter Reutemann 29 Nov '21

29 Nov '21

'ZDNet reports: By and large, the public cloud runs on Linux. Most users, even Microsoft Azure customers, run Linux on the cloud. In the case of market giant Amazon Web Services (AWS), the cloud provider will let you run many Linux distros or their own homebrew Linux, Amazon Linux. Now, AWS has released an early version of its next distro, Amazon Linux 3, which is based on Red Hat's community Linux, Fedora. AWS has long tried to incorporate Red Hat Enterprise Linux (RHEL) compatibility into Amazon Linux, but this latest release takes that to new heights. By using Fedora as its upstream, the new Amazon distro, also called AL2022, is a stable distribution. It's gone through extensive testing to offer package stability, and it also includes all available security updates.... TechRadar adds some more details: The distro has had two major releases till now; the first in 2010, and the second in 2017. However, with the third AL2022 release the service is committing to a two year release cycle, with each release supported for a period of five years... AWS argues that the two year major release cycle, with updates shipped quarterly via minor releases, will help keep the software current, while the five year support commitment for each major release will give customers the stability they need to manage long project lifecycles. ' -- source: https://linux.slashdot.org/story/21/11/27/0328223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Addressing 'Bus Factor', PHP Gets a Foundation
by Peter Reutemann 29 Nov '21

29 Nov '21

'How many members of your team are so irreplaceable that if they were hit by a bus, your project would grind to a halt? For PHP, that number is: two. (According to a post by PHP contributor Joe Watkins earlier this year that's now being cited in Mike Melanson's "This Week in Programming" column.) "Maybe as few as two people would have to wake up this morning and decide they want to do something different with their lives in order for the PHP project to lack the expertise and resources to move it forward in its current form, and at current pace," Watkins wrote at the time, naming Dmitry Stogov and Nikita Popov as those two. Well, last week, Nikita Popov was thankfully not hit by a bus, but he did decide to move on from his role with PHP to instead focus his activities on LLVM. Also thankfully, Watkins' article earlier this year opened some eyes to the situation at hand and, as he writes in a follow-up article this week, JetBrains (Popov's employer) reached out to him at the time regarding starting a PHP Foundation. This week, with Popov's departure, the PHP Foundation was officially launched with the goal of funding part/full-time developers to work on the PHP core in 2022. At launch, the PHP Foundation will count 10 companies — Automattic, Laravel, Acquia, Zend, Private Packagist, Symfony, Craft CMS, Tideways, PrestaShop, and JetBrains — among its backers, with an expectation to raise $300,000 per year, and with JetBrains contributing $100,000 annually. Alongside that, the foundation is being launched using foundation-as-a-service provider Open Collective, and just under 700 contributors have already raised more than $40,000 for the foundation. One of the key benefits to creating a foundation, rather than sticking with the status quo, goes beyond increasing the bus factor — it diversifies the influences on PHP. Watkins points out that, for much of the history of PHP, Zend, the employer of Dmitry Stogov, has been a primary financial backer, and as such has had some amount of influence on the language's direction. Similarly, JetBrains had increased influence during its time employing Popov on PHP."To say they have not influenced the direction of the language as a whole would just not be true...." While Watkins says that everything has been above board and gone through standard processes to ensure so, influence is nonetheless indisputable, and that "The Foundation represents a new way to push the language forward..." The current RFC process, JetBrains writes, "will not change, and language decisions will always be left to the PHP Internals community." And in addition, Watkins adds, "It provides us the mechanism by which to raise the bus factor, so that we never face the problems we face today, and have faced in the past."' -- source: https://developers.slashdot.org/story/21/11/27/0225217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Computation-Intensive Research And The Quest For Scientific Reproducibility
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

The fruits of scientific research are supposed to be open to all. A key part of this is the need for reproducibility -- the idea that somebody else can repeat the same experiments and analysis and (hopefully) come to the same conclusions. It has long been a common expectation that researchers will make their raw data available to others for this purpose, but nowadays even that is likely no longer enough. The analysis of the data usually requires some particular piece of computer software, even if this was just some in-house scripting done on top of a commonly-available toolkit or package. Two different reports on this subject have come out recently, this one <https://www.theregister.com/2021/11/25/research_software_inquiry/> from the UK and this <https://arstechnica.com/science/2021/11/keeping-science-reproducible-in-a-w…> with examples from the US and elsewhere. The latter goes into a lot more detail, including good news (the rise of publicly-available data sets which get heavily used for many different analyses), and bad: From 2017 through 2019, Tsuyoshi Miyakawa, the editor-in-chief of the journal Molecular Brain, replied to 41 article submissions by requesting that the authors provide their complete source data for review, as per the stated policy of the journal. Only one author did so. ... Based on his efforts to replicate papers from other statisticians, Thomas Lumley, a professor of biostatistics at the University of Auckland in New Zealand, says of the phrase data available upon request: "When people put it in their papers, what they typically mean is 'data not available.'" As for making code available, that has its own challenges: often the scripts/programs are hastily thrown together, and the creators may be embarrassed to have others see it in this state. Or it’s not likely to work properly anyway, outside of the original systems where it was developed. The good news is, bodies that fund the research and the journals that publish the results are becoming more aware of such issues, and increasingly trying to ensure that procedures for dealing with them are built into the projects from the beginning.

3 2

Bye-Bye MIPS
by Lawrence D'Oliveiro 26 Nov '21

26 Nov '21

You know a CPU architecture is really dead when the Linux kernel drops support for it. I just learned that MIPS64 has joined this club as of the 5.15 kernel, according to <https://www.theregister.com/2021/11/25/alpine_3_15/> (presumably “MIPS32” vanished some time before?). Even the company formerly known as “MIPS” is now rebranding (at least its parent) as “Wave”, and is going to base its future products on the RISC-V architecture instead.

1 0

Mozilla Is Ending Support For Its Firefox Password Manager Sync App
by Peter Reutemann 24 Nov '21

24 Nov '21

'Mozilla announced last week via a support article that its Firefox Lockwise password manager app will reach end-of-life on December 13th. The final release versions are 1.8.1 (iOS) and 4.0.3 (Android) and will no longer be available to download or reinstall after that date. The Verge reports: What started in 2018 as a small experimental mobile app called Lockbox ended up bringing a way to access saved passwords and perform autofills on iOS, Android, and desktop devices to a small but enthusiastic following of Firefox fans. The app was also later adapted as a Firefox extension. It seemed like it was apt to stick around for the long run. The support article recommends that users continue accessing passwords using the native Firefox browsers on desktop and mobile. In an added note on the support site, Mozilla suggests that later in December, the Firefox iOS app will gain the ability to manage Firefox passwords systemwide. The note alludes to Mozilla adopting the features of Lockwise and eventually integrating them into the Firefox browser apps natively on all platforms. ' -- source: https://tech.slashdot.org/story/21/11/23/2157244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Trying To Reclaim The Word “Crypto”
by Lawrence D'Oliveiro 24 Nov '21

24 Nov '21

For decades, the word “crypto” has been synonymous with “cryptography”. But increasingly now, some are using it to mean “cryptocurrency” instead. Naturally this is annoying some who have been working in the crypto field for years, and they are demanding that this new (mis)usage be stopped. What do you think? <https://www.theregister.com/2021/11/23/crypto_graphy_or_currency/>

2 2

Attackers Don't Bother Brute-forcing Long Passwords, Microsoft Engineer Says
by Peter Reutemann 23 Nov '21

23 Nov '21

'According to data collected by Microsoft's network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters. From a report: "I analysed the credentials entered from over -- million brute force attacks against SSH. This is around 30 days of data in Microsoft's sensor network," said Ross Bevington, a security researcher at Microsoft. "77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases," said Bevington, who works as Head of Deception at Microsoft, a position in which he's tasked with creating legitimate-looking honeypot systems in order to study attacker trends.' -- source: https://it.slashdot.org/story/21/11/22/2036243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

GoDaddy Security Breach Exposes WordPress Users' Data
by Peter Reutemann 23 Nov '21

23 Nov '21

'Web hosting company GoDaddy said on Monday email addresses of up to 1.2 million active and inactive Managed WordPress customers had been exposed in an unauthorized third-party access. From a report: The company said the incident was discovered on Sept. 6 and the third-party accessed the system using a compromised password.' -- source: https://it.slashdot.org/story/21/11/22/1523234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A German State is Switching Its 25,000 Computers From Windows to Linux
by Peter Reutemann 22 Nov '21

22 Nov '21

'The north-German state of Schleswig-Holstein plans to switch to open source software..." reports Mike Saunders from LibreOffice. "By the end of 2026, Microsoft Office is to be replaced by LibreOffice on all 25,000 computers used by civil servants and employees (including teachers), and the Windows operating system is to be replaced by GNU/Linux." The tech site Foss Force writes: This seems to be a done deal, as the steps for the transition from proprietary to open have already been codified by the Schleswig-Holstein state parliament, and explained in plain language in an interview with Jan Philipp Albrecht, the state's digital minister, that was published in c't, a German language computer magazine (Google Translate version here). In the interview, Albrecht said that part of the transition to open source is already in the works, and pointed out that 90% of state administration conferencing is conducted using the open source video conferencing platform Jitsi. "We have been testing LibreOffice in our IT department for two years, and our experience is clear: it works," he said. "This also applies, for example, when editing Microsoft Word documents with comments... No Linux distribution has been chosen yet to use as a standard, although Albrecht said they're currently looking at five distributions that suit their purposes.' -- source: https://linux.slashdot.org/story/21/11/21/0231218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Firefox Users Accidentally Commit Login Cookies On GitHub
by Peter Reutemann 19 Nov '21

19 Nov '21

'Thousands of Firefox cookie databases containing sensitive data are available on request from GitHub repositories, data potentially usable for hijacking authenticated sessions. The Register reports: These cookies.sqlite databases normally reside in the Firefox profiles folder. They're used to store cookies between browsing sessions. And they're findable by searching GitHub with specific query parameters, what's known as a search "dork." Aidan Marlin, a security engineer at London-based rail travel service Trainline, alerted The Register to the public availability of these files after reporting his findings through HackerOne and being told by a GitHub representative that "credentials exposed by our users are not in scope for our Bug Bounty program." Marlin then asked whether he could make his findings public and was told he's free to do so. "I'm frustrated that GitHub isn't taking its users' security and privacy seriously," Marlin told The Register in an email. "The least it could do is prevent results coming up for this GitHub dork. If the individuals who uploaded these cookie databases were made aware of what they'd done, they'd s*** their pants." Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well," he said, adding that he's alerted the UK Information Commissioner's Office because personal information is at stake. Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory. "I imagine in most of the cases, the individuals aren't aware that they've uploaded their cookie databases," he explained. "A common reason users do this is for a common environment across multiple machines."' -- source: https://news.slashdot.org/story/21/11/18/2227206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Has a Serious Security Problem That Once Again Enables DNS Cache Poisoning
by Peter Reutemann 18 Nov '21

18 Nov '21

'As much as 38 percent of the Internet's domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. >From then on, anyone relying on the same resolver would be diverted to the same imposter site. The sleight of hand worked because DNS at the time relied on a transaction ID to prove the IP number returned came from an authoritative server rather than an imposter server attempting to send people to a malicious site. The transaction number had only 16 bits, which meant that there were only 65,536 possible transaction IDs. Kaminsky realized that hackers could exploit the lack of entropy by bombarding a DNS resolver with off-path responses that included each possible ID. Once the resolver received a response with the correct ID, the server would accept the malicious IP and store the result in cache so that everyone else using the same resolver -- which typically belongs to a corporation, organization, or ISP -- would also be sent to the same malicious server.' -- source: https://linux.slashdot.org/story/21/11/17/1856235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 18 Nov '21

18 Nov '21

Hi everyone We have a WLUG meeting next week on Monday: 'For the last meeting of the year, let's have general get-together. Ian Stewart will demo the latest Ubuntu 21.10 and Peter Reutemann will try to show what you can use the frp fast reverse proxy for (https://github.com/fatedier/frp) And of course, general Linux related troubleshooting and questions answered.' -- source: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861098/ This is once again an online event, so make sure to RSVP on meetup to get the link (you only need a browser). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Latency Numbers Every Programmer Should Know
by Lawrence D'Oliveiro 17 Nov '21

17 Nov '21

Somebody did a nice chart a while back <https://gist.github.com/hellerbarde/2843375> of the time it takes to perform many common data transfer operations on contemporary hardware. And note the multi-part figure, where the basic unit in each block is a bit more than an order of magnitude greater than the one in the previous block. And if the figure isn’t dramatic enough, a commenter has said “let’s multiply all the numbers by a billion” (just to bring them into more human-comprehensible scales), and then liken them to common things that people do, from making a cup of coffee, all the way up to completing a bachelor’s degree.

2 5

Scientists Send Data Using Nuclear Radiation
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

A research group has used fast neutrons <https://www.theregister.com/2021/11/15/wireless_information_transfer_with_f…> as a communication channel, to send legible data between a transmitter and a receiver. Their proof of concept is very low-bandwidth and requires a lot of complicated equipment, but at least it does show (safety issues aside) that it is theoretically possible. The issue with high-energy subatomic particles is, how do you turn them on and off at will -- i.e. modulate the intensity of the beam to convey information? This group used some kind of shutter system (“neutron chopper”) in conjunction with some quantity of radioactive californium-252 as their neutron source. But they mention that someone else has come up with a device that is basically a particle accelerator on a chip, able to produce a stream of neutrons from non-radioactive starting components on demand.

1 0

Microsoft Fixes An Issue
by Lawrence D'Oliveiro 16 Nov '21

16 Nov '21

The latest Windows 11 update <https://www.theregister.com/2021/11/15/windows_11_insiders_bug_fixes/> gets ever closer to perfection. I like this one: We fixed an issue that prevents your device from starting up, and it becomes unresponsive because of licensing API calls. Because what would that good old “enrichment of the user experience” be like without licensing API calls ... The writer’s verdict on the new OS sounds more like damning with faint praise: We have been running Windows 11 for daily work since official release and are happy to report that it is usable and stable in our experience so far, though useful improvements over its predecessor are hard to identify.

1 0

DDR4 memory protections are broken wide open by new Rowhammer technique
by Peter Reutemann 16 Nov '21

16 Nov '21

'Rowhammer exploits that allow unprivileged attackers to change or corrupt data stored in vulnerable memory chips are now possible on virtually all DDR4 modules due to a new approach that neuters defenses chip manufacturers added to make their wares more resistant to such attacks. Rowhammer attacks work by accessing—or hammering—physical rows inside vulnerable chips millions of times per second in ways that cause bits in neighboring rows to flip, meaning 1s turn to 0s and vice versa. Researchers have shown the attacks can be used to give untrusted applications nearly unfettered system privileges, bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources, and root or infect Android devices, among other things. All previous Rowhammer attacks have hammered rows with uniform patterns, such as single-sided, double-sided, or n-sided. In all three cases, these “aggressor” rows—meaning those that cause bitflips in nearby “victim” rows—are accessed the same number of times. Research published on Monday presented a new Rowhammer technique. It uses non-uniform patterns that access two or more aggressor rows with different frequencies. The result: all 40 of the randomly selected DIMMs in a test pool experienced bitflips, up from 13 out of 42 chips tested in previous work from the same researchers.' -- source: https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptibl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

topics for next month?
by Peter Reutemann 15 Nov '21

15 Nov '21

Hi everyone Next month will be the last meeting for the year and I'm once again looking for presenters. I can give a short introduction/show'n'tell of frp (fast reverse proxy) and what it can be used for: https://github.com/fatedier/frp Who else is willing to talk about something? It doesn't have to be admin-type stuff at all, but instead useful applications that you use/have come across. If you have something, even just for 5-10 min, please reply in this thread or contact me off-list. Have a great and safe weekend! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 2

Ask Slashdot: Why Is Firefox Losing Users?
by Peter Reutemann 05 Nov '21

05 Nov '21

'This weekend finds some long-time Slashdot readers debating why research shows Firefox losing market share. Long-time Slashdot reader chiguy shares one theory: "Firefox keeps losing users, according to this rant, because it arrogantly refuses to listen to its users." Slashdot reader BAReFO0t countered that that can't be the reason, "because Google does that too." (They blame Chrome's "feature" addition treadmill, where "they keep adding stupid kitchen sinks for the sole and only purpose to make others unable to keep up.") Long-time Slashdot reader Z00L00K thinks that "All those totally unnecessary UI changes are what REALLY annoys users. Not only the immediately visible things in the header but also the renaming of items in the menus just bugs people." But long-time Slashdot reader AmiMoJo argues that "the most popular browser, Chrome, has all those things. In fact all the browsers that are more popular than Firefox do, so the idea that those are unpopular and driving people away doesn't really hold up... Firefox's decline is mostly due to Chrome just being really good, and [Firefox] not having a decent mobile version." I'm still a loyal Firefox user. (Although the thing that annoyed me was when Firefox suddenly changed the keyboard shortcut for copying a link from CNTRL-A to CNTRL-L.) The "rant" at ItsFoss argues that Firefox's original sin was in 2009 when it decided to move tabs to the top of the browser, and when favorite features could no longer be re-enabled in Firefox's about:config file. But that's what I like about Firefox -- at it's best, it's ultimately customizable, with any feature you want easily enabled in what's essentially an incredibly detailed "preferences" menu. Maybe other browsers are just better at attracting new users through purely mechanical advantages like default placement on popular systems? Long-time Slashdot reader zenlessyank is also a long-time Firefox user -- "Been using it since Netscape" -- and countered all the doubters with a comment headlined "Firefox rocks!" "Doesn't matter to me how many other users there are or aren't I will still use it as long as it stays updated." But what are your thoughts? Feel free to share your own opinions and experiences with Firefox in the comments.' -- source: https://news.slashdot.org/story/21/09/12/181257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 7

The Booming Underground Market for Bots That Steal Your 2FA Codes
by Peter Reutemann 04 Nov '21

04 Nov '21

'The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. From a report: The call came from PayPal's fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer. "In order to secure your account, please enter the code we have sent your mobile device now," the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, "Thank you, your account has been secured and this request has been blocked. Don't worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up," the voice said. But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers. Various bots target Apple Pay, PayPal, Amazon, Coinbase, and a wide range of specific banks. Whereas fooling victims into handing over a login or verification code previously would often involve the hacker directly conversely with the victim, perhaps pretending to be the victim's bank in a phone call, these increasingly traded bots dramatically lower the barrier of entry for bypassing multi-factor authentication.' -- source: https://yro.slashdot.org/story/21/11/03/1842245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Edge Browser for Linux is Now Available for All Users
by Peter Reutemann 03 Nov '21

03 Nov '21

'A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.' -- source: https://linux.slashdot.org/story/21/11/02/1627250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Trojan Source' Bug Threatens the Security of All Code
by Peter Reutemann 02 Nov '21

02 Nov '21

'"Virtually all compilers -- programs that transform human-readable source code into computer-executable machine code -- are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected," warns cybersecurity expert Brian Krebs in a new report. An anonymous reader shares an excerpt: Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis). Specifically, the weakness involves Unicode's bi-directional or "Bidi" algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic -- which is read right to left -- and English (left to right). But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the "Bidi override," which can be used to make left-to-right text read right-to-left, and vice versa. "In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient," the Cambridge researchers wrote. "For these cases, Bidi override control characters enable switching the display ordering of groups of characters." Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email. Here's the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text -- including control characters -- is ignored by compilers and interpreters. Also, it's bad because most programming languages allow string literals that may contain arbitrary characters, including control characters. "So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty," said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. "That's bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything." The research paper, which dubbed the vulnerability "Trojan Source," notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. [...] Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable. "If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected," he said. Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.' -- source: https://it.slashdot.org/story/21/11/01/2147254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Zero 2 W: 5x faster than the original for $5 more
by Peter Reutemann 01 Nov '21

01 Nov '21

'The diminutive Raspberry Pi Zero is getting its first upgrade in nearly five years. Today, Raspberry Pi founder Eben Upton announced the Raspberry Pi Zero 2 W, a new $15 product that puts the processor from the Raspberry Pi 3 into a board the exact same size as the original Zero. The new board swaps the old Zero's 1 GHz single-core ARM11 processor for a quad-core Cortex A53-based Broadcom BCM2710A1 processor, also clocked at 1 GHz—the same processor used in the original Raspberry Pi 3 released back in 2016, albeit clocked slightly lower. This is a substantial increase in power and capability for the Pi Zero, going from one core to four and from 32 bits to 64. Upton said that the performance increase over the original Zero "varies across workloads" but that for multithreaded tasks like those simulated by sysbench, "it is almost exactly five times faster." Heat dissipation is provided by "thick internal copper layers" in the board, which should help prevent thermal throttling without the use of additional fans or heatsinks.' -- source: https://arstechnica.com/gadgets/2021/10/raspberry-pi-zero-2-w-crams-pi-3-pa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Newly-Discovered 'AbstractEmu' Malware Rooted Android Devices, Evaded Detection
by Peter Reutemann 01 Nov '21

01 Nov '21

'"New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks," reports BleepingComputer. Cybersecurity company Lookout said on its blog that they'd spotted the malware on Google Play "and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store.... To protect Android users, Google promptly removed the app as soon as we notified them of the malware." We named the malware "AbstractEmu" after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads... This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors... By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances... AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading... By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device. "Apps bundling the malware included password managers and tools like data savers and app launchers," reports BleepingComputer, "all of them providing the functionality they promised to avoid raising suspicions..." Lookout's blog post said they'd spotted people affected by the malware in 17 different countries.' -- source: https://it.slashdot.org/story/21/10/31/1253225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sprite Fright: Not Your Father’s Blender Open Movie
by Lawrence D'Oliveiro 31 Oct '21

31 Oct '21

The latest short feature from the Blender Studio is now out <https://www.blender.org/>. While past efforts have had the occasional sombre, not to say dark, elements, this one just takes the darkness to the next level. It’s an out-and-out horror story, with overtones of environmental retribution in its plot. Carnage, gore, deaths, and just plain ickiness in full measure, packed into a mere 10 minutes. I just hope the script writer is getting therapy ...

1 0

Protonmail Celebrates Swiss Court Victory Exempting it From Telco Data Retention Laws
by Peter Reutemann 28 Oct '21

28 Oct '21

'Encrypted email provider Protonmail has hailed a recent Swiss legal ruling as a "victory for privacy," after winning a lawsuit that sees it exempted from data retention laws in the mountainous realm. From a report: Referring to a previous ruling that exempted instant messaging services from data capture and storage laws, the Protonmail team said this week: "Together, these two rulings are a victory for privacy in Switzerland as many Swiss companies are now exempted from handing over certain user information in response to Swiss legal orders." Switzerland's Federal Administrative Court ruled on October 22 that email providers in Switzerland are not considered telecommunications providers under Swiss law, thereby removing them from the scope of data retention requirements imposed on telcos. The victory comes after controversy over a previous (and not directly related) Swiss court order that forced the company to collect mobile device push notification identifiers from a specified user's account. That user was later arrested by French police, who had asked their Swiss counterparts to obtain the surveillance order. Protonmail chief exec Andy Yen told The Register his business doesn't routinely collect such data on its users.' -- source: https://yro.slashdot.org/story/21/10/27/147224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Core i9 11900K: Five Linux Distros Show Sizable Lead Over Windows 11
by Peter Reutemann 28 Oct '21

28 Oct '21

'Phoronix: Now that Windows 11 has been out as stable and the initial round of updates coming out, I've been running fresh Windows 11 vs. Linux benchmarks for seeing how Microsoft's latest operating system release compares to the fresh batch of Linux distributions. First up is the fresh look at the Windows 11 vs. Linux performance on an Intel Core i9 11900K Rocket Lake system. Microsoft Windows 11 Pro with all stable updates as of 18 October was used for this round of benchmarking on Intel Rocket Lake. The Windows 11 performance was being compared to all of the latest prominent Linux distributions, including: Ubuntu 20.04.3 LTS, Ubuntu 21.10, Arch Linux (latest rolling), Fedora Workstation 35, Clear Linux 35150. All the testing was done on the same Intel Core i9 11900K test system at stock speeds (any frequency differences reported in the system table come down to how the information is exposed by the OS, i.e. base or turbo reporting) with 2 x 16GB DDR4-3200 memory, 2TB Corsair Force MP600 NVMe solid-state drive, and an AMD Radeon VII graphics card. Each operating system was cleanly installed and then run at its OS default settings for seeing how the out-of-the-box OS performance compares for these five Linux distributions to Microsoft Windows 11 Pro. But for the TLDR version... Out of 44 tests run across all six operating systems, Windows 11 had just three wins on this Core i9 11900K system. Meanwhile Intel's own Clear Linux platform easily dominated with coming in first place 75% of the time followed by Fedora Workstation 35 in second place with first place finishes 9% of the time. The geometric mean for all 44 tests showed Linux clearly in front of Windows 11 for this current-generation Intel platform. Ubuntu / Arch / Fedora were about 11% faster overall than Windows 11 Pro on this system. Meanwhile, Clear Linux was about 18% faster than Windows 11 and enjoyed about 5% better performance overall than the other Linux distributions.' -- source: https://linux.slashdot.org/story/21/10/27/1625217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Setback for Nvidia's $54 Billion ARM Bid as EU Regulators Open Probe
by Peter Reutemann 28 Oct '21

28 Oct '21

'Nvidia suffered a setback on Wednesday as EU antitrust regulators opened a full-scale investigation into its $54 billion bid for British chip designer ARM on concerns the deal could lead to higher prices, less choice and reduced innovation. From a report: Britain's competition agency is also probing the deal for the country's most important technology company, warning that it could damage competition and weaken rivals. Reuters reported the European Commission viewed as insufficient concessions offered by the world's biggest maker of graphics and artificial intelligence (AI) chips during its preliminary review. Nvidia has not disclosed what these are but it has previously said it would maintain ARM as a neutral technology supplier to sooth concerns from customers such as Qualcomm, Samsung and Apple. The Commission said it would decide by March 15 whether to clear or block the deal. "Whilst Arm and Nvidia do not directly compete, Arm's IP is an important input in products competing with those of Nvidia, for example in datacentres, automotive and in Internet of Things," EU competition chief Margrethe Vestager said in a statement.' -- source: https://slashdot.org/story/21/10/27/1648229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's 12L Feature Drop Aims To Be a Big Improvement for Folding Phones
by Peter Reutemann 28 Oct '21

28 Oct '21

'At this year's Android Dev Summit, Google announced an upcoming update for devices with larger screens, which includes tablets, foldables, and devices that run ChromeOS. From a report: Google is calling the update 12L, and it's supposed to make Android 12 run smoother on big screens. We first heard the possibility of a "12.1" update in late September, and it looks like many of the rumored features are true. 12L optimizes the layout of a device's UI, adjusting the placement of the home screen, lock screen, notifications, Quick Settings, and more. Google notes that any screen 600 density-independent pixels (dp) and above will display a two-column layout that makes use of the entire screen. In the example Google shows, the Quick Settings menu is pushed towards the left side of the screen, while the notifications panel is locked to the right, giving you the ability to access both simultaneously -- all without opening one app and closing another. 12L also introduces a new taskbar that makes it easier for users to quickly switch between different apps. Dragging and dropping an app from the taskbar opens it up in split-screen mode, which Google notes it has enabled for all apps, whether they're resizable or not.' -- source: https://tech.slashdot.org/story/21/10/27/1821200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Trying To Cripple Its Own Open-Source Project
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Microsoft is trying to remove a feature called “Hot Reload” from Dotnet, saying it is something that should only be available through Visual Studio <https://www.theregister.com/2021/10/22/microsoft_net_hot_reload_visual_stud…>. Trouble is, this is the (supposedly) Open-Source version of Dotnet. And you do not take away useful features from Open-Source projects. You can do that to proprietary products, where the users have no choice but to put up with it. As of this writing, the commit that removes the feature has already been merged, but a follow up request to revert that change, while gathering a lot of support, has not been accepted into the official code base yet. As one of the commenters says: “This is the PR that is truly going to decide .NET is really an OSS or not!”. This is just one in a long line of incidents <https://www.theregister.com/2021/10/18/net_foundation_gnome/> casting doubt on the independence of Dotnet as an Open-Source project.

1 0

App Telemetry For Developers
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Here’s an interesting idea <https://www.theregister.com/2021/10/22/new_relic_codestream/>: if an app should crash during a production run, it can send telemetry data back to the developer providing some program state and pinpointing exact locations in the source code. This is done using eBPF (Extended Berkeley Packet Filter), which is able to collect information about running applications with minimal impact. You thought packet-filtering was only about managing network activity, but no, it is more useful than that. Yes, there is potential for this sort of thing to be misused, if it is not correctly managed. With great power comes great responsibility etc. By the way, while eBPF may have its roots in the older BPF as found in the BSDs, it is nevertheless a Linux-only technology <https://ebpf.io/>. Though Microsoft is trying to port some parts of it to Windows <https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-…>.

1 0

GPSD Bug Will Switch Your Time-Keeping Systems To March 2002 This Weekend, Unless You Update
by Peter Reutemann 22 Oct '21

22 Oct '21

'"Apparently a bug in GPSD, the daemon responsible for deriving time from the GPS system, is going to trigger on October 24, 2021, jumping the time back to March of 2002," writes Slashdot reader suutar. "There's a fix that's been committed since August, but of course not everything is up to date." ZDNet's Steven J. Vaughan-Nichols writes: This will be ugly. Or, as Stephen Williams, who uncovered the bug put it, "I have a feeling that there will be some 'interesting moments' in the early morning when a bunch of the world's stratum 1 NTP servers using GPSD take the long strange trip back to 2002." GPSD maintainer Gary E. Miller has acknowledged the problem, and a fix has been made to the code. To be exact, the fix is in August 2021's GPSD 3.23 release. So, what's the problem if the fix is already in? Well, there are two problems. First, it won't be backported to previous releases. If you're still using an older version, you may be out of luck. Second, as Miller observed, not all distros "pick up GPSD updates or upstream their patches. [This] is a very sore spot with me." So, just because your operating system is up to date does not mean that it will have the necessary GPSD fix. Miller suggests that you check it and do it yourself: "I [am] gonna fall back on Greg K_H's dictum: All users must update." Oh, wondering what the mysterious root cause of all this commotion GPS Week Rollover? It's a legacy GPS problem. The GPS signal GPS week number uses a 10-bit code with a maximum value of 1,023. This means every 19.7 years; the GPS week number rolls over to zero. Or, as Miller noted, "This code is a 1024 week time warp waiting to happen." So, check your systems now for this problem. And, if, like most of us, you're relying on someone upstream from you for the correct time, check with them to make sure they've taken care of this forthcoming trouble.' -- source: https://it.slashdot.org/story/21/10/21/2053248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Sues Vizio for GPL Violations
by Peter Reutemann 21 Oct '21

21 Oct '21

'Jeremy Allison - Sam writes: Software Freedom Conservancy, a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), announced today it has filed a lawsuit against Vizio for what it calls repeated failures to fulfill even the basic requirements of the GPL. The lawsuit alleges that Vizio's TV products, built on its SmartCast system, contain software that Vizio unfairly appropriated from a community of developers who intended consumers to have very specific rights to modify, improve, share, and reinstall modified versions of the software.' -- source: https://yro.slashdot.org/story/21/10/19/2043203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Versus The Chip Foundries
by Lawrence D'Oliveiro 21 Oct '21

21 Oct '21

Nice backgrounder <https://arstechnica.com/tech-policy/2021/10/intel-slipped-and-its-future-no…> on how Intel (and American chipmakers generally) slipped from their leadership position by overlooking an important new business: manufacturing chips according to other people’s designs. We’ve all heard of Taiwan-based TSMC, which is the world leader in this area; when it was founded way back in 1987 (with help from the Taiwanese Government and from Philips), none of the US companies would take such an idea seriously. They didn’t think it would amount to a very profitable business, and anyway they wanted to control their own Intellectual Property. Plus, a company that made chips both for its own internal businesses and for others could never be seen to be entirely above accusations of conflict of interest. Note also the role played by Carver Mead, basically the father of the whole concept of RISC. He wanted a place to go to, where his students (and those of other teachers) could get their designs turned into actual working chips. He had special personal connections with Intel to get access to their fabs, but he knew others were not so lucky. So he played an influential part in getting TSMC started.

1 0

Google Removes Support for FTP and Old-gen U2F Security Keys in Chrome 95
by Peter Reutemann 21 Oct '21

21 Oct '21

'Google today released Chrome v95, the latest version of its popular web browser and a version that contains several changes that will likely cause problems for a considerable part of its users. The problematic changes include: removing support for File Transfer Protocol (FTP) URLs -- ftp:// removing support for the Universal 2nd Factor (U2F) standard, used in old-generation security keys (Chrome will only support FIDO2/WebAuth security keys going forward) adding file size limits for browser cookies removing support for URLs with non-IPv4 hostnames ending in numbers, such as http://example.0.1 In addition to breaking changes, Chrome 95 also comes with a new UI component called the "Side Panel," which can be used to view the Chrome browser's Reading List and Bookmarks.' -- source: https://tech.slashdot.org/story/21/10/20/206210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Supply chain woes lead to a “temporary” Raspberry Pi 4 price hike
by Peter Reutemann 21 Oct '21

21 Oct '21

'Pandemic-driven supply chain problems have prompted the first-ever price increase for a Raspberry Pi product, according to Raspberry Pi founder Eben Upton. Acknowledging that the 2GB configuration of the Raspberry Pi 4 and the Raspberry Pi Zero had been particularly hard-hit by shortages, Upton announced that the price of the 2GB Pi 4 would increase from $35 to $45 and that a previously discontinued version of the Pi 4 with 1GB of RAM would be reintroduced at $35.' -- source: https://arstechnica.com/gadgets/2021/10/supply-chain-woes-lead-to-a-tempora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux laptop offers RTX 3080 and 144 Hz 17-inch screen
by Peter Reutemann 20 Oct '21

20 Oct '21

'Linux users like to game, too, and the Juno Neptune 17-inch V3 laptop announced this week ensures that people on Ubuntu can play their favorite titles on the go. Keeping up with the Alienwares, Asus ROGs, and other Windows-focused gaming brands, the new portable packs up to an RTX 3080 discrete graphics card and the 8-core Intel Core i7-11800H. And it lets you experience all the action on a spacious, 17.3-inch screen with a 144 Hz refresh rate. A colorfully backlit keyboard completes the package.' -- source: https://arstechnica.com/gadgets/2021/10/new-linux-laptop-offers-rtx-3080-an… Well, if you have a spare USD3,699, then the maxed out version can be yours... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave Removes Google as its Default Search Engine
by Peter Reutemann 20 Oct '21

20 Oct '21

'As Paul Thurrott reports, Brave is removing Google Search as its default search engine. From the report: Going forward, the Brave web browser will default to Brave Search. "Brave Search has grown significantly since its release last June, with nearly 80 million queries per month," Brave CEO and co-founder Brendan Eich says. "Our users are pleased with the comprehensive privacy solution that Brave Search provides against Big Tech by being integrated into our browser. As we know from experience in many browsers, the default setting is crucial for adoption, and Brave Search has reached the quality and critical mass needed to become our default search option, and to offer our users a seamless privacy-by-default online experience." Brave Search is built on top of an independent index, and doesn't track users, their searches, or their clicks, the firm says. And starting with Brave 1.3 on desktop and Android, and Brave 1.32 on iOS, it will be the default search engine in the browser, instead of Google, in the United States, Canada, and the United Kingdom. It is also replacing Qwant in France and DuckDuckGo in Germany, and Brave says that more locales will be added in the next several months. Existing users can keep their chosen search engine default, of course, and new users who prefer other search engines can configure as needed. Brave Search doesn't display ads today, but the free version of the service will soon be ad-supported. An ad-free Premium version is coming "in the near future," Brave says. Along with this search engine news, Brave announced the Web Discovery Project (WDP), "which it describes as a privacy-preserving system for users to anonymously contribute data to improve Brave Search results," writes Thurrott. "The WDP is an opt-in feature that protects user privacy and anonymity by ensuring that contributed data is not linked to individuals, their devices, or any set of users." It has a GitHub repo available to help you learn more about this system.' -- source: https://tech.slashdot.org/story/21/10/19/2121251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(virtual) meeting next Monday
by Peter Reutemann 19 Oct '21

19 Oct '21

Hi everyone We have a meeting coming up next week. Due to the small venue size, we will still hold it in a virtual manner, even if Hamilton should go back to level 2 (though we will record it): 'Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861093/ You will get access to the meeting link when RSVPing on meetup. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Quote Of The Week
by Lawrence D'Oliveiro 18 Oct '21

18 Oct '21

From <https://arstechnica.com/gadgets/2021/10/fixes-for-amd-ryzen-performance-oth…>: Now that Windows 11 is out, the arduous process of fixing the new operating system's bugs can begin. So goodbye Windows 10, no PrintNightmare fix for you...

1 0

PowerPC Fork of Firefox Reaches End of the Road
by Peter Reutemann 15 Oct '21

15 Oct '21

'Ars Technica: It has been well over a decade since PowerPC Macs roamed the earth -- so long that the Intel Macs that replaced them are themselves being replaced by something else. But to this day, there's a small community of people still developing software for PowerPC Macs and Mac OS 9. One of those projects was TenFourFox, a fork of the Firefox browser for G3, G4, and G5-based PowerPC Macs running Mac OS X 10.4 or 10.5. Maintained primarily by Cameron Kaiser, the TenFourFox project sprang up in late 2010 after Mozilla pulled PowerPC support from Firefox 4 during its development. And amazingly, the browser has continued to trundle on ever since. But continuing to backport Firefox features to aging, stuck-in-time PowerPC processors only got more difficult as time went on. And in March of this year, Kaiser announced that TenFourFox updates would be ending after over a decade of development. The final planned release of TenFourFox was earlier this month. Kaiser's full post is long, but it's worth a read for vintage-computer enthusiasts or anyone who works on software -- Kaiser expresses frustration with the realities of developing and supporting a niche app, but he also highlights TenFourFox's impressive technical achievements and ruminates on the nature of the modern Internet and open source software development [...]. Kaiser doesn't intend to fully halt work on the browser, but he is downshifting it into what he calls "hobby mode." He will continue to backport security patches from newer ESR releases of Firefox and post them to the TenFourFox Github page, but anyone who wants to use these will need to build the app themselves. Kaiser also won't commit to providing support for these additions or providing them on any kind of schedule. Other developers are also welcome to continue to release TenFourFox builds on their own. ' -- source: https://news.slashdot.org/story/21/10/14/2116255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular Framework Laptop Gets Marketplace For All Those Modules
by Peter Reutemann 15 Oct '21

15 Oct '21

'Framework, makers of the modular 13.5-inch Framework laptop that's designed to be easily repaired and upgraded, has launched a dedicated marketplace filled with replacement parts and upgrades for its portable computer. The Verge reports: Writing in a blog post, the company said the marketplace is currently focused on replacement parts and expansion cards, but that it hopes to add more customization modules like additional language keyboards later this year, as well as third-party and community developed modules in 2022. The marketplace already includes a range of expansion cards for the laptop, which are designed to slot into its four modular compartments to add everything from extra storage to features like MicroSD card slots or more USB ports. There's also user upgradeable RAM and storage for sale. But the store is clearly a work in progress, and lists a host of other items like replacement CPU-equipped mainboards, keyboards, and spare parts like batteries and displays as "coming soon." ' -- source: https://hardware.slashdot.org/story/21/10/14/2110258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.0 Released
by Peter Reutemann 15 Oct '21

15 Oct '21

'Everyone's favorite security-focused operating system, OpenBSD, released version 7.0 today. In addition to the usual bug fixes and performance enhancements, support for RISC-V processors has been added. The changelog and mirrors can be found at their respective links.' -- source: https://bsd.slashdot.org/story/21/10/14/217206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Ubuntu Linux 21.10 Impish Indri
by Peter Reutemann 15 Oct '21

15 Oct '21

'Following a brief beta-testing period, Ubuntu 21.10 has finally become available to download in the "final" stable form. BetaNews: Code-named "Impish Indri," this version of Ubuntu is not a Long Term Support (LTS) version, so it is only supported for nine months. Ubuntu 21.10 features Linux kernel 5.13 and a Snap variant of the Mozilla Firefox browser. "Ubuntu 21.10 brings the all-new PHP 8 and GCC 11 including full support for static analysis, greatly improving everyday developer security awareness in low-level programming. With Gnome 40 desktop users gain dynamic workspaces and touchpad gestures. The new Firefox snap, published by Mozilla, improves security and guarantees access to both the latest and the extended support release versions of the browser. The exact same versions of the browser are available on multiple different versions of Ubuntu, simplifying enterprise developer platform management," says Canonical.' -- source: https://linux.slashdot.org/story/21/10/14/2013235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice, OpenOffice Bug Allows Hackers To Spoof Signed Docs
by Peter Reutemann 12 Oct '21

12 Oct '21

'LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source. Although the severity of the flaw is classified as moderate, the implications could be dire. BleepingComputer reports: The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. If you're using either of the open-source office suites, you're advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers -- LibreOffice, OpenOffice. If you're using Linux and the aforementioned versions aren't available on your distribution's package manager yet, you are advised to download the "deb", or "rpm" package from the Download center or build LibreOffice from source. If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros. ' -- source: https://it.slashdot.org/story/21/10/11/212215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'FontOnLake' Malware Family Can Target Linux Systems
by Peter Reutemann 11 Oct '21

11 Oct '21

'Security Week reports: A previously unknown, modular malware family that targets Linux systems has been used in targeted attacks to collect credentials and gain access to victim systems, ESET reported on Thursday. Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile. What's more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed to work together, namely trojanized applications, backdoors, and rootkits. Evidence suggests that FontOnLake has been used in attacks aimed at organizations in Southeast Asia. The first malware samples related to this family emerged last May. The malware was previously described by Avast and Lacework as the HCRootkit / Sutersu Linux rootkit, as well as by Tencent Security Response Center in a February report. The various trojanized applications that ESET's researchers have identified during their investigation are used to load custom backdoor or rootkit modules, but also to collect sensitive data when needed. Posing as standard Linux utilities, these files were also designed to achieve persistence on the compromised systems. What the researchers haven't figured out yet is the manner in which the trojanized applications are delivered to the victims. ESET's analysis of FontOnLake has revealed the use of three different backdoors, all written in C++, all using the same Asio library from Boost, and all capable of exfiltrating sshd credentials and bash command history. The simplest of the three was designed to launch and mediate access to a local SSH server, update itself, and transmit collected credentials. The malware appears to be under development. The second backdoor was also capable of file manipulation, updating itself, and uploading and downloading files, according to the article, while the third backdoor "accepts remote connections, serves as a proxy and can download and run Python scripts, in addition to exfiltrating credentials."' -- source: https://linux.slashdot.org/story/21/10/10/000240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Linux and Mac Computers Get Their Time Zones From the Same Database
by Peter Reutemann 11 Oct '21

11 Oct '21

'"All Linux and Mac-based computers pull their time zones from a massively important database — the time zone database," explains Medium's tech site OneZero. And this vastly crucial project is ultimately overseen by one man who Medium calls "The Time Zone King." The process of defining time zones is centralized. This is actually quite a big deal in its own right because people tend to grossly underestimate how pivotal Linux is to ... the entire internet and technology as we know it... The time zone database — which is sometimes called the Olson data or zoneinfo database — has a fascinating history... Not only are time zones apparently a longstanding menace for computer developers, but the time zone maintenance community is currently, it seems, mired among some procedural dispute regarding how this essential database should best be maintained. Of course that's an interesting fact in its own right: there is a world time zone data community. In fact, The Register recently described them as being no less than " up in arms " about the direction the project was proceeding down... A difference of vision among time zone enthusiasts might be the neatest summary anybody can advance.... Not only can't the time zone titans currently agree on the best way to carry the timezone database forward, it seems. But the entire process of codifying and standardizing time zones is also decidedly contentious political business with a long and tumultuous history to go with it. Those who enter the fray need to be therefore not only technical heavyweights but also prepared to have the occasional audacity to stand up to countries like the Hashemite Republic of Jordan and tell them that their attempt to prematurely end DST is unacceptable and will not be promulgated in the database... Weary time zone mavericks are bursting to the seams with horror stories of African states who made rash time zone decisions on only four days' notice... Time zone data insiders say that every single one of these high stakes deliberations represents a near Y2K disaster that must be averted... At the helm of this project is one individual. One guy. Paul Eggert, a computer scientist who teaches at the Department of Computer Science at the University of California's LA Campus... This is a man, after all, whose codebase helps hundreds of millions of users know what time zone they're in and who — for the past ten years — has gone to bed knowing that hundreds of millions of computers are using his code to know what time zone they're in. He's lived under that pressure for over a decade. And by all accounts thrived... Untold millions have been made by startups announcing dubious advents upon existing technologies heralded with the breathless fanaticism of companies announcing that they have found a way to turn air water into oil. Many of these will vanish into oblivion within a few short years. The time zone database won't. Because it can't. And those at the very bottom of the tech stack — those tirelessly and thanklessly maintaining open source projects upon which so much of the world's computing derives — languish in comparable obscurity... In recent years, the project has fallen under the purview of ICANN [through its Internet Assigned Numbers Authority]. Its code reads like a cross between a JSON file and a historical novel. And while I'm sure the project has many noteworthy contributors, there's ultimately one guy who's responsible for maintaining it. The Time Zone King. His name is Paul Eggert. And he's a computer scientist based out of UCLA. We probably all owe him a 'thank you'.' -- source: https://tech.slashdot.org/story/21/10/10/1950239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

I can't log into trademe and entering an URL dosen't work
by Michelle 10 Oct '21

10 Oct '21

Hi, I bought on disc the new version of Manjaro Plasma 64 bit KDE because the old Manjaro Illyria 18.0 64 bit I was using stopped working with various things. The new one won't allow me to log into tradme. I enter my email and password and it won't work just like the old one wouldn't. Plasma allows me to see pictures on tumblr whereas the old one stopped allowing that about 2 months ago. And youtube still works. But the new one has another big problem. For security issues I run a computer off a DVD and have no hard drive. When I want to go into any site that requires a password like email or trademe, this is what I do. I boot up, I pull up firefox, I type in the URL for trademe or what have you, and press enter, then and only then do I connect to the internet and click to 'retry' that site and then once at the site the first thing I do is log in. But this new Plasma won't allow me to do that. So could I please have some suggestions for two things: How to make this new one work in those two circumstances AND/OR Some specific names of Operating Systems that will actually allow logging into trademe and will allow URL's to be typed in. Thanks for any help.

3 11

Firefox Now Sends Your Address Bar Keystrokes To Mozilla
by Peter Reutemann 10 Oct '21

10 Oct '21

'How-To Geek reports: Firefox now sends more data than you might think to Mozilla. To power Firefox Suggest, Firefox sends the keystrokes you type into your address bar, your location information, and more to Mozilla's servers. Here's exactly what Firefox is sharing and how to control it. This change was made as part of the introduction of Firefox Suggest in Firefox 93, released on October 5, 2021. As part of Firefox Suggest, Firefox is getting ads in your search bar -- but that's not the only thing that will be news to longtime Firefox users. According to Mozilla, "Firefox Suggest acts as a trustworthy guide to the better web, surfacing relevant information and sites to help people accomplish their goals." In reality, what that means is, when you start typing in your address bar, you won't just see the standard search suggestions from Google or your current search default engine. You'll also see "Firefox Suggest" results pointing to web pages. Some of them are sponsored ads, but you can disable the ads. Firefox Suggest is on by default. Mozilla's blog post on the subject says Firefox Suggest is an "opt-in experience," which was the case in September 2021 -- but it's now enabled by default in Firefox 93. However, as of Firefox 93's release in October 2021, Firefox Suggest is only enabled in the USA -- for now. It's worth noting that, for many years, Firefox and other web browsers have had search suggestions in their address bar. So, when you start typing "win" in your address bar, you may see suggestions for "Windows 11" and "Window repair." This is accomplished by sending keystrokes to your default search engine as you type in the search bar, as Mozilla's support site explains. Mozilla is also providing contextual suggestions, for which it needs more data, including the city you're located in and whether you're clicking its suggestions. You can disable Firefox's suggested results, if you like. This will stop Mozilla from collecting the data you type in your search bar, and it will also disable the suggested results and ads. To do so, open Firefox and click menu [and then] Settings. Select "Privacy [and] Security" in the left pane, and scroll down to "Address Bar -- Firefox Suggest." Disable "Contextual suggestions" and "Include occasional sponsored suggestions" to stop Firefox from sending data to Mozilla.' -- source: https://news.slashdot.org/story/21/10/08/2225217 I saw that "Firefox suggest" popping up with the latest 93 as well and, when I tried to turn it off, didn't find the "Firefox suggest" option in the settings dialog that got mentioned in various articles. Something that p...ed me off somewhat... However, looking through the slashdot comments, I came across this github gist called "Silent Firefox": https://gist.github.com/AetherEternity/5a6bb6e493a3d34988fc7342013f2ea6 The top of the file lists where to place this "user.js" file. NB: You might already have such a file, so check before you overwrite it... Personally, I like suggestions from my history (which is turned off in this gist, key: "browser.urlbar.suggest.history"), so I forked the gist and enabled it: https://gist.github.com/fracpete/408ce83d3ce48f9f95b2fea30ddf5403 I'm not particularly fond of this move by Mozilla, but at least you can still tweak its browser (though it's become harder for non-technical people). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Now Shows Ads As Sponsored Address Bar Suggestions
by Peter Reutemann 08 Oct '21

08 Oct '21

'Mozilla is now showing ads in the form of sponsored Firefox contextual suggestions when U.S. users type in the URL address bar. Mozilla says the feature was introduced with Firefox 92 in September to fund development and optimization. Mozilla describes Firefox Suggest contextual suggestions as opt-in, in BleepingComputer's tests and from what users have reported, the feature is on by default. Furthermore, Firefox doesn't tag the ads displayed via Firefox Suggest. There is no clear way to identify what a sponsored suggestion and what a regular unsponsored suggestion should look like. The only way Firefox users will know whether a sponsored suggestion is an ad would be by looking at the URL, but, in many cases, the URL is not clearly visible.' -- source: https://news.slashdot.org/story/21/10/07/1844254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache Fixes Actively Exploited Web Server Zero-day
by Peter Reutemann 06 Oct '21

06 Oct '21

'The Apache Software Foundation has released a security patch to address a vulnerability in its HTTP Web Server project that has been actively exploited in the wild. From a report: Tracked as CVE-2021-41773, the vulnerability affects only Apache web servers running version 2.4.49 and occurs because of a bug in how the Apache server converts between different URL path schemes (a process called path or URI normalization). "An attacker could use a path traversal attack to map URLs to files outside the expected document root," the ASF team said in the Apache HTTP Server 2.4.50 changelog. "If files outside of the document root are not protected by 'require all denied' these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts," Apache engineers added. More than 120,000 servers currently exposed online to attacks.' -- source: https://apache.slashdot.org/story/21/10/05/1538213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Company That Routes Billions of Text Messages Quietly Discloses It Was Hacked
by Peter Reutemann 05 Oct '21

05 Oct '21

'A company that is a critical part of the global telecommunications infrastructure used by AT&T, T-Mobile, Verizon and several others around the world such as Vodafone and China Mobile, quietly disclosed that hackers were inside its systems for years, impacting more than 200 of its clients and potentially millions of cellphone users worldwide. From a report: The company, Syniverse, revealed in a filing dated September 27 with the U.S. Security and Exchange Commission that an unknown "individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers." A former Syniverse employee who worked on the EDT systems told Motherboard that those systems have information on all types of call records. [...] The company wrote that it discovered the breach in May 2021, but that the hack began in May of 2016.' -- source: https://tech.slashdot.org/story/21/10/04/1827246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Community, Rust and Linux's Longevity
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week saw the annual check-in with Linux creator Linus Torvalds at the Open Source Summit North America, this year held in Seattle (as well as virtually). Torvalds took the stage for the event's traditional half-hour of questions from Dirk Hohndel, an early Linux contributor (now also the chief open source officer and vice president at VMware) in an afternoon keynote session.... And the theme of community seemed to keep coming up — notably about what that community has ultimately taught Linus Torvalds. (For example, while Torvalds said he'd originally planned on naming the operating system Freax, "I am eternally grateful for two other people for having more taste than I did.") But even then Linux was a project that "I probably would've left behind," Torvalds remembered, "if it was only up to me." Torvalds credits the larger community for its interest (and patches) "that just kept the motivation going. And here we are 30 years later, and it's still what keeps the motivation going. Because as far as I'm concerned, it's been done for 29 of those 30 years, and every single feature ever since has been about things that other people needed or wanted or were interested in." Torvalds also says "I'm very proud of the fact that there's actually a fair number of people still involved with the kernel that came in in 1991 — I mean, literally 30 years ago.... I think that's a testament to how good the community, on the whole, has been, and how much fun it's been." And Torvalds says you can see that sense of fun in discussions about writing some Linux kernel modules using Rust. "From a technical angle, does that make sense?" Torvalds asked. "Who knows. That's not the point. The point is for a project to stay interesting — and to stay fun — you have to play with it.... "Probably next year, we'll start seeing some first intrepid modules being written in Rust, and maybe being integrated in the mainline kernel." "I really love C," Torvalds said at one point. "I think C is a great language, and C is, to me, is really a way to control the hardware at a fairly low level..." Yet Torvalds also saw Hohndel's analogy that it can be like juggling chainsaws. As a long-time watcher of C, Torvalds knows that C's subtle type interactions "are not always logical" and "are pitfalls for pretty much anybody. And they're easy to overlook, and in the kernel that's not always a good thing." Torvalds called Rust "the first language I saw which looked like this might actually be a solution"' -- source: https://linux.slashdot.org/story/21/10/02/004213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions Experience Browser Problems After Long-Anticipated Expiration of 'Let's Encrypt' Certificate
by Peter Reutemann 04 Oct '21

04 Oct '21

'"The expiration of a key digital encryption service on Thursday sent major tech companies nationwide scrambling to deal with internet outages that affected millions of online users," reports the Washington Examiner. The expiring certificate was issued by Let's Encrypt — though ZDNet notes there's been lots of warnings about its pending expiration: Digital Shadows senior cyber threat analyst Sean Nikkel told ZDNet that Let's Encrypt put everyone on notice back in May about the expiration of the Root CA Thursday and offered alternatives and workarounds to ensure that devices would not be affected during the changeover. They have also kept a running forum thread open on this issue with fairly quick responses, Nikkel added. Thursday night the Washington Examiner describes what happened when the big day arrived: Tech giants — such as Amazon, Google, Microsoft, and Cisco, as well as many smaller tech companies — were still battling with an endless array of issues by the end of the night... At least 2 million people have seen an error message on their phones, computers, or smart gadgets in the past 24 hours detailing some internet connectivity problems due to the certificate issue, according to Scott Helme, an internet security researcher and well-known cybersecurity expert. "So many people have been affected, even if it's only the inconvenience of not being able to visit certain websites or some of their apps not working," Helme said. "This issue has been going on for many hours, and some companies are only just getting around to fixing it, even big companies with a lot of resources. It's clearly not going smoothly," he added. There was an expectation before the certificate expired, Helme said, that the problem would be limited to gadgets and devices bought before 2017 that use the Let's Encrypt digital certificate and haven't updated their software. However, many users faced issues on Thursday despite having the most cutting-edge devices and software on hand. Dozens of major tech products and services have been significantly affected by the certificate expiration, such as cloud computing services for Amazon, Google, and Microsoft; IT and cloud security services for Cisco; sellers unable to log in on Shopify; games on RocketLeague; and workflows on Monday.com. Security researcher Scott Helme also told ZDNet he'd also confirmed issues at many other companies, including Guardian Firewall, Auth0, QuickBooks, and Heroku — but there might be many more beyond that: "For the affected companies, it's not like everything is down, but they're certainly having service issues and have incidents open with staff working to resolve. In many ways, I've been talking about this for over a year since it last happened, but it's a difficult problem to identify. it's like looking for something that could cause a fire: it's really obvious when you can see the smoke...!" Digital certificates expert Tim Callan added that the popularity of DevOps-friendly architectures like containerization, virtualization and cloud has greatly increased the number of certificates the enterprise needs while radically decreasing their average lifespan. "That means many more expiration events, much more administration time required, and greatly increased risk of a failed renewal," he said. ' -- source: https://it.slashdot.org/story/21/10/02/2318202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Announces 'JShelter' Browser Privacy Extension to Block Fingerprinting, Tracking, and Malware
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week the Free Software Foundation (FSF) announced JShelter, "an anti-malware Web browser extension to mitigate potential threats from JavaScript, including fingerprinting, tracking, and data collection." The browser add-on — supported by NLnet Foundation's Next Generation Internet (NGI) Zero Privacy & Trust Enhancing Technologies fund — is currently "in development and the first release is available." This browser add-on will limit the potential for JavaScript programs to do harmful actions by restricting default behavior and adding a layer of control... Accessing cookies, performing fingerprinting to track users across multiple sites, revealing the local network address, or capturing the user's input before they submit a form are some examples of JavaScript's capabilities that can be used in harmful ways. JShelter adds a safety layer that allows the user to choose if a certain action should be forbidden on a site, or if it should be allowed with restrictions, such as reducing the accuracy of geolocation to the city area. This layer can also aid as a countermeasure against attacks targeting the browser, operating system, or hardware levels... [The extension] will ask — globally or per site — if specific native functions provided by the JavaScript engine and the Document Object Model (DOM) are allowed by the user. It will also link to an explanatory page for each function, to raise awareness of related threats. Depending on the function being addressed, the user will have the option to allow it, block it, or have it return a custom value... "Our browsers have become perhaps the most critical of tools we depend on, and yet the browser environment is far from healthy," says Michiel Leenaars, director of strategy at NLnet Foundation and coordinator of NGI Zero. "Dominant corporate behavior from a small amount of actors has been aggressively reshaping the evolution of the Web, and that is starting to wreak havoc. Despite an enormous systemic dependency, we as users have very little control over what browsers allow and share — leading to significant risk as the most powerful tools in the shed are essentially left unprotected for every casual Web site to abuse. JShelter is a great initiative to help empower us all, to help us gain better understanding and to better safeguard ourselves from obvious and otherwise unavoidable harm." The effort is part of a larger, multi-year campaign from FSF on JavaScript on the Web started in 2013, which among others includes the development of GNU LibreJS and outreach to users and developers about nonfree software inside the browser. The GNU LibreJS extension detects JavaScript web labels and assists users with running only JavaScript distributed under a free software license, according to their ethical convictions and individual preferences. "JShelter will help protect users from critical threats now, and contribute significantly to progress on the necessary longer-term cultural shift of moving away from nonfree JavaScript," said Ruben Rodriguez, former FSF chief technology officer. "This is a project I've been looking forward to for years, tired of dealing with all kinds of potential antifeatures in the browsers I use and distribute, and having to figure out some countermeasure for them with configuration changes, patches or extensions. Being able to wrap the JavaScript engine in a layer of protection is a game changer."' -- source: https://news.slashdot.org/story/21/10/03/0150251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let's Encrypt's Root Certificate is expiring!
by Peter Reutemann 01 Oct '21

01 Oct '21

'On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day so here's what you need to know!' -- source: https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

People Will Pay For Privacy, And Take Rewards To Give It Up
by Lawrence D'Oliveiro 01 Oct '21

01 Oct '21

British consumer magazine “Which?” has published the results of a survey <https://www.theregister.com/2021/09/30/which_data_survey/> which found that people would pay companies like Google and Facebook an average of £1.09 a month to avoid collection of their personal data and its use for targeted advertising. On the other hand, while a quarter of people were happy to receive targeted advertising to begin with, that proportion went up quite substantially if a basic reward like an Amazon voucher were offered.

1 0

Social Media Companies Can’t Be Trusted To Police Themselves -- Who Knew?
by Lawrence D'Oliveiro 29 Sep '21

29 Sep '21

>From a hearing at the US House of Representatives <https://www.theregister.com/2021/09/29/facebook_research_congress/> which received submissions from academics trying to study Facebook’s effect on its users in the face of active hostility from the company: “Tobacco companies don't get to decide who does research on smoking and the idea that social media companies get to decide who studies them is perverse.” -- Laura Edelson

1 0

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension
by Peter Reutemann 27 Sep '21

27 Sep '21

'The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development. No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever. Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections. >From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode. With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition. The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."' -- source: https://it.slashdot.org/story/21/09/27/008226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Recognizes Linux's 'True' 30th Anniversary Date
by Peter Reutemann 26 Sep '21

26 Sep '21

'While it's been argued that Linux has four different "birthdays," last Friday saw the 30th anniversary of Linux's very, very first release — version 0.01. That special first release "was never publicly announced, and I only emailed a handful of people in private about the upload," Torvalds remembered on the Linux kernel mailing list. He no longer has copies of those announcement emails, "so there's no real record of that. The only record of the date is in the Linux-0.01 tar-file itself, I suspect." "Alas, the dates in that tar-file are for the last modification dates, not the actual creation of the tar-file," Torvalds wrote, "but it does seem to have happened around 7:30pm (Finnish time), so the exact anniversary was technically a couple of hours ago." So when the exact moment arrived for its 30th anniversary, Torvalds couldn't resist sharing the moment on the Linux kernel mailing list. "Just thought I'd mention it, since while unannounced, in many ways this is the true 30th anniversary date of the actual code."' -- source: https://linux.slashdot.org/story/21/09/25/0333233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting tomorrow
by Peter Reutemann 26 Sep '21

26 Sep '21

Hi everyone Apologies for the late reminder, things have been a bit hectic at my end... We have a "virtual" meeting tomorrow: "Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861089/ Meeting link will be available to people that RSVP on meetup.com. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First RISC-V Computer Chip Lands At the European Processor Initiative
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Register reports: The European Processor Initiative (EPI) has run the successful first test of its RISC-V-based European Processor Accelerator (EPAC), touting it as the initial step towards homegrown supercomputing hardware. EPI, launched back in 2018, aims to increase the independence of Europe's supercomputing industry from foreign technology companies. At its heart is the adoption of the free and open-source RISC-V instruction set architecture for the development and production of high-performance chips within Europe's borders. The project's latest milestone is the delivery of 143 samples of EPAC chips, accelerators designed for high-performance computing applications and built around the free and open-source RISC-V instruction set architecture. Designed to prove the processor's design, the 22nm test chips -- fabbed at GlobalFoundries, the not-terribly-European semiconductor manufacturer spun out of AMD back in 2009 -- have passed initial testing, running a bare-metal "hello, world" program as proof of life. It's a rapid turnaround. The EPAC design was proven on FPGA in March and the project announced silicon tape-out for the test chips in June -- hitting a 26.97mm2 area with 14 million placeable instances, equivalent to 93 million gates, including 991 memory instances. While the FPGA variant, which implemented a subset of the functions of the full EPAC design, was shown booting a Linux operating system, the physical test chips have so far only been tested with basic bare-metal workloads -- leaving plenty of work to be done. Earlier today, the UK government released its 10-year plan to make the country a global "artificial intelligence superpower," seeking to rival the likes of the U.S. and China. "The so-called 'National Artificial Intelligence Strategy' is designed to boost the use of AI among the nation's businesses, attract international investment into British AI companies and develop the next generation of homegrown tech talent," reports CNBC.' -- source: https://hardware.slashdot.org/story/21/09/22/2057258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security audit raises severe warnings on Chinese smartphone model
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Lithuanian National Cyber Security Centre (NCSC) recently published a security assessment of three recent-model Chinese-made smartphones—Huawei's P40 5G, Xiaomi's Mi 10T 5G, and OnePlus' 8T 5G. Sufficiently determined US shoppers can find the P40 5G on Amazon and the Mi 10T 5G on Walmart.com—but we will not be providing direct links to those phones, given the results of the NCSC's security audit. The Xiaomi phone includes software modules specifically designed to leak data to Chinese authorities and to censor media related to topics the Chinese government considers sensitive. The Huawei phone replaces the standard Google Play application store with third-party substitutes the NCSC found to harbor sketchy, potentially malicious repackaging of common applications. The OnePlus 8T 5G—arguably, the best-known and most widely marketed phone of the three—was the only one to escape the NCSC's scrutiny without any red flags raised.' -- source: https://arstechnica.com/information-technology/2021/09/security-audit-raise… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Finally Shifting To 'Upstream First' Linux Kernel Approach For Android Features
by Peter Reutemann 23 Sep '21

23 Sep '21

'Phoronix reports: Google's Android had been notorious for all of its downstream patches carried by the mobile operating system as well as various vendor/device kernel trees while in recent years more of that code has been upstreamed. Google has also been shifting to the Android Generic Kernel Image (GKI) as the basis for all their product kernels to further reduce the fragmentation. Looking ahead, Google is now talking of an "upstream first" approach for pushing new kernel features into mainline Linux before deploying them on Android. Google's Todd Kjos talked today during Linux Plumbers Conference (LPC2021) around their Generic Kernel Image initiative. With Android 12 and their Linux 5.10 based GKI image they have further cut down the fragmentation to the extent that it's "nearly eliminated." With the Android 12 GKI, most of the vendor/OEM kernel features have now either been upstreamed into the Linux kernel, isolated to vendor modules/hooks, or merged into the Android Common Kernel. They are making good progress on the GKI front and also ensuring vendors adapt to the new approach to cut down on the kernel mess. But perhaps most exciting is their outlook for 2023 to 2024 for further reducing technical debt. They are going to pursue an "upstream first development model for new features" in making sure new code first lands into the mainline Linux kernel rather than aiming straight for lodging within the Android source tree. ' -- source: https://tech.slashdot.org/story/21/09/22/1920258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming NAS workshop
by 51miked 22 Sep '21

22 Sep '21

Anyone interested in a NAS workshop can register at: https://www.qnap.com/static/landing/en-us/workshop/workshop-09.html. I’ve found these very informative. Michael -- Kind regards Michael

2 2

Ubuntu 14.04 and 16.04 Each Get a Decade of Support from Canonical
by Peter Reutemann 22 Sep '21

22 Sep '21

'Canonical has announced that it is extending the life of Ubuntu 14.04 and 16.04 to a decade. BetaNews: In other words, Ubuntu 14.04 and 16.04 are getting longer Extended Security Maintenance (ESM) periods as Canonical pushes back their End of Life (EoL) dates. The former will now get security updates until 2024, while the latter will receive them until 2026. "This lifecycle extension enables organizations to balance their infrastructure upgrade costs, by giving them additional time to implement their upgrade plan. The prolonged Extended Security Maintenance (ESM) phase of Ubuntu 14.04 LTS and 16.04 LTS enables a secure and low-maintenance infrastructure with security updates and kernel livepatches provided by Canonical. The announcement represents a significant opportunity for the organizations currently implementing their transition to new applications and technologies," says Canonical.' -- source: https://linux.slashdot.org/story/21/09/21/1443254 That could help IoT devices to stay up to date for longer (at least OS-wise). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over-Elaborate Shell Scripting
by Lawrence D'Oliveiro 21 Sep '21

21 Sep '21

When using a computer, laziness is a virtue. This is why we have command lines, to help automate the boring and repetitive tasks. This article <https://arstechnica.com/gadgets/2021/09/command-line-wizardry-part-two-vari…> continues the author’s intro to basic command-line concepts. But it repeats a failing I see all too often in shell scripting: doing complex parsing of the output of some command, when the command itself offers an option to produce something closer to the exact output you need. In this case, he is extracting the names of datasets from the “zfs list” command. And while I have zero experience with ZFS, I can look at documentation <https://docs.oracle.com/cd/E18752_01/html/819-5461/gazsu.html>, and discover that the command offers the “-o” option where you can select exactly that information you want it to output. It even has “-H” to simplify the output format right down, specifically to make it easier to parse. Sure, it’s fun to write code. But it can be even more fun to _avoid_ writing code. RTFM helps.

2 3

Linux Foundation Survey Shows Companies Desperate To Hire Open-Source Talent
by Peter Reutemann 21 Sep '21

21 Sep '21

'ZDNet reports: At the Open Source Summit in Seattle, The Linux Foundation, and edX, the leading massive open online course (MOOC) provider released the 2021 Open Source Jobs Report. In this survey of 200 technical hiring managers and 750 open-source pros, the organizations found more demand for top open-source workers than ever. On top of that, 92% of managers are having trouble finding enough talent and many of them are also having fits holding on to their existing senior open-source staffers. In short, if you've got open-source skills, whether you're a developer, a sysadmin, a DevOps expert, or a cloud-native pro, there's a good-paying job waiting for you out there. And, where before the Covid-19 pandemic, you might have been stuck with only jobs in your area, these days, thanks to the rise of working from home, you can still live at the old homestead instead of moving to Silicon Valley or Manhattan. On top of this 50% of employers surveyed stated they are increasing hires this year. The jobs are out there. The difficulty for companies is, as 92% of managers report, finding enough talent and hanging onto existing talent in the face of fierce competition. This is especially true for cloud-native application development and operations skills. Cloud-native tops the list of skills needed with over 46% of hiring managers looking for people with Kubernetes smarts. Indeed, for the first time in the survey's history, cloud and container technology skills are more in demand by hiring managers than Linux. Indeed, cloud and container skills rank far above Linux in this go around with 41% over 32%. [T]he survey also found that DevOps has become the standard method for developing software: Virtually all open-source professionals (88%) report using DevOps practices in their work, a 50% increase from three years ago. In other words, it's all DevOps all the time. "The survey also revealed that a majority of employers, 88%, now say that hiring certified professionals is a priority," the report adds. "That's an 87% increase in only three years, 57% in 2020, and 47% in 2018." Sadly, discrimination has also become more of an issue. "18% of open-source professionals now report they have been discriminated against or made to feel unwelcome in the community," the report says. "That's a 125% increase over the past three years."' -- source: https://news.slashdot.org/story/21/09/20/2031215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Home Computing Pioneer Sir Clive Sinclair Dies Aged 81
by Peter Reutemann 20 Sep '21

20 Sep '21

'Sir Clive Sinclair, the man behind the Sinclair Spectrum and the first computer to retail for under a hundred dollars (the Sinclair ZX-81, A.K.A. The Timex/Sinclair 1000), died September 15 after battling a long illness. His daughter, Belinda, said he died at home in London on Thursday morning after a long illness. Sinclair invented the pocket calculator but was best known for popularising the home computer, bringing it to British high-street stores at relatively affordable prices. Many modern-day titans of the games industry got their start on one of his ZX models. For a certain generation of gamer, the computer of choice was either the ZX Spectrum 48K or its rival, the Commodore 64. Belinda Sinclair, 57, told the Guardian: "He was a rather amazing person. Of course, he was so clever and he was always interested in everything. My daughter and her husband are engineers so he'd be chatting engineering with them." He left school at 17 and worked for four years as a technical journalist to raise funds to found Sinclair Radionics.' -- source: https://news.slashdot.org/story/21/09/16/1936235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Mozilla Experiment: Set Default Search Engine to Bing for 1% of Firefox Users
by Peter Reutemann 20 Sep '21

20 Sep '21

'"Mozilla is running an experiment on 1% of the Firefox desktop population currently, which sets the default search engine to Bing in the web browser," reports Ghacks: [I]n most regions, it is Google Search. Mozilla and Google extended the search deal in 2020 for another three years. Google is paying Mozilla "between $400 and $450 million per year" so that its search engine is the default in Firefox in most regions. Google has been Firefox's default search engine since 2017, when Mozilla ended its search deal with Yahoo early. Firefox users may change the default search engine to one of the other engines that are included by default, or an engine that is not included but can be added... The study started on September 6 and it will run until early 2022, likely January 2022. About 1% of Firefox desktop users may notice that the default search engine is changed when the installation of Firefox is picked for the experiment. Tip: load about:studies in the Firefox address bar to list the studies that the browser us currently taking part in and has completed already. Firefox users who don't want to participate in studies can disable the preference "Allow Firefox to install and run studies" on about:preferences#privacy. ' -- source: https://news.slashdot.org/story/21/09/18/1914227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is 2021 The Year of the Linux Desktop?
by Peter Reutemann 20 Sep '21

20 Sep '21

'"2021 Is the Year of Linux on the Desktop," writes PC Magazine. "No, really..." Walk into any school now, and you'll see millions of Linux machines. They're called Chromebooks. For a free project launched 30 years ago today by one man in his spare time, it's an amazing feat.... Linux found its real niche — not as a political statement about "free software," but as a practical way to enable capable, low-cost machines for millions... Chrome OS and Android are both based on the Linux kernel. They don't have the extra GNU software that distributions like Ubuntu have, but they're descended from Linus Torvalds' original work. Chromebooks are the fastest growing segment of the traditional PC market, according to Canalys. IDC points out that Canalys' estimates of 12 million Chromebooks shipped in Q1 2021 are only a fraction of the 63 million notebooks sold that quarter, but once again, they're where the growth is. Much of that is driven by schools, where Chromebooks dominate now. Schoolkids don't generally need a million apps' worth of generic computing power. They need inexpensive, rugged ways to log into Google Classroom. Linux came to the rescue, enabling cheap, light, easy-to-manage PCs that don't have the Swiss Army Knife cruft of Windows or the premium price of Macs... One great thing about open-source hacker projects is that they can be taken in unexpected directions. Linux isn't controlled, so it can adapt, Darwinian-style. It was a little scurrying mammal in the time of the dinosaurs, and then the mobile-computing asteroid hit. Linux could evolve. Windows couldn't. When you're building something that fits in your hand and has to sip battery, you can't just keep throwing processors and storage at it. Microsoft had a tough time adapting its monstrous megakernel OS to the new, tiny world. But *nix platforms thrive there: Android (based on Linux) and iOS. "Android and Chrome water down the Linux philosophy," the article argues, "but they are Linux..." Does this make any long-time geeks feel vindicated? In the original submission wiredog (Slashdot reader #43,288) looks back to 1995, remembering that "my first Linux was RedHat 2.0 in the beige box, running the 0.95(?) kernel and the F Virtual Window Manager... "It came with 2 books, a CD, and a boot floppy disk."' -- source: https://linux.slashdot.org/story/21/09/18/0050255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hi, I have parcels going missing. Does anyone know of technology to trace parcels?
by Michelle 18 Sep '21

18 Sep '21

It would presumably use GPS. It would involve a very small device put in the parcel that a thief would very possibly not even see when the parcel is scanned at customs. The icing on the cake would be if the route of the parcel was able to be recorded as evidence. I will give more details later like it going on for 3 months and involving parcels posted in NZ as well. But this is trial run email because I haven't posted in a long time and I want to make sure I am doing it right. I am hoping that if anyone replies to this that there is a convenient reply to button or link that I can reply back to. Oh well, after I send this email I want to go to the site and see if it has posted. Thanks for any help.

5 13

Ransomware Scammers Preying On Krita Users
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

Some ne’er-do-wells are targeting users of the open-source paint app Krita, purporting to offer payment for advertising the app on their YouTube channels. But when they download the referenced media “asset” pack, they get a ransomware attack instead. <https://www.theregister.com/2021/09/14/krita_users_targeted_by_ransomware/>

1 0

UN Calls For Moratorium On AI That Threatens Human Rights
by Lawrence D'Oliveiro 16 Sep '21

16 Sep '21

The UN human rights office has released a report <https://www.aljazeera.com/economy/2021/9/15/warning-of-risk-un-rights-chief…> on the risks of AI technologies to human rights. Its head, Michelle Bachelet, wants safeguards against the abuse of such technologies before they get too widely deployed. Such technologies are increasingly being used for automated decision making by both companies and governments, in ways that can impact people’s lives in a major way: for example, to control access to social security benefits, health, education, or to identify criminal suspects for arrest. When mistakes are made in these areas, the consequences can be catastrophic for the individuals concerned. And the tendency to secrecy on the part of those using such technologies doesn’t help.

1 0

More On The NZ Reserve Bank Breach
by Lawrence D'Oliveiro 15 Sep '21

15 Sep '21

Seems hackers broke into a secure file-sharing service called Accellion, based in California. The RBNZ was using that to exchange documents with the likes of banks and insurance companies. <https://www.stuff.co.nz/business/123911764/reserve-bank-reveals-more-detail…>

2 5

Travis CI flaw exposed secrets of thousands of open source projects
by Peter Reutemann 15 Sep '21

15 Sep '21

'A security flaw in Travis CI potentially exposed the secrets of thousands of open source projects that rely on the hosted continuous integration service. Travis CI is a software-testing solution used by over 900,000 open source projects and 600,000 users. A vulnerability in the tool made it possible for secure environment variables—signing keys, access credentials, and API tokens of all public open source projects—to be exfiltrated. Worse, the dev community is upset about the poor handling of the vulnerability disclosure process and the brief "security bulletin" it had to force out of Travis.' -- source: https://arstechnica.com/information-technology/2021/09/travis-ci-flaw-expos… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Day, Another DDoS ...
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A bunch of NZ banks, also NZ Post and MetService, are currently having online trouble <https://www.nzherald.co.nz/business/live-cyber-attack-fears-kiwibank-anz-nz…>. For Kiwibank, this is about the second or third outage this week.

1 1

PHP maintains an enormous lead in server-side programming languages
by Peter Reutemann 14 Sep '21

14 Sep '21

'The venerable web programming language PHP is a source of frequent complaints and frustration, but according to a report W3Techs released today, it doesn't seem to be going away anytime soon. W3Techs' web server survey looks for technologies in use by sites in Alexa's top 10 million list; today's report includes a year-on-year chart beginning with January 2010, running all the way through 2021. The survey only includes top sites not out of elitism, but as one part of its effort to avoid data-skewing returns from domain-parking services and spammers, which would otherwise dominate legitimate websites through sheer volume. Within that dataset, the story told is clear. Apart from PHP—which held a 72.5 percent share in 2010 and holds a 78.9 percent share as of today—only one other server-side language ever broke a 10 percent share. That one competitor is ASP.NET, which held an impressive 24.4 percent share in 2010 but was down to 9.3 percent in January and 8.3 percent this month. Amongst the small fry, the only truly impressive growth to be seen is in Ruby—which at 5.2 percent this month is still seeing continued, uninterrupted growth in W3Techs' survey. This might come as a shock if you're mostly familiar with Ruby on Rails, which itself remains viable but seems to be on the decline in popularity.' -- source: https://arstechnica.com/gadgets/2021/09/php-maintains-an-enormous-lead-in-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EU Study On Impact Of Open Source
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

The European Commission’s Directorate-General for Communications Networks, Content and Technology has released a report <https://www.theregister.com/2021/09/13/eu_open_source_study_highlights/> on the economic impact of open source, both software and hardware, within the EU. The report’s authors talked to companies and developers, looked at existing research, surveyed repos on GitHub and ran economic analyses, among other things. Conclusion: there is economic value in open source, but corresponding business investment in it is lacking (though smaller companies tend to be better at this). Also adoption in the public sector can be quite difficult. Further conclusion: if businesses are happy to take but not so keen to give back, then it may be up to Government to give them a nudge in the right direction. One of the authors offered this encouragement: "There are companies that do see the value of contributing back, and some less so… those companies that contribute a lot and are very active in communities see that as an advantage, because when you contribute to it, you can also steer it, know how to fix it… if you have standing in that community, you are more likely to have the community respond to your need."

1 0

Facebook’s Special Rules For VIPs
by Lawrence D'Oliveiro 14 Sep '21

14 Sep '21

A report on some leaked documents <https://arstechnica.com/tech-policy/2021/09/leaked-documents-reveal-the-spe…> detailing Facebook’s “XCheck” system for exempting certain user accounts from its normal content-moderation rules. The sole reason for the exemption is that, regardless of the rights and wrongs of what they are saying, such users (e.g. politicians, celebrities) can raise a PR storm that can make Facebook look bad, and of course the company wants to avoid that. Except that the list of such special users has now grown to about 5.8 million accounts, which is getting a bit unwieldy. Note this: In the meantime, Facebook plans to assume “good intent” on the part of high-profile users in the program and take an approach of “innocent until proven guilty,” a product manager on Facebook’s Mistakes Prevention Team wrote. Does that sound like basic fairness, rather than arbitrary treatment, to you? If only all their users were treated that way ...

1 0

Mozilla Has Defeated Microsoft's Default Browser Protections in Windows
by Peter Reutemann 14 Sep '21

14 Sep '21

'Mozilla has quietly made it easier to switch to Firefox on Windows recently. From a report: While Microsoft offers a method to switch default browsers on Windows 10, it's more cumbersome than the simple one-click process to switch to Edge. This one-click process isn't officially available for anyone other than Microsoft, and Mozilla appears to have grown tired of the situation. In version 91 of Firefox, released on August 10th, Mozilla has reverse engineered the way Microsoft sets Edge as default in Windows 10, and enabled Firefox to quickly make itself the default. Before this change, Firefox users would be sent to the Settings part of Windows 10 to then have to select Firefox as a default browser and ignore Microsoft's plea to keep Edge. Mozilla's reverse engineering means you can now set Firefox as the default from within the browser, and it does all the work in the background with no additional prompts. This circumvents Microsoft's anti-hijacking protections that the company built into Windows 10 to ensure malware couldn't hijack default apps. Microsoft tells us this is not supported in Windows.' -- source: https://news.slashdot.org/story/21/09/13/1527222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Merges Support for Microsoft's NTFS File System, Complains GitHub 'Creates Absolutely Useless Garbage Merges'
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Linux creator Linus Torvalds has agreed to include Paragon Software's NTFS3 kernel driver, giving the Linux kernel 5.15 release improved support for Microsoft's NTFS file system..." reports ZDNet, adding that the driver "will make working with Windows' NTFS drives in Linux an easier task — ending decades of difficulties with Microsoft's proprietary file system that succeeded FAT...." "But he also had some process and security lessons to offer developers about how to code submissions to the kernel should be made." "I notice that you have a GitHub merge commit in there," wrote Torvalds. He continued: "That's another of those things that I *really* don't want to see — GitHub creates absolutely useless garbage merges, and you should never ever use the GitHub interfaces to merge anything...GitHub is a perfectly fine hosting site, and it does a number of other things well too, but merges are not one of those things." Torvalds' chief problem with it was that merges need "proper commit messages with information about [what] is being merged and *why* you merge something." He continued: "But it also means proper authorship and committer information etc. All of which GitHub entirely screws up." TechRadar supplies some more context: One of the shortcomings Torvalds highlighted are GitHub's concise, factually correct, but functionally useless, commit messages. For instance, GitHub's commit message for Paragon's merge read "Merge branch 'torvalds:master' into master", which didn't impress Torvalds one bit... Torvalds also had some pertinent security advice, perhaps useful in light of recent software supply chain cyberattacks that the Linux Foundation wants to address by improving supply chain integrity through tools that make it easier to sign software cryptographically. As Torvalds points out, this is particularly important for new contributors to the Linux kernel. "For GitHub accounts (or really, anything but kernel.org where I can just trust the account management), I really want the pull request to be a signed tag, not just a plain branch," Torvalds explains... Torvalds suggests Paragon do future merges from the command-line.' -- source: https://linux.slashdot.org/story/21/09/11/2316216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Apple Silicon Macs Gets Closer To Reality
by Peter Reutemann 13 Sep '21

13 Sep '21

'"Asahi Linux for Apple M1 Macs is moving closer to reality," writes Slashdot reader TroysBucket. An Asahi developer posted a detailed status update on Twitter. Linux enthusiast Bryan Lunduke offers this succinct summary: - The Asahi Linux team has Linux (Debian, in this case) booting and usable with network support. - They now have (very early) display drivers which "take full advantage of the display hardware." - They have at least two base distributions — both Arch and Debian — working and functional (to some extent). They also have, according to their latest update, "boot picker" support so that you can manually select which OS / Drive to boot from on the M1 Macs... I, for one, can't wait to see the first public, functional release of Asahi Linux — and will be following it extremely closely.' -- source: https://linux.slashdot.org/story/21/09/12/0044227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Strange Tale of the Freedom Phone
by Peter Reutemann 08 Sep '21

08 Sep '21

'A 22-year-old Bitcoin millionaire wants Republicans to ditch their iPhones for a low-end handset that he hopes to turn into a political tool. From a report: It was a pitch tuned for a politically polarized audience. Erik Finman, a 22-year-old who called himself the world's youngest Bitcoin millionaire, posted a video on Twitter for a new kind of smartphone that he said would liberate Americans from their "Big Tech overlords." His splashy video, posted in July, had stirring music, American flags and references to former Presidents Abraham Lincoln and Donald J. Trump. Conservative pundits hawked Mr. Finman's Freedom Phone, and his video amassed 1.8 million views. Mr. Finman soon had thousands of orders for the $500 device. Then came the hard part: Building and delivering the phones. First, he received bad early reviews for a plan to simply put his software on a cheap Chinese phone. And then there was the unglamorous work of shipping phones, hiring customer-service agents, collecting sales taxes and dealing with regulators. "I feel like practically I was prepared for anything," he said in a recent interview. "But I guess it's kind of like how you hope for world peace, in the sense you don't think it's going to happen." For even the most lavishly funded start-ups, it is hard to compete with tech industry giants that have a death grip on their markets and are valued in the trillions of dollars. Mr. Finman was part of a growing right-wing tech industry taking on the challenge nonetheless, relying more on their conservative customers' distaste for Silicon Valley than expertise or experience. [...] To make a smartphone, however, he had to rely on Google. The company's Android software already works with millions of apps, and Google makes a free, open version of the software for developers to modify. So Mr. Finman hired engineers to strip it of any sign of Google and load it with apps from conservative social networks and news outlets. Then he uploaded the software on phones he bought from China. To unveil the phone, he recorded an infomercial in which he cast the tech companies as enemies of the American way. "Imagine if Mark Zuckerberg banned MLK or Abraham Lincoln," he said in the video. "The course of history would have been altered forever." [...] Thousands of people bought the $500 phone. Others, including some conservatives, quickly panned the animated pitch. Quickly, news outlets reported that the Freedom Phone was based on a low-cost handset from Umidigi, a Chinese manufacturer that had used chips shown to be vulnerable to hacks. Mr. Finman, who marketed the device as "the best phone in the world," was on the defensive. In an interview in July, Mr. Finman admitted that Umidigi made the phone but still said he was "100 percent" sure it was more secure than the latest iPhone. Apple has tens of thousands of engineers. Mr. Finman said he employed 15 people in Utah and Idaho.' -- source: https://hardware.slashdot.org/story/21/09/07/1450242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Zero-Day Allows Full Server Compromises
by Peter Reutemann 08 Sep '21

08 Sep '21

'Proof-of-concept exploit code was published online over the weekend for an unpatched Ghostscript vulnerability that puts all servers that rely on the component at risk of attacks. From a report: Published by Vietnamese security researcher Nguyen The Duc, the proof-of-concept code is available on GitHub and was confirmed to work by several of today's leading security researchers. Released back in 1988, Ghostscript is a small library that allows applications to process PDF documents and PostScript-based files. While its primary use is for desktop software, Ghostscript is also used server-side, where it is typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick. The proof-of-concept code released by Nguyen on Sunday exploits this latter scenario, allowing an attacker to upload a malformed SVG file that escapes the image processing pipeline and runs malicious code on the underlying operating system. While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability.' -- source: https://it.slashdot.org/story/21/09/07/1532205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Jokes About Celebrations for Linux's 30th Anniversary
by Peter Reutemann 05 Sep '21

05 Sep '21

'Despite Linux reaching its 30th anniversary, "most outside the tech industry will be unaware that Linux has reached such a milestone," writes ZDNet, "even though the project has had a huge impact on everything from smartphones to cloud computing." They add that Linus Torvalds "poked fun at that lack of recognition in his usual Sunday release note for a new stable version of the Linux kernel." "So I realize you must all still be busy with all the galas and fancy balls and all the other 30th anniversary events, but at some point you must be getting tired of the constant glitz, the fireworks, and the champagne," Torvalds said. "That ball gown or tailcoat isn't the most comfortable thing, either. The celebrations will go on for a few more weeks yet, but you all may just need a breather from them." Linux 5.14 includes additional features for Intel's Alder Lake mobile-ready CPUs, extra AMD support and better support for the Raspberry Pi 400 PC. "Because 5.14 is out there, just waiting for you to kick the tires and remind yourself what all the festivities are about," notes Torvalds... Torvalds is upbeat about Linux's future, predicting decades more work for the kernel's several thousand contributors who help shape the Linux kernel and drivers. "Of course, the poor tireless kernel maintainers won't have time for the festivities, because for them, this just means that the merge window will start tomorrow. We have another 30 years to look forward to, after all. But for the rest of you, take a breather, build a kernel, test it out, and then you can go back to the seemingly endless party that I'm sure you just crawled out of," he wrote.' -- source: https://linux.slashdot.org/story/21/09/04/2037241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vocus DDoS
by Lawrence D'Oliveiro 04 Sep '21

04 Sep '21

Vocus, which owns Orcon, Slingshot, Flip and Stuff Fibre (totalling 15% of NZ broadband users), has suffered a DDoS attack, possibly still ongoing <https://www.nzherald.co.nz/nz/widespread-internet-outages-across-nz-vocus-h…>. Users in Auckland, Wellington and Christchurch were affected from 1:30pm, though some reported services returning by 2:10pm. This has also hit EFTPOS payments.

2 2

Cloudflare Says Intel is Not Inside Its Next-Gen Servers
by Peter Reutemann 02 Sep '21

02 Sep '21

'Internet-grooming company Cloudflare has revealed that it was unable to put Intel inside its new home-brew servers, because they just used too much energy. A Tuesday post by platform operations engineer Chris Howells reveals that Cloudflare has been working on designs for an eleventh-generation server since mid-2020. jaa101 writes: "We evaluated Intel's latest generation of 'Ice Lake' Xeon processors," Howells wrote. "Although Intel's chips were able to compete with AMD in terms of raw performance, the power consumption was several hundred watts higher per server -- that's enormous." Fatally enormous -- Cloudflare's evaluation saw it adopt AMD's 64-core Epyc 7713 for the servers it deploys to over 200 edge locations around the world. Power savings also influenced a decision to go from three disks to two in the new design. A pair of 1.92TB Samsung drives replaced the three of the Korean giant's 960GB units found in previous designs. The net gain was a terabyte of capacity, and six fewer watts of power consumption. Howellls's post also reveals that testing produced data showing that equipping its servers with 512GB of RAM did not produce enough of a performance boost to justify the expense. The company has therefore settled on 384GB of memory, but did jump from DDR4-2933 to DDR4-3200 as the slight cost increase delivered a justifiable performance boost.' -- source: https://slashdot.org/story/21/09/01/1917257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

On-Prem Windows Server: Are Its Days Numbered?
by Lawrence D'Oliveiro 31 Aug '21

31 Aug '21

Microsoft has released yet another typically confusing update on the future of its family of Windows Server products <https://www.theregister.com/2021/07/28/windows_server_2022_sac/>. What’s clear from the details is that development is primarily going into the cloudy versions of Windows Server, with those who prefer to manage their own instances on their own hardware being increasingly left behind: At a high level, it seems that Microsoft is investing in Azure and [Azure Kubernetes Service], and that on-premises Windows Server users are in some respects being left behind. It is notable, for example, that Active Directory's functional level has not changed since Windows Server 2016, and this remains the case in Server 2022. ... SMB over QUIC, which promises secure access to Windows file shares from anywhere, is another key feature which will be available only in Windows Server Azure Edition. The article notes that on-prem Windows Server being slowly moved to the back burner in this way “will not go down well with on-premises users, nor perhaps with rival clouds running Windows Server”. But then again, given that Microsoft’s own cloud offerings are predominantly Linux-based, I can’t see other cloud services doing any better with Windows.

1 2

ESR On GitHub
by Lawrence D'Oliveiro 29 Aug '21

29 Aug '21

NZ’s Institute of Environmental Science and Research (more commonly known as ESR) has a GitHub area at <https://github.com/ESR-NZ>. There are a few repos related to the SARS-CoV-2 virus that causes COVID-19. The data repo <https://github.com/ESR-NZ/NZ_COVID19_Data> in particular shows a nice attitude to openness: the data files are in CSV format, and the licence is CC-BY. I see quite a lot of use of Python and Jupyter there. Also some mention of .xlsx files ... hmmm ...

1 0

Software Microsoft Trusts To Run As Admin
by Lawrence D'Oliveiro 27 Aug '21

27 Aug '21

You may have heard of this security bug involving Razer gaming mice <https://arstechnica.com/information-technology/2021/08/need-to-get-root-on-…>. Basically, when you plug such a mouse into a Windows system, it automatically downloads and runs an installer “wizard”, which opens a File Explorer window to let you choose where to actually put the additional software. However, this File Explorer instance is running with full admin privileges, without the user’s prior knowledge or consent. How does this happen? Because the buggy version of the installer has been accepted as part of Microsoft’s “Windows Catalog”, which means your Windows installation trusts it with extra privileges purely on Microsoft’s say so. As if we needed another reminder that, with a proprietary OS, you are never really in control of your own systems ...

1 0

Happy Birthday, Linux: From a Bedroom Project To Billions of Devices in 30 Years
by Peter Reutemann 26 Aug '21

26 Aug '21

'On August 25, 1991, Linus Torvalds, then a student at the University of Helsinki in Finland, sent a message to the comp.os.minix newsgroup soliciting feature suggestions for a free Unix-like operating system he was developing as a hobby. Thirty years later, that software, now known as Linux, is everywhere. From a report: It dominates the supercomputer world, with 100 per cent market share. According to Google, the Linux kernel is at the heart of more than three billion active devices running Android, the most-used operating system in the world. Linux also powers the vast majority of web-facing servers Netcraft surveyed. It is even used more than Microsoft Windows on Microsoft's own Azure cloud. And then there are the embedded electronics and Internet-of-Things spaces, and other areas. Linux has failed to gain traction among mainstream desktop users, where it has a market share of about 2.38 per cent, or 3.59 per cent if you include ChromeOS, compared to Windows (73.04 per cent) and macOS (15.43 per cent). But the importance of Linux has more to do with the triumph of an idea: of free, open-source software. "It cannot be overstated how critical Linux is to today's internet ecosystem," Kees Cook, security and Linux kernel engineer at Google, told The Register via email. "Linux currently runs on everything from the smartphone we rely on everyday to the International Space Station. To rely on the internet is to rely on Linux." The next 30 years of Linux, Cook contends, will require the tech industry to work together on security and to provide more resources for maintenance and testing.' -- source: https://linux.slashdot.org/story/21/08/25/1751220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Software For Estimating Fertilizer, Effluent Leaches From Farmland Is Flawed
by Lawrence D'Oliveiro 23 Aug '21

23 Aug '21

In a report in this evening’s TV1 news, NZ farmers have been using a piece of software to help them estimate their environmental groundwater impact that, according to some reports, is giving wildly inaccurate results <https://1news.co.nz/one-news/new-zealand/software-estimating-much-fertilise…>. The minister is looking into whether it can be fixed, or whether it needs to be replaced. Given its taxpayer funding (at least in part), why isn’t it open-sourced? Stick it on GitHub, and watch the hordes of would-be fixers descend. ;)

2 3

Level 4
by Peter Reutemann 22 Aug '21

22 Aug '21

Hi everyone With NZ going into level 4 at midnight, we will follow the guidelines that the government and university implement next week. If we shouldn't be able to meet in person, we can fall back on a virtual meeting via BigBlueButton. Well keep you posted. Stay safe everyone! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/.

2 3

Musings On Symlinks And Security
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

I published a Blender addon <https://github.com/ldo/blendgit/> that lets you use Git to track versions of Blender documents and associated files. This addon makes heavy use of both hard links and symlinks in order to set up the directory tree snapshots correctly. Every now and then a Windows user tries to run it, and it fails for them with the peculiar error “symbolic link privilege not held”. It seems Microsoft added the ability to create symlinks in Windows back around the time of Windows Vista or 7 or so. But it puts a major obstacle in the way of users attempting to use this facility: you need to enter yourself into a special privilege group <https://social.msdn.microsoft.com/Forums/en-US/cf9d0948-b80e-436e-b5c4-8ca8…>. Or take the standard Windows lazy way out, and simply “run as administrator”. On Linux and other POSIXy systems, creating links is just a routine operation; why does Windows treat it as such a sensitive issue? In fact, even in the POSIX world, symbolic links can be a source of security problems <https://en.wikipedia.org/wiki/Symlink_race>. Symlinks were invented at the University of California at Berkeley way back in the early days of their BSD work, and the security implications only became apparent later. By that time, I think, they had become so useful and commonplace that no one wanted to get rid of them. So the workarounds were created, as the holes were uncovered. These days, the techniques have become commonplace, embedded in various library/system routines that will work securely without you having to give them a second thought. But on Windows, the whole concept is still new and untried (even after over a decade!). Very few people know how to use them, because when they try, they encounter the privilege restrictions, and that puts them off. And so the application developers hardly ever encounter the need to deal with them. And so they never become a commonplace facility that application software can be trusted to deal with.

1 0

SerenityOS: Homage To The 1990s
by Lawrence D'Oliveiro 19 Aug '21

19 Aug '21

Here <https://arstechnica.com/gadgets/2021/08/not-a-linux-distro-review-serenityo…> is a review of SerenityOS, a complete open-source POSIXy OS that does not use any GNU, Linux or BSD code. The review spends a lot of time on the GUI, which is consciously designed around a 1990s aesthetic. As usual, this sort of thing leaves me wondering “you could implement that whole look and feel on top of a Linux kernel, so why make your own?”. Then, further down, we get to this: Some of the paradigm shifts Kling and fellow contributors have introduced are neither weird nor trivial, though. SerenityOS's kernel, for example, exposes its internals as JSON rather than unstructured text. System utilities consuming kernel information therefore have a much simpler time of formatting it for display and/or internal decisions. Aha! Now there is something which could very well have a point. Though the Linux approach is to have the information exposed in these kernel pseudo-files in a simple (not unstructured!) text format that is both easy to parse and also somewhat comprehensible to a human viewer (which is harder to say of JSON). If you want to pass around object streams in a Linux command line, jq <https://github.com/stedolan/jq> is available as a standard Debian package, for doing precisely this sort of manipulation of JSON-formatted data. (Is that someone in Microsoft’s PowerShell group saying “I told you so!” ... ?)

1 0

Google's Fuchsia OS Is Rolling Out Widely To 1st-Gen Nest Hubs
by Peter Reutemann 19 Aug '21

19 Aug '21

'More owners of the first-generation Nest Hub are receiving the update to Google's Fuchsia operating system as it expands beyond the Preview program. 9to5Google reports: Back in May, Google formally released Fuchsia, its effort to develop a "not Linux" operating system from scratch, which has been years in the making. The first device to receive the new OS was Google's 2018 smart display, the Nest Hub -- not to be confused with the second generation Nest Hub with sleep tracking released earlier this year -- taking it permanently off of the existing Linux based "Cast OS" without negatively affecting the UI or experience. At the time, the rollout of Fuchsia was limited to a select few devices that were enrolled in the "Preview program" available to all devices via the Google Home app. Over time, the number of Nest Hubs running Fuchsia was expanded, with Google no doubt watching carefully for any issues with the upgrade. Late last week, Google updated a support page to reflect that the Nest Hub has received a new firmware update for both the Preview program and all other devices. Specifically, the first-gen Nest Hub is now receiving firmware version 1.52.260996. Google confirmed to us that this update does indeed include the upgrade to Fuchsia. All goes well, this means in a matter of days, all first-gen Nest Hub devices in households around the world should be running Fuchsia. ' -- source: https://tech.slashdot.org/story/21/08/18/2056255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firewalls and Middleboxes Can Be Weaponized For Gigantic DDoS Attacks
by Peter Reutemann 18 Aug '21

18 Aug '21

'In an award-winning paper last week, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet. Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations. Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.' -- source: https://it.slashdot.org/story/21/08/17/1941202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Glibc Security Fix Created a Nastier Linux Bug
by Peter Reutemann 17 Aug '21

17 Aug '21

'A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops. Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc. In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher. ' -- source: https://it.slashdot.org/story/21/08/16/2131221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 11 'Bullseye' Released As Stable
by Peter Reutemann 16 Aug '21

16 Aug '21

'"One of the oldest and most renowned distributions of Linux has been released!" âwrites Slashdot reader Washuu2. Phoronix reports it took "just over two years in development." Debian 11 brings many new features as outlined this morning with the big upgrade to Linux 5.10 LTS, exFAT file-system support, control groups v2, yescrypt for password hashing, and a plethora of updated packages. GNOME 3.38, KDE Plasma 5.20, and Xfce 4.16 are among the desktop options for Debian 11. Debian.org adds: Do you want to celebrate the release? We provide some bullseye artwork that you can share or use as base for your own creations. Follow the conversation about bullseye in social media via the #ReleasingDebianBullseye and #Debian11Bullseye hashtags... Around the world, there were even several in-person and online release parties — with a few more upcoming!' -- source: https://linux.slashdot.org/story/21/08/15/171228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting this month
by Peter Reutemann 16 Aug '21

16 Aug '21

Hi everyone At this stage, we don't have any talk(s) lined up for our meeting this month. Anybody feeling like a quick show and tell about some software or project that they've been working on lately? Or another topic that they'd like to discuss? Thanks! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

“Androids”: A History Of The Development Of The Android Operating System
by Lawrence D'Oliveiro 15 Aug '21

15 Aug '21

Chet Haase, one of the Android engineers, has published a book called “Androids”, giving an account of the early development of the mobile OS. A review is here <https://arstechnica.com/gadgets/2021/08/review-androids-is-a-developer-comm…>, and an excerpt is here <https://arstechnica.com/information-technology/2021/08/excerpt-the-history-…>. Before Android the company got acquired by Google, they were shopping themselves around to various groups of venture capitalists. From the beginning, the platform was going to be built on Open Source components like the Linux kernel. So how were they going to make money, if the main part of the platform was being given away for free? The initial answer was to offer paid-for services that would be resold by the carriers. This whole idea went away after the Google acquisition. Interesting to review the state of play at the time Android Inc were pitching their new OS: Symbian had some support from different vendors, but surprisingly (to me, at least), it left the whole UI layer up to the device maker, with no attempt at standardization between vendors. How were you to write portable apps in that situation? No wonder it had limited uptake. Sun were offering Java ME for mobile devices, but again, this was subject to differing, not-quite-compatible “profiles” for different devices, further complicating the headache of writing code to run across those devices. As I understand it, it also ran just a single Java VM on the device which had to be shared across all applications, which made it totally unsuited to a modern multitasking OS. The Hiptop device from Danger, Inc also gets a mention. Not a few people considered it probably the best mobile device to come out up to that point. Not mentioned in the above is that Microsoft acquired Danger. But because its platform was built on Java, which Microsoft had an allergy to, they wasted 18 months of product development time excising the Java dependency, totally losing the window of opportunity for releasing a new device. When the Kin finally came out, it probably held the world record for some product category for the shortest time on the market before being heavily discounted in clearance sales (about a month). One key point is that, when Google acquired Android, they continued to let it run like an independent company, at least for the first few years. This allowed the innovation to continue to flourish ... at least for a while.

1 0

Fwd: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022
by Peter Reutemann 13 Aug '21

13 Aug '21

Apologies for cross-posting, but you might be interested in the call for papers outlined below. Cheers, Peter ---------- Forwarded message --------- From: Simon Lyall <simon(a)darkmere.gen.nz> Date: Thu, Aug 12, 2021 at 11:29 PM Subject: [NZLUG] Call for Proposals - Sysadmin Miniconf at Linux.conf.au 2022 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> The Call for Proposals is now up for the Sysadmin Miniconf at Linux.conf.au 2022. The Miniconf is on January 14th and the rest of the conference is the 2 days afterwards. All events are online. We are looking for 30 minute long Operations-related talks. We'd particularly love your War Stories about responding to the global pandemic and general work for home, or how you avoided earning war stories. The good news is that all talks accepted to the Miniconf get a free ticket for the whole of the conference! The bad news is that the CFP closes in just over 3 weeks from now on September 5th. So don't delay getting your proposal in. See our long CFP for more details: https://sysadmin.miniconf.org/cfp22.html Then Register and Login the the Conference dashboard to submit a proposal: https://linux.conf.au/dashboard -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Centralization Versus Decentralization On The Internet
by Lawrence D'Oliveiro 12 Aug '21

12 Aug '21

A thoughtful, at times somewhat technical article <https://www.theregister.com/2021/08/11/decentralized_internet/> on the original philosophy of the designers of the Internet that nothing should be centralized, and how that was modified somewhat with the concept of “Software-Defined Networking”, without compromising the robustness of a decentralized underlying framework. The World-Wide Web, on the other hand, is a very different matter: rampant centralization, not just at the level of social-media networks and cloud services, but also at the lower layer of “Content-Delivery Networks” (CDNs) has led to the creation of way too many of what the engineers call SPOFs (“Single Points Of Failure”), where a breakdown in any of these can lead to a complete failure of any number of services that have become crucially dependent on them. Is the pendulum swinging away from centralization now? The author seems to think so; but I suspect the fat profit margins are still driving things in the wrong direction.

1 0

Firefox 91 Pushes Privacy With Stronger New Cookie-clearing Option
by Peter Reutemann 11 Aug '21

11 Aug '21

'WIth the release of Firefox 91 on Tuesday, Mozilla has introduced a bigger hammer for smashing the cookies that websites, advertisers and tracking companies can use to record your online behavior. From a report: The new feature, called enhanced cookie clearing, is designed to block tracking not just from a website, but also from third parties whose code appears on the site. The technology is designed to let you clear cookies for a particular website but also the more aggressive "supercookies" designed to evade lesser privacy protections. The feature is an option if you enable Firefox's strict mode for cookie handling, which partitions website data into separate storage containers. "You can easily recognize and remove all data a website has stored on your computer, without having to worry about leftover data from third parties embedded in that website," Mozilla said in a blog post. ' -- source: https://news.slashdot.org/story/21/08/10/1637219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." Just been looking at the DMARC overview <https://dmarc.org/overview/>, and I think there is some confusion here. What the University is doing is changing the recommended action for other MTAs receiving mail purporting to come _from_ the waikato.ac.nz domain, not the action it takes on receiving mail sent _to_ the waikato.ac.nz domain. In other words, this shouldn’t really make any difference to members of this list. If the systems that pick up their mail do DMARC checks, this shouldn’t matter (assuming the Uni sysadmins haven’t misconfigured anything ;)); if they don’t, it doesn’t matter anyway.

2 1

Re: DMARC enforced
by Lawrence D'Oliveiro 09 Aug '21

09 Aug '21

On Mon, 9 Aug 2021 13:09:11 +1200, Peter Reutemann via wlug wrote: > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." What was the effect of “quarantine” before? Would it have been causing delays in posts getting through? (Because I don’t think I noticed any on mine.) On a further look, I found the following header line in the echo of my last posting back to myself: spf=pass (google.com: best guess record for domain of ldo(a)geek-central.gen.nz designates 72.249.182.57 as permitted sender) So it seems like Google’s algorithms are smart enough to figure out that my mail is coming from an address associated with that domain.

2 1

Re: DMARC enforced
by David McNab 09 Aug '21

09 Aug '21

And for added 'fun' (as opposed to fun), we just need outside senders' mailservers to quietly drop the resulting NDR messages :P On Mon, 9 Aug 2021 at 13:09, Peter Reutemann via wlug < wlug(a)list.waikato.ac.nz> wrote: > > > > ---------- Forwarded message ---------- > From: Peter Reutemann <fracpete(a)waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > Hi everyone > > Just received an email from the IT department: > "The university will be changing the DMARC action for the domain space > waikato.ac.nz from quarantine to reject on Monday 16th August." > > However, for mailing lists they put some mitigation options in place. > > Please let me know if you encounter any problems posting to the WLUG > list (starting next week). > > Cheers, Peter > -- > Peter Reutemann > Dept. of Computer Science > University of Waikato, NZ > +64 (7) 577-5304 > http://www.cms.waikato.ac.nz/~fracpete/ > http://www.data-mining.co.nz/ > > > > ---------- Forwarded message ---------- > From: Peter Reutemann via wlug <wlug(a)list.waikato.ac.nz> > To: wlug List <wlug(a)list.waikato.ac.nz> > Cc: Peter Reutemann <fracpete(a)waikato.ac.nz> > Bcc: > Date: Mon, 9 Aug 2021 13:09:11 +1200 > Subject: [wlug] DMARC enforced > _______________________________________________ > wlug mailing list -- wlug(a)list.waikato.ac.nz | To unsubscribe send an > email to wlug-leave(a)list.waikato.ac.nz > Unsubscribe: > https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz >

1 0

DMARC enforced
by Peter Reutemann 09 Aug '21

09 Aug '21

Hi everyone Just received an email from the IT department: "The university will be changing the DMARC action for the domain space waikato.ac.nz from quarantine to reject on Monday 16th August." However, for mailing lists they put some mitigation options in place. Please let me know if you encounter any problems posting to the WLUG list (starting next week). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Trace Toolkit Next Generation 2.13 Facilitates Quick Reaction To Kernel/User-space Instrumentation Hits
by Peter Reutemann 09 Aug '21

09 Aug '21

'LTTng has been called "the killer app for system-level debugging and performance tuning." And now long-time Slashdot reader compudj writes: It's the official release of LTTng 2.13 — Nordicité! LTTng is a kernel and user-space tracer for Linux. The most notable features of this release are: - Event-rule matches condition triggers and new actions, allowing internal actions or external monitoring applications to quickly react when kernel or user-space instrumentation is hit - Notification payload capture, allowing external monitoring applications to read elements of the instrumentation payload when instrumentation is hit. - Instrumentation API: vtracef and vtracelog (LTTng-UST) - User space time namespace context (LTTng-UST and LTTng-modules).' -- source: https://linux.slashdot.org/story/21/08/07/182213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Fiercely Guards The Privacy Of Its Advertisers
by Lawrence D'Oliveiro 07 Aug '21

07 Aug '21

Facebook has shut down all accounts and access for New York University’s Ad Observatory project <https://www.theregister.com/2021/08/04/facebook_research_lockdown/>. This project was using a browser extension to garner information about ads shown to Facebook users without the cooperation of Facebook itself. However, the project <https://adobservatory.org/> tries to be fully transparent about what it is doing to volunteers who choose to install the extension, and as is common these days, the source code is available on GitHub. Part of Facebook’s excuse is that the extension is somehow scraping information from the website that is “not publicly viewable”. How such information is getting to the user’s browser is not explained. Facebook has its own alternative research platform, called “FORT”, that it makes available to selected researchers on a strictly controlled basis. One of the conditions is that Facebook is given pre-publication access to research papers in order to identify--and remove--information that it considers to be “confidential”. Naturally, this kind of thing rings alarm bells for researchers. Another group has published an open letter <https://freedom-to-tinker.com/2021/08/05/facebooks-illusory-promise-of-tran…> pointing out why this is not an acceptable alternative.

1 1

Firefox Lost Almost 50 Million Users In 3 Years
by Peter Reutemann 05 Aug '21

05 Aug '21

'A report from It's FOSS, written by Ankush Das: Mozilla's Firefox is the only popular alternative to Chromium-based browsers. It has been the default choice for Linux users and privacy-conscious users across every platform. However, even with all benefits as one of the best web browsers around, it is losing its grip for the past few years. I came across a Reddit thread by u/nixcraft, which highlighted more details on the decline in the userbase of Firefox since 2018. And surprisingly, the original source for this information is Firefox's Public Data Report. As per the official stats, the reported number of active (monthly) users was about 244 million at the end of 2018. And, it seems to have declined to 198 million at the end of Q2 2021. So, that makes it a whopping ~46 million decline in the userbase. Considering 2021 is the year when privacy-focused tools saw a big boost in their userbase, Mozilla's Firefox is looking at a constant decline. Especially when Firefox manages to introduce some industry-first privacy practices. Quite the irony, eh? Just for fun, here's a timeline of our stories reporting on Firefox's download milestones from the mid-2000s: September 19, 2004: 1 Million Firefoxes in 4 Days December 12, 2004: Firefox Reaches 10 Million Downloads February 17, 2005: Firefox Breaks 25 Million Downloads April 26, 2005: Firefox nears 50 Million Downloads July 29, 2005: Firefox Downloads Reach 75 Million October 19, 2005: Firefox Tops 100 Million Downloads September 11, 2007: Firefox Hits 400 Million Downloads July 3, 2008: Firefox Breaks 8 Million, Gets Into Guinness' -- source: https://news.slashdot.org/story/21/08/04/2137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To No Longer Show Secure Website Indicators
by Peter Reutemann 04 Aug '21

04 Aug '21

'Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection. Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar. ' -- source: https://tech.slashdot.org/story/21/08/03/2049218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Kill Off Very Old Versions of Android Next Month
by Peter Reutemann 04 Aug '21

04 Aug '21

'Ars Technica: Google has started emailing users of very old Android devices to tell them it's time to say goodbye. Starting September 27, devices running Android 2.3.7 and lower will no longer be able to log in to Google services, effectively killing a big portion of the on-rails Android experience. As Google puts it in an official community post, "If you sign in to your device after September 27, you may get username or password errors when you try to use Google products and services like Gmail, YouTube, and Maps." Android is one of the most cloud-based operating systems ever. Especially in older versions, many included apps and services were tied to your Google login, and if that stops working, a large chunk of your phone is bricked. While Android can update many core components without shipping a full system update today, Android 2.3.7 Gingerbread, released around 10 years ago, was not so modular. The individual Google apps started to be updatable through the Android Market/Play Store, but signing in to Google was still a system-level service and is frozen in time. Any Google services wanting to allow sign-ins from those versions would have to conform to 2011-era security standards, which means turning off two-factor authentication and enabling a special "allow less-secure access" setting in your Google account. Really, these old Android versions have to die eventually because they're just too insecure. Google shows active user base breakdowns for Android versions in Android Studio, and Gingerbread has such a low device count that it doesn't even make the list. It's less than 0.2 percent of active devices, behind 14 other versions of Android. Users of these old devices could still sideload a third-party app store and find replacements for all the Google apps, but if you're a technical user and can't get a new device, there's a good chance you could load a whole new operating system with an aftermarket Android ROM. After September 27, the oldest version of Android you'll be able to sign in to is Android 3.0 Honeycomb, which is only for tablets.' -- source: https://tech.slashdot.org/story/21/08/03/207222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD and Valve Working On New Linux CPU Performance Scaling Design
by Peter Reutemann 03 Aug '21

03 Aug '21

'Along with other optimizations to benefit the Steam Deck, AMD and Valve have been jointly working on CPU frequency/power scaling improvements to enhance the Steam Play gaming experience on modern AMD platforms running Linux. Phoronix reports: It's no secret that the ACPI CPUFreq driver code has at times been less than ideal on recent AMD processors with delivering less than expected performance/behavior with being slow to ramp up to a higher performance state or otherwise coming up short of disabling the power management functionality outright. AMD hasn't traditionally worked on the Linux CPU frequency scaling code as much as Intel does to their P-State scaling driver and other areas of power management at large. AMD is ramping up efforts in these areas including around the Linux scheduler given their recent hiring spree while it now looks like thanks to the Steam Deck there is renewed interest in better optimizing the CPU frequency scaling under Linux. AMD and Valve have been working to improve the performance/power efficiency for modern AMD platforms running on Steam Play (Proton / Wine) and have spearheaded "[The ACPI CPUFreq driver] was not very performance/power efficiency for modern AMD platforms...a new CPU performance scaling design for AMD platform which has better performance per watt scaling on such as 3D game like Horizon Zero Dawn with VKD3D-Proton on Steam." AMD will be presenting more about this effort next month at XDC. It's quite possible this new effort is focused on ACPI CPPC support with the previously proposed AMD_CPUFreq. Back when Zen 2 launched in 2019, AMD did post patches for their new CPUFreq driver that leveraged ACPI Collaborative Processor Performance Controls but the driver was never mainlined nor any further iterations of the patches posted. When inquiring about that work a few times since then, AMD has always said it's been basically due to resource constraints that it wasn't a focus at that time. Upstream kernel developers also voiced their preference to seeing AMD work to improve the generic ACPI CPPC CPUFreq driver code rather than having another vendor-specific solution. It's also possible AMD has been working on better improvements around the now-default Schedutil governor for scheduler utilization data in making CPU frequency scaling decisions. ' -- source: https://hardware.slashdot.org/story/21/08/02/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Mars Helicopter Contributors
by Lawrence D'Oliveiro 03 Aug '21

03 Aug '21

I was looking at some code on GitHub, and I came across a badge I hadn’t seen before on a developer’s account. It turns out it means some of their code was used on NASA’s Mars Ingenuity helicopter <https://github.com/readme/featured/nasa-ingenuity-helicopter>.

1 0

Security Versus Requirements For Internationalization
by Lawrence D'Oliveiro 01 Aug '21

01 Aug '21

Yet another incident <https://arstechnica.com/gadgets/2021/07/with-help-from-google-impersonated-…> of substituting characters with different diacritic marks in a domain name to fool people into visiting the wrong site. Seems this problem is fundamentally unfixable. We need the ability to represent words in non-English languages, simply because the world does not revolve around the English language. And differences in meanings of words just from mixing up those diacritics can sometimes be quite major.

1 0

New Android Malware Records Smartphones via VNC To Steal Passwords
by Peter Reutemann 30 Jul '21

30 Jul '21

'Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record and broadcast a victim's smartphone activity, allowing threat actors to collect keyboard presses and app passwords. From a report: First spotted in March 2021 by Dutch security firm ThreatFabric, this new piece of malware, named Vultur, is a departure from other Android malware strains that usually rely on fake login screens floating on top of legitimate apps to collect a victim's credentials. Instead, Vultur opens a VNC server on the infected phone, and broadcasts screen captures to an attacker command and control server, where the Vultur operator extracts passwords for desired apps.' -- source: https://it.slashdot.org/story/21/07/29/1549220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Warnings That Work: Combating Misinformation Without Deplatforming
by Lawrence D'Oliveiro 29 Jul '21

29 Jul '21

How do you flag misleading postings on Facebook and elsewhere about vaccination, Covid-19 and other issues? Currently these platforms add a little warning next to the posting. Evidence accumulated over many years has shown that such “contextual” warnings are mostly disregarded. What does work is “interstitial” warnings: something that interrupts the user, and forces them to make a choice to continue. This works for security issues on PCs and when browsing the Internet; it can work for postings on social media, too. This article <https://freedom-to-tinker.com/2021/07/26/warnings-that-work-combating-misin…> goes into more details.

1 0

New On Bitsavers This/Last Week
by Lawrence D'Oliveiro 28 Jul '21

28 Jul '21

Among the recent additions to the Bitsavers retrocomputing archive is a scan of the Mt Xinu 1993 calendar <http://bitsavers.trailing-edge.com/pdf/mtXinu/1993_MT_XINU_Calendar.pdf>. On the flip side of each month’s page is a collection of clippings from some interestingly mythical magazines and newspapers. For example, a purported article on “How to eat a meal near a keyboard -- Safely!” hints at an implement that is both “a mouse AND a scrub-brush!”. The cover of a magazine targeted at “computer professionals” touts a report on “Strategic partnerships: What CEOs should know about space aliens” as well as “DOS removers, do they do what they claim?” And then there’s the ad for improving the productivity of your staff with a department-wide installation of a product called ... UrethraNet ...

1 0

The Debian usrmerge Package
by Lawrence D'Oliveiro 27 Jul '21

27 Jul '21

There is a package in Debian (and no doubt also in its derivatives) called “usrmerge” <https://wiki.debian.org/UsrMerge>. The mere act of installing this will perform a “usr merge” on your system, which means that the contents of /bin are merged with /usr/bin, with the former becoming just a symlink to the latter, and similarly /sbin merged into /usr/sbin, and /lib merged into /usr/lib. Back in the last century, when hard drives were smaller, it was standard practice to put only the minimum core of executables and libraries into /bin, /sbin and /lib that would allow the system to boot into a state where a sysadmin could perform some basic maintenance tasks. All the less crucial, but nice to have stuff, would be in /usr, which would be mounted as a separate disk or partition. This way, I suppose, problems with the /usr volume could be fixed without the entire system becoming unbootable. These days, such a division is considered an anachronism. Debian hasn’t supported booting without /usr available for a long while now. I think some other distros, like Fedora, made the move a long time ago. And if you have problems with your OS partition, it’s easier to boot and fix things with something like SystemRescueCD anyway. Note that the usr merge, once performed, is not (easily) reversible. Also note that new Debian installs have been creating a merged usr system since version 10.

1 0

Microsoft Warns of 'Evolving' LemonDuck Mining Malware Targeting Linux and Windows Machines
by Peter Reutemann 26 Jul '21

26 Jul '21

'The threat intelligence team for Microsoft's 365 Defender security suite recently focused on an example of "modern mining malware infrastructure," describing how "Anything that can gain access to machines — even so-called commodity malware — can bring in more dangerous threats." Specifically, it offered a case study of LemonDuck. The blog post's title? "When coin miners evolve..." Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity. LemonDuck's threat to enterprises is also in the fact that it's a cross-platform threat. It's one of a few documented bot malware families that targets Linux systems as well as Windows devices. It uses a wide range of spreading mechanisms — phishing emails, exploits, USB devices, brute force, among others — and it has shown that it can quickly take advantage of news, events, or the release of new exploits to run effective campaigns... Notably, LemonDuck removes other attackers from a compromised device by getting rid of competing malware and preventing any new infections by patching the same vulnerabilities it used to gain access... LemonDuck spreads in a variety of ways, but the two main methods are (1) compromises that are either edge-initiated or facilitated by bot implants moving laterally within an organization, or (2) bot-initiated email campaigns. LemonDuck acts as a loader for many other follow-on activities, but one if its main functions is to spread by compromising other systems. Since its first appearance, the LemonDuck operators have leveraged scans against both Windows and Linux devices for open or weakly authenticated SMB, Exchange, SQL, Hadoop, REDIS, RDP, or other edge devices that might be vulnerable to password spray or application vulnerabilities... Other common methods of infection include movement within the compromised environment, as well as through USB and connected drives. These processes are often kicked off automatically and have occurred consistently throughout the entirety of LemonDuck's operation.' -- source: https://linux.slashdot.org/story/21/07/25/2112228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Stops FTP Support in Firefox 90
by Peter Reutemann 25 Jul '21

25 Jul '21

'A post on Mozilla's security blog calls FTP "by now one of the oldest protocols still in use" — and it's suffering from "a number of serious security issues." The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user's device using the FTP protocol. Aligning with our intent to deprecate non-secure HTTP and increase the percentage of secure connections, we, as well as other major web browsers, decided to discontinue support of the FTP protocol. Removing FTP brings us closer to a fully-secure web which is on a path to becoming HTTPS only and any modern automated upgrading mechanisms such as HSTS or also Firefox's HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP. The FTP protocol itself has been disabled by default since version 88 and now the time has come to end an era and discontinue the support for this outdated and insecure protocol — Firefox 90 will no longer support the FTP protocol.' -- source: https://news.slashdot.org/story/21/07/24/0213220 There is always FileZilla: https://filezilla-project.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Researchers Found a Malicious NPM Package Using Chrome's Password-Recovery Tools
by Peter Reutemann 25 Jul '21

25 Jul '21

'Threatpost reports on "another vast software supply-chain attack" that was "found lurking in the npm open-source code repository...a credentials-stealing code bomb" that used the password-recovery tools in Google's Chrome web browser. Researchers caught the malware filching credentials from Chrome on Windows systems. The password-stealer is multifunctional: It also listens for incoming commands from the attacker's command-and-control (C2) server and can upload files, record from a victim's screen and camera, and execute shell commands... ReversingLabs researchers, who published their findings in a Wednesday post, said that during an analysis of the code repository, they found an interesting embedded Windows executable file: a credential-stealing threat. Labeled "Win32.Infostealer.Heuristics", it showed up in two packages: nodejs_net_server and temptesttempfile. At least for now, the first, main threat is nodejs_net_server. Some details: nodejs_net_server: A package with 12 published versions and a total of more than 1,300 downloads since it was first published in February 2019...finally upgrading it last December with a script to download the password-stealer, which the developer hosts on a personal website. It was subsequently tweaked to run TeamViewer.exe instead, "probably because the author didn't want to have such an obvious connection between the malware and their website," researchers theorized... ReversingLabs contacted the npm security team on July 2 to give them a heads-up about the nodejs_net_server and tempdownloadtempfile packages and circled back once again last week, on Thursday, since the team still hadn't removed the packages from the repository. When Threatpost reached out to npm Inc., which maintains the repository, a GitHub spokesperson sent this statement: "Both packages were removed following our investigation...."' -- source: https://developers.slashdot.org/story/21/07/24/0152218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Reading about Firefox makes it seem a faster web browser than Chrome'
by Matthew Skiffington 25 Jul '21

25 Jul '21

Spotted in New Scientist, who sadly paywall everything. 'Going into the test, people overall tended to view Chrome as faster than Firefox (~39 per cent to ~31 per cent). While the researchers noted that many participants brought their own strong brand preferences, priming participants had an effect that overcame the inertia of that affinity. "When respondents read one of the priming articles, we saw a prevalence of the priming effect over brand preferences, providing support for the hypothesis that Firefox is faster after reading about Firefox improvements," the researchers said.' https://www.theregister.com/2021/03/11/mozilla_google_speed/ https://arxiv.org/abs/2103.06181 <https://www.theregister.com/2021/03/11/mozilla_google_speed/> Cognitive psychology + UX/UI, nifty. Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

'Update to Windows Defender will delete files Microsoft doesn't want to exist'
by Matthew Skiffington 23 Jul '21

23 Jul '21

Stumbled across something interesting on r/datahoarder, xpost from r/sysadmin. https://www.reddit.com/r/DataHoarder/comments/oopz4c/update_to_windows_defe… Cheers, Matthew *Doctoral Researcher, TAIAO project <https://taiao.ai/>Machine Learning Laboratory, FG.2.01LinkedIn <https://www.linkedin.com/in/matthew-skiffington>*

2 1

Do Software Bugs Really Cost 100× More To Fix In Production Than In Testing?
by Lawrence D'Oliveiro 23 Jul '21

23 Jul '21

There is an oft-cited claim that if you let a bug get into production code, the cost of fixing it increases a hundredfold, compared to if you had flushed it out during testing. This report <https://www.theregister.com/2021/07/22/bugs_expense_bs/> looks into the basis of that claim, and it seems to originate from a book published in 1987, which gave it a reference “[IBM81]”, which was “course notes at the IBM System Sciences Institute”. Only there was no such “Institute”, it seems it was really just the name for an internal training program for IBM employees. It also seems a related claim, that “defects cost more to fix the later you fix them”, also has weak, if any, empirical support. Nowhere in there is the issue of “technical debt” addressed, though. That is real, and can be very costly, and its costs do increase over time.

1 0

Say hi to Microsoft's own Linux: CBL-Mariner
by Peter Reutemann 23 Jul '21

23 Jul '21

'Ok, so it's not named MS-Linux or Lindows, but Microsoft now has its very own, honest-to-goodness general-purpose Linux distribution: Common Base Linux, (CBL)-Mariner. And, just like any Linux distro, you can download it and run it yourself. Amazing isn't it? Why the next thing you know Microsoft will let you run Windows applications on Linux! Oh, wait it has!' -- source: https://www.zdnet.com/article/say-hi-to-microsofts-own-linux-cbl-mariner/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Pushed a One-Character Typo To Production, Bricking Chrome OS Devices
by Peter Reutemann 23 Jul '21

23 Jul '21

'Google says it has fixed a major Chrome OS bug that locked users out of their devices. Google's bulletin says that Chrome OS version 91.0.4472.165, which was briefly available this week, renders users unable to log in to their devices, essentially bricking them. From a report: Chrome OS automatically downloads updates and switches to the new version after a reboot, so users who reboot their devices are suddenly locked out them. The go-to advice while this broken update is out there is to not reboot. The bulletin says that a new build, version 91.0.4472.167, is rolling out now to fix the issue, but it could take a "few days" to hit everyone. Users affected by the bad update can either wait for the device to update again or "powerwash" their device -- meaning wipe all the local data -- to get logged in. Chrome OS is primarily cloud-based, so if you're not doing something advanced like running Linux apps, this solution presents less of an inconvenience than it would on other operating systems. Still, some users are complaining about lost data.' -- source: https://it.slashdot.org/story/21/07/22/1955245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines
by Peter Reutemann 22 Jul '21

22 Jul '21

'Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights. The bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity. According to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations. "This function copies a string from the user input using 'strncpy' with a size parameter that is controlled by the user," according to SentinelOne's analysis, released on Tuesday. "Essentially, this allows attackers to overrun the buffer used by the driver." Thus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm. The printer-based attack vector is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup. "Thus, in effect, this driver gets installed and loaded without even asking or notifying the user," explained the researchers. "Whether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected." -- source: https://hardware.slashdot.org/story/21/07/21/2235207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Adding Custom Entries To A Create-New-Document Menu
by Lawrence D'Oliveiro 22 Jul '21

22 Jul '21

If you look at a file/folder view in various of the common GUI file managers, you should see a contextual menu item with a name like “Create New”, showing a submenu of different document types (e.g. “Text File...”, “Spread Sheet Document...”) that you can create in that location. Select an item, it asks you for a name for the new document, and it creates it under that name, as a copy of the template provided for that document type. You can then click to open the newly-created document in the corresponding app and continue working with it in the usual way. This is an alternative to launching the app, creating a new untitled document, then using its “Save-As” function to name the document file. Of course, you can easily create your own templates. On KDE, when I type kde4-config --path templates to find out where a KDE-based file manager like Dolphin finds these templates, it reports /home/ldo/.kde/share/templates/:/usr/share/templates/ The latter contains templates installed systemwide by repo packages, while the former can contain whatever I like. As to the format of these template files? They are just another variation on the ever-popular text-based .desktop file format, which is used for example to define entries in your application menu, and icons on the desktop (for those who like that sort of thing). Oddly, the official spec for this only briefly mentions <https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.ht…> “Type=Link”, without explaining this option further (that I can find). But some searching found this useful post <https://forum.kde.org/viewtopic.php?f=224&t=119342> on the KDE user forums. For example, if I look at /usr/share/templates/Illustration.desktop on my system, besides all the localized versions of the name to show for this option, there are the lines Type=Link URL=.source/Illustration.odg That “URL” is actually a file path relative to the .desktop file itself, referencing a document template to be copied as the initial state of the new document. Looking in the referenced directory, /usr/share/templates/.source/, I do indeed see the file Illustration.odg, along with many others. The association of the file extension with the app, in this case LibreOffice Draw, is handled through a separate spec, the shared MIME database <https://www.freedesktop.org/wiki/Specifications/shared-mime-info-spec/>. This is also widely supported by GUI desktop environments.

1 1

PlasticArm is a 32-bit bendable processor
by Peter Reutemann 22 Jul '21

22 Jul '21

'Wearable electronics, like watches and fitness trackers, represent the next logical step in computing. They've sparked an interest in the development of flexible electronics, which could expand the category to include products like clothing and backpacks. Flexible electronics run into a problem, however: Our processing hardware is anything but flexible. Most efforts to deal with that limitation have involved splitting up processors into a collection of smaller units, linking them with flexible wiring, and then embedding all the components in a flexible polymer. To an extent, the process is a throwback to the early days of computing, when a floating-point unit might reside on a separate chip. But a group within the semiconductor company Arm has now managed to implement one of the company's smaller embedded designs using flexible silicon. The design works and executes all the instructions you'd expect from it, but it also illustrates the compromises we have to make to produce truly flexible electronics.' -- source: https://arstechnica.com/science/2021/07/researchers-build-a-bendable-arm-pr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Audacity’s new owner is in another fight with the open source community
by Peter Reutemann 21 Jul '21

21 Jul '21

'Muse Group—owner of the popular audio-editing app Audacity—is in hot water with the open source community again. This time, the controversy isn't over Audacity—it's about MuseScore, an open source application which allows musicians to create, share, and download musical scores (especially, but not only, in the form of sheet music). The MuseScore app itself is licensed GPLv3, which gives developers the right to fork its source and modify it. One such developer, Wenzheng Tang ("Xmader" on GitHub) went considerably further than modifying the app—he also created separate apps designed to bypass MuseScore Pro subscription fees. After thoroughly reviewing the public comments made by both sides at GitHub, Ars spoke at length with Muse Group's Head of Strategy Daniel Ray—known on GitHub by the moniker "workedintheory"—to get to the bottom of the controversy.' -- source: https://arstechnica.com/gadgets/2021/07/audacitys-new-owner-is-in-another-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nasty Linux Systemd Security Bug Revealed
by Peter Reutemann 21 Jul '21

21 Jul '21

'Qualys has discovered a new systemd security bug that enables any unprivileged user to cause a denial of service via a kernel panic. Slashdot reader inode_buddha shares the news via ZDNet's Steven J. Vaughan-Nichols: As Bharat Jogi, Qualys's senior manager of Vulnerabilities and Signatures, wrote, "Given the breadth of the attack surface for this vulnerability, Qualys recommends users apply patches for this vulnerability immediately." You can say that again. Systemd is used in almost all modern Linux distributions. This particular security hole arrived in the systemd code in April 2015. It works by enabling attackers to misuse the alloca() function in a way that would result in memory corruption. This, in turn, allows a hacker to crash systemd and hence the entire operating system. Practically speaking, this can be done by a local attacker mounting a filesystem on a very long path. This causes too much memory space to be used in the systemd stack, which results in a system crash. That's the bad news. The good news is that Red Hat Product Security and systemd's developers have immediately patched the hole. ' -- source: https://it.slashdot.org/story/21/07/20/211230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experimental Rust Support Patches Submitted to Linux Kernel Mailing List
by Peter Reutemann 21 Jul '21

21 Jul '21

'"The Rust for Linux project, sponsored by Google, has advanced..." reported the Register earlier this week: A new set of patches submitted to the Linux kernel mailing list summarizes the progress of the project to enable Rust to be used alongside C for implementing the Linux kernel. The progress is significant. - ARM and RISC-V architectures are now supported, thanks to work on rustc_codgen_gcc, which is a GCC codegen for rustc. This means that rustc does the initial compilation of Rust code but GCC (the GNU Compiler Collection) does the backend compilation, enabling support for the architectures that GCC supports... - Overall, "the Rust support is still to be considered experimental. However, as noted back in April, support is good enough that kernel developers can start working on the Rust abstractions for subsystems and write drivers and other modules," continued project leader Miguel Ojeda, a computer scientist at CERN in Geneva, Switzerland, now working full time on Rust for Linux... There is substantial support for the project across the industry. Google said in April "we feel that Rust is now ready to join C as a practical language for implementing the kernel" and that it would reduce the number of potential bugs and security vulnerabilities. Google is sponsoring Ojeda to work full time on the project for a year, via the ISRG (Internet Security Research Group), which said last month that it is part of "efforts to move the internet's critical software infrastructure to memory safe code," under the project name Prossimo. The ISRG is also the nonprofit organisation behind Let's Encrypt free security certificates. Ojeda also mentioned that Microsoft's Linux Systems Group is contributing and hopes to submit "select Hyper-V drivers written in Rust." Arm is promising assistance with Rust for Linux on ARM-based systems. IBM has contributed Rust kernel support for its PowerPC processor. More detail is promised at the forthcoming Linux Plumber's Conference in September. In the meantime, the project is on GitHub here. "In addition, we would like to announce that we are organizing a new conference that focuses on Rust and the Linux kernel..." Ojeda posted. "Details will be announced soon." And for context, the Register adds: Linus Torvalds has said on several occasions that he welcomes the possibility of using Rust alongside C for kernel development, and told IT Wire in April that it is "getting to the point where maybe it might be mergeable for 5.14 or something like that."' -- source: https://linux.slashdot.org/story/21/07/10/0447253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

MicroG Project
by Lawrence D'Oliveiro 21 Jul '21

21 Jul '21

Came across this <https://microg.org/>, which is an open-source reimplementation of much of Google’s proprietary Play Services for Android. Their repos are on GitHub <https://github.com/microg>. They’ve been getting some funding from the German Federal Ministry of Education and Research.

1 0

DuckDuckGo Launches New Email Protection Service To Remove Trackers
by Peter Reutemann 21 Jul '21

21 Jul '21

'DuckDuckGo is launching a new email privacy service meant to stop ad companies from spying on your inbox. From a report: The company's new Email Protection feature gives users a free "@duck.com" email address, which will forward emails to your regular inbox after analyzing their contents for trackers and stripping any away. DuckDuckGo is also extending this feature with unique, disposable forwarding addresses, which can be generated easily in DuckDuckGo's mobile browser or through desktop browser extensions. The personal DuckDuckGo email is meant to be given out to friends and contacts you know, while the disposable addresses are better served when signing up for free trials, newsletters, or anywhere you suspect might sell your email address. If the email address is compromised, you can easily deactivate it. These tools are similar to anti-tracking features implemented by Apple in iOS 14 and iOS 15, but DuckDuckGo's approach integrates into iOS, Android, and all major web browsers. DuckDuckGo will also make it easier to spin up disposable email addresses on the fly, for newsletters or anywhere you might share your email.' -- source: https://yro.slashdot.org/story/21/07/20/1532258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

For years, a backdoor in popular KiwiSDR product gave root to project developer
by Peter Reutemann 20 Jul '21

20 Jul '21

'KiwiSDR is hardware that uses a software-defined radio to monitor transmissions in a local area and stream them over the Internet. A largely hobbyist base of users does all kinds of cool things with the playing-card-sized devices. For instance, a user in Manhattan could connect one to the Internet so that people in Madrid, Spain, or Sydney, Australia, could listen to AM radio broadcasts, CB radio conversations, or even watch lightning storms in Manhattan. On Wednesday, users learned that for years, their devices had been equipped with a backdoor that allowed the KiwiSDR creator—and possibly others—to log in to the devices with administrative system rights. The remote admin could then make configuration changes and access data not just for the KiwiSDR but in many cases to the Raspberry Pi, BeagleBone Black, or other computing devices the SDR hardware is connected to.' -- source: https://arstechnica.com/gadgets/2021/07/for-years-a-backdoor-in-popular-kiw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers got past Windows Hello by tricking a webcam
by Peter Reutemann 20 Jul '21

20 Jul '21

'Biometric authentication is a key piece of the tech industry's plans to make the world password-less. But a new method for duping Microsoft's Windows Hello facial-recognition system shows that a little hardware fiddling can trick the system into unlocking when it shouldn't. Services like Apple's FaceID have made facial-recognition authentication more commonplace in recent years, with Windows Hello driving adoption even farther. Apple only lets you use FaceID with the cameras embedded in recent iPhones and iPads, and it's still not supported on Macs at all. But because Windows hardware is so diverse, Hello facial recognition works with an array of third-party webcams. Where some might see ease of adoption, though, researchers from the security firm CyberArk saw potential vulnerability. That's because you can't trust any old webcam to offer robust protections in how it collects and transmits data. Windows Hello facial recognition works only with webcams that have an infrared sensor in addition to the regular RGB sensor. But the system, it turns out, doesn't even look at RGB data. Which means that with one straight-on infrared image of a target's face and one black frame, the researchers found that they could unlock the victim's Windows Hello–protected device. By manipulating a USB webcam to deliver an attacker-chosen image, the researchers could trick Windows Hello into thinking the device owner’s face was present and unlocking.' -- source: https://arstechnica.com/information-technology/2021/07/hackers-got-past-win… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Case Against SQL
by Peter Reutemann 19 Jul '21

19 Jul '21

'Long-time Slashdot reader RoccamOccam shares "an interesting take on SQL and its issues from Jamie Brandon (who describes himself as an independent researcher who's built database engines, query planners, compilers, developer tools and interfaces). It's title? "Against SQL." The relational model is great... But SQL is the only widely-used implementation of the relational model, and it is: Inexpressive, Incompressible, Non-porous. This isn't just a matter of some constant programmer overhead, like SQL queries taking 20% longer to write. The fact that these issues exist in our dominant model for accessing data has dramatic downstream effects for the entire industry: - Complexity is a massive drag on quality and innovation in runtime and tooling - The need for an application layer with hand-written coordination between database and client renders useless most of the best features of relational databases The core message that I want people to take away is that there is potentially a huge amount of value to be unlocked by replacing SQL, and more generally in rethinking where and how we draw the lines between databases, query languages and programming languages... I'd like to finish with this quote from Michael Stonebraker, one of the most prominent figures in the history of relational databases: "My biggest complaint about System R is that the team never stopped to clean up SQL... All the annoying features of the language have endured to this day. SQL will be the COBOL of 2020..." It's been interesting to follow the discussion on Twitter, where the post's author tweeted screenshots of actual SQL code to illustrate various shortcomings. But he also notes that "The SQL spec (part 2 = 1732) pages is more than twice the length of the Javascript 2021 spec (879 pages), almost matches the C++ 2020 spec (1853) pages and contains 411 occurrences of 'implementation-defined', occurrences which include type inference and error propagation." His Twitter feed also includes a supportive retweet from Rust creator Graydon Hoare, and from a Tetrane developer who says "The Rust of SQL remains to be invented. I would like to see it come."' -- source: https://developers.slashdot.org/story/21/07/18/1844225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

meeting next Monday (July 26th)
by Peter Reutemann 19 Jul '21

19 Jul '21

Hi everyone We have a WLUG meeting coming up next Monday (July 26th): 'Looking for a replacement of Dropbox or Google Drive that respects your privacy? Then come to our meeting, as Glenn will show you how to install, run and use the open-source solution Nextcloud (https://nextcloud.com/) on a Raspberry Pi and check out the various clients that you can use with it.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861069/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1.4 Million Cubans Bypass Censorship Using US Government-Funded Software Psiphon
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Cuban officials rallied tens of thousands of supporters in the streets on Saturday — nearly a week after they were stunned by the most widespread protests in decades," the Associated Press reports. President Miguel Díaz-Canel — accompanied by 90-year-old former President Raul Castro — "made an impassioned speech blaming unrest on the U.S. and its economic embargo, 'the blockade, aggression and terror... The enemy has returned to throw all it has at destroying the sacred unity and tranquility of the citizens.'" "I think the government is just trying to signal to people that it understands their desperation and that it's going to try to alleviate some of the misery that they're experiencing. The problem is that the government just doesn't have much in the way of resources that it can devote to doing that," said William LeoGrande, an expert on Cuba at the American University in the United States. Meanwhile, Reuters reports: Psiphon Inc's freely available internet censorship circumvention tool has helped nearly 1.4 million Cubans this week gain access to websites, the company said on Friday, after Cuba's government curbed access to popular social media and messaging platforms... Thousands of Cubans joined nationwide protests over shortages of basic goods, limits on civil liberties and the government's handling of a surge in COVID-19 infections on Sunday, the most significant unrest in decades in the communist-run country. Psiphon said 1.389 million users accessed the open web from Cuba through its network on Thursday, as well as 1.238 million as noon EDT (1600 GMT) on Friday. "Internet is ON; circumvention tools ARE working," Psiphon said in a statement. Psiphon said the roughly 1.4 million represents about 20% of Cuban internet users. Its open source circumvention tool can be downloaded from app stores like Google Play or Apple to "maximize your chances of bypassing censorship," according to the company. Canadian university researchers developed the software in 2007 to let users evade governmental internet firewalls. The censorship-circumvention tool — which combines VPN, SSH, and HTTP Proxy tools — has also been used in Iran, China, Belarus, Myanmar, according to recent news reports. Bloomberg notes that the Toronto-based nonprofit Psiphon "has received funding from the Open Technology Fund, a U.S. government nonprofit that aims to support global internet freedom technologies... "On Thursday, President Biden said the U.S. is examining whether it's able to restore internet access shut down by the Cuban government."' -- source: https://yro.slashdot.org/story/21/07/18/009221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's Elasticsearch Fork 'OpenSearch' Reaches General Availability 1.0 Milestone
by Peter Reutemann 19 Jul '21

19 Jul '21

'Mike Melanson's "This Week in Programming" column shares an update on Amazon's ongoing battle with scalable data search solution ElasticSearch: Earlier this year, AWS completed its fork of ElasticSearch with the first release of OpenSearch. If you haven't followed along, the whole affair was a bit of a tug of war between AWS and Elastic, with AWS eventually coming out seemingly on top. After Elastic changed the licensing on ElasticSearch in an attempt to prevent AWS from selling a service based on the then-open-source project, AWS forked the project to release OpenSearch under Apache 2.0, effectively preserving its open source status. Now, OpenSearch has reached 1.0, which AWS says not only "marks the first production-ready version of OpenSearch," but also introduces "multiple new enhancements," such as data streams, trace analytics span filtering, report scheduling and more. The 1.0 release also involved quite a bit of code cleanup, removing proprietary code and marks, and adds the ability to upgrade from ElasticSearch to OpenSearch as if you were performing a normal upgrade of ElasticSearch. If you're interested in learning where the project is going, head on over to the public roadmap to learn more. ' -- source: https://news.slashdot.org/story/21/07/18/1656208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will a New Law Help the Chinese Government Stockpile Zero-Days?
by Peter Reutemann 19 Jul '21

19 Jul '21

'"Starting September 1, 2021, the Chinese government will require that any Chinese citizen who finds a zero-day vulnerability must pass the details to the Chinese government," reports SecurityWeek, "and must not sell or give the knowledge to any third-party outside of China (apart from the vulnerable product's manufacturer)." Brief details are provided in a report by the Associated Press (AP) published Tuesday, July 13, 2021. No source is provided beyond the statement, "No one may 'collect, sell or publish information on network product security vulnerabilities,' say the rules issued by the Cyberspace Administration of China and the police and industry ministries...." AP describes this action as "further tightening the Communist Party's control over information". This is unlikely to be the primary motivation for the new rule since the government already has a vice-like grip on data. Companies may not store data on Chinese customers outside of China. Foreign companies selling routers and some other network devices in China must disclose to regulators how any encryption features work. "I would expect the Chinese Government to weaponize any discovered security vulnerabilities to enhance China's cybersecurity capabilities," Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, tells SecurityWeek. And Jake Williams, co-founder and CTO at BreachQuest adds that "the defensive advantages of Chinese government organizations being able to mitigate vulnerabilities discovered may well outweigh any offensive gains...." But he also believes this could rebound against China. "One of the biggest likely issues is brain drain. If Chinese researchers can profit handsomely from their work anywhere else, but can't do so in China, why would they stay? This probably helps China in the short term but harms them in the long term." The new law does encourage network operators and product vendors to set up a reward mechanism for reported vulnerabilities, according to the Record. But Katie Moussouris, founder and CEO of Luta Security, also raises the issue of western-based bug bounty platforms that have been working with Chinese security researchers for the past years. "If Western-based bug bounty platforms comply with this requirement in order to continue to legally receive bug reports from Chinese researchers, we must assume they will be required to hand over vulnerability data to the Ministry within two days of receiving the reports," Moussouris said. "That requirement will effectively introduce a backdoor straight to the Chinese government in any VDP [vulnerability disclosure program] or bug bounty program where Chinese researchers submit bugs via platforms, even to non-Chinese companies."' -- source: https://it.slashdot.org/story/21/07/18/2143207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hey Google: It’s Not (Just) A Joke
by Lawrence D'Oliveiro 14 Jul '21

14 Jul '21

Looking at this list <https://www.nzherald.co.nz/entertainment/the-best-inappropriate-and-annoyin…> of complaints about ads that didn’t get far with the Advertising Standards Authority, one stood out for me: The complaint: One avid Google Assistant user was very riled by this ad, explaining that when the shop assistant asks "Hey Google", it ended up triggering every Google smart device in his home. "I have 10 such devices in the house which includes smart speakers, smart displays and Chromecast which all respond to the advert," they write. "This is not only highly annoying, but also a deliberate attempt to trigger these devices." Yes, it seems it really does happen ... (Though I think the award for most nitpicking has to go to the “Clair de Lune” one.)

1 0

Speed Up Microsoft Teams By Bypassing Antivirus Checks
by Lawrence D'Oliveiro 13 Jul '21

13 Jul '21

Microsoft’s official recommendation <https://github.com/MicrosoftDocs/OfficeDocs-SkypeForBusiness/blob/9df8f4069…> for improving the performance of Teams on Windows is to exclude it from antivirus checks: Add the following Teams programs to your antivirus safe list. %localappdata%\Microsoft\Teams\current\Teams.exe %localappdata%\Microsoft\Teams\Update.exe Add the following Teams folders to your antivirus safe list. %localappdata%\Microsoft\Teams %appdata%\Microsoft\Teams| Because antivirus software only exists to slow your system down, right? (Found from this <https://forums.theregister.com/forum/all/2021/07/12/windows_11_still_doesnt…> reader comment.)

2 1

Libre-SOC's Open Hardware 180nm ASIC Submitted To IMEC for Fabrication
by Peter Reutemann 11 Jul '21

11 Jul '21

'"We're building a chip. A fast chip. A safe chip. A trusted chip," explains the web page at Libre-SOC.org. "A chip with lots of peripherals. And it's VPU. And it's a 3D GPU... Oh and here, have the source code." And now there's big news, reports long-time Slashdot reader lkcl: Libre-SOC's entirely Libre 180nm ASIC, which can be replicated down to symbolic level GDS-II with no NDAs of any kind, has been submitted to IMEC for fabrication. It is the first wholly-independent Power ISA ASIC outside of IBM to go Silicon in 12 years. Microwatt went to Skywater 130nm in March; however, it is also developed by IBM, as an exceptionally well-made Reference Design, which Libre-SOC used for verification. Whilst it would seem that Libre-SOC is jumping on the chip-shortage era's innovation bandwagon, Libre-SOC has actually been in development for over three and a half years so far. It even pre-dates the OpenLane initiative, and has the same objectives: fully automated HDL to GDS-II, full transparency and auditability with Libre VLSI tools Coriolis2 and Libre Cell Libraries from Chips4Makers. With €400,000 in funding from the NLNet Foundation [a long-standing non-profit supporting privacy, security, and the "open internet"], plus an application to NGI Pointer under consideration, the next steps are to continue development of Draft Cray-style Vectors (SVP64) to the already supercomputer-level Power ISA, under the watchful eye of the upcoming OpenPOWER ISA Workgroup.' -- source: https://hardware.slashdot.org/story/21/07/10/0154220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Edge Beats Firefox To Become the Third-Most Popular Browser
by Peter Reutemann 11 Jul '21

11 Jul '21

'"New data from Statcounter shows that Edge has now overtaken established rival Firefox in the rankings," reports TechRadar: In recent months, the pair have been neck-and-neck, but Microsoft's browser has now put daylight between itself and Firefox. Figures for June suggest Microsoft Edge now holds 3.4% of the browser market, while Firefox has slipped to 3.29%, continuing a downward trajectory that has seen the browser either lose or maintain market share in ten of the last twelve months. The change pushes Edge into third position in the browser rankings, behind only Chrome (65.27%) and Safari (18.34%). Launched in January 2020, the new Chromium-based Edge got off to a slow start, but began to gather momentum as the year progressed. Since last summer, the browser's market share has more than tripled. The increase in adoption can be attributed in part to renewed marketing efforts, but also to improvements that brought the experience in line with other modern web browsers. That may be true, but the article also acknowledges that it was just last month that Microsoft began rolling out Edge to all Windows PCs (via Windows 10 updates), "expanding the install base by millions almost overnight. "Now, Microsoft is doing everything in its power to encourage users to abandon Internet Explorer in favor of Edge, such as removing support for Microsoft 365 web apps and automatically launching certain web pages in the new browser."' -- source: https://news.slashdot.org/story/21/07/10/0353201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Unfair Performance Advantage in Chrome
by Peter Reutemann 10 Jul '21

10 Jul '21

'Google Chrome for Android has a feature that gives Google Search an unfair advantage over its competition. Sure, it's the default search engine and that's a huge hurdle to overcome for any competitor. However, Chrome also reserves a performance-boosting feature for Google Search exclusively. I recently poked around in the Chromium project source code; the open-source foundation for Google's Chrome web browser. The Chromium project is co-developed by Google, and other corporate and individual contributors. The project is managed and controlled by Google, however. I was looking for something else when I stumbled upon a feature called PreconnectToSearch. When enabled, the feature preemptively opens and maintains a connection to the default search engine. The preconnection feature resolves the domain name, and negotiates and sets up a secure connection to the server. All these things take time and they must happen before the search engine can receive the users' search queries. Preempting these steps can save a dozen seconds on a slow network connection or half a second on a fast connection. This optimization can yield a nice performance boost for Google's customers. Assuming the connection only requires a trivial amount of processing power and network bandwidth, of course. Setting up the connection early can be wasteful or slow down the loading of other pages if the user isn't going to search the web. There's just one small catch: Chromium checks the default search engine setting, and only enables the feature when it's set to Google Search. This preferential treatment means no other search engine can compete with Google Search on the time it takes to load search results. Every competitor must wait until the user has started to type a search query before Chrome will establish a connection.' -- source: https://tech.slashdot.org/story/21/07/09/2056209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Extends Privacy and Security of Canadian Internet Users With By-default DNS-over-HTTPS Rollout in Canada
by Peter Reutemann 09 Jul '21

09 Jul '21

'In a few weeks, Firefox will start the by-default rollout of DNS over HTTPS (or DoH for short) to its Canadian users in partnership with local DoH provider CIRA, the Canadian Internet Registration Authority. >From a report: DoH will first become a default for 1% of Canadian Firefox users on July 20 and will gradually reach 100% of Canadian Firefox users in late September 2021 -- thereby further increasing their security and privacy online. This follows the by-default rollout of DoH to US users in February 2020. As part of the rollout, CIRA joins Mozilla's Trusted Recursive Resolver (TRR) Program and becomes the first internet registration authority and the first Canadian organization to provide Canadian Firefox users with private and secure encrypted Domain Name System (DNS) services.' -- source: https://news.slashdot.org/story/21/07/08/1732203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kaspersky Password Manager Fixes Flaw That Generated Easily Bruteforced Passwords
by Peter Reutemann 09 Jul '21

09 Jul '21

'ZDNet reports: Suppose you are in the business of generating passwords, it would probably be a good idea to use an additional source of entropy other than the current time, but for a long time, that's all Kaspersky Password Manager (KPM) used. In a blog post to cap off an almost two year saga, Ledger Donjon head of security research Jean-Baptiste Bedrune showed KPM was doing just that. "Kaspersky Password Manager used a complex method to generate its passwords. This method aimed to create passwords hard to break for standard password crackers. However, such method lowers the strength of the generated passwords against dedicated tools," Bedrune wrote. One of the techniques used by KPM was to make letters that are not often used appear more frequently, which Bedrune said was probably an attempt to trick password cracking tools. "Their password cracking method relies on the fact that there are probably 'e' and 'a' in a password created by a human than 'x' or 'j', or that the bigrams 'th' and 'he' will appear much more often than 'qx' or 'zr'," he said. "Passwords generated by KPM will be, on average, far in the list of candidate passwords tested by these tools. If an attacker tries to crack a list of passwords generated by KPM, he will probably wait quite a long time until the first one is found. This is quite clever." The flip side was that if an attacker could deduce that KPM was used, then the bias in the password generator started to work against it. "If an attacker knows a person uses KPM, he will be able to break his password much more easily than a fully random password. Our recommendation is, however, to generate random passwords long enough to be too strong to be broken by a tool." The big mistake made by KPM though was using the current system time in seconds as the seed into a Mersenne Twister pseudorandom number generator. "It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second," Bedrune said. Because the program has an animation that takes longer than a second when a password is created, Bedrune said it could be why this issue was not discovered. "The consequences are obviously bad: every password could be bruteforced," he said. Bedrune added due to sites often showing account creation time, that would leave KPM users vulnerable to a bruteforce attack of around 100 possible passwords. "Kaspersky was informed of the vulnerability in June 2019, and released the fix version in October that same year," adds ZDNet. "In October 2020, users were notified that some passwords would need to be generated, with Kaspersky publishing its security advisory on 27 April 2021." "All public versions of Kaspersky Password Manager liable to this issue now have a new logic of password generation and a passwords update alert for cases when a generated password is probably not strong enough," the security company said.' -- source: https://it.slashdot.org/story/21/07/08/2116252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Endian Wars: Linus Has Spoken
by Lawrence D'Oliveiro 06 Jul '21

06 Jul '21

The Rust language continues to make progress for use in the Linux kernel <https://www.theregister.com/2021/07/05/rust_for_linux_kernel_project/>. The article ends with a comment from Linus Torvalds about the old “endian wars” which have been a feature of the computing landscape since byte addressability became common: should the bytes of a number be arranged in big-endian order (most significant end at the lowest address) or little-endian (least significant end at the lowest address)? In the latest patches, Ojeda proposed to use big-endian order for long symbols in the kernel symbol table, needed because Rust symbols "can become quite long due to namespacing introduced by modules, types, traits, generics." Torvalds responded: "Why is this in big-endian order? Let's just try to kill big-endian data, it's disgusting and should just die already... networking has legacy reasons from the bad old days when byte order wars were still a thing, but those days are gone." Having used both kinds of computer architectures over the years, I agree. Little-endian ordering is more mathematically consistent.

3 7

Kaseya VSA Software Compromised By Ransomware
by Lawrence D'Oliveiro 06 Jul '21

06 Jul '21

Kaseya VSA is a piece of software widely used around the world (and in NZ) to manage IT resources in small-to-medium businesses. Now it appears <https://www.rnz.co.nz/news/national/446162/new-zealand-may-be-caught-up-in-…> this software has been subverted as a weapon, likely by the notorious Russia-based “REvil” gang, to hold data to ransom across a range of organizations worldwide. This evening’s TV1 news mentions a Cambridge school <https://www.tvnz.co.nz/one-news/new-zealand/cambridge-school-among-business…> among other victims in NZ.

1 4

Open Source Audio Editor Audacity Has Become 'Spyware'
by Peter Reutemann 06 Jul '21

06 Jul '21

'Anyone deciding to download the free and open-source audio editor Audacity is being warned that the software may now be classified as spyware due to recent updates to its privacy policy. From a report: Audacity has been around for over 21 years and classes as the world's most popular audio editing software. On April 30, the Muse Group acquired Audacity with the promise that the software would "remain forever free and open source." However, as FOSS Post reports, last week the Audacity privacy policy page was updated and introduced a number of personal data collection clauses. The data collected includes OS version and name, user country based on IP address, the CPU being used, data related to Audacity error codes and crash reports, and finally "Data necessary for law enforcement, litigation and authorities' requests (if any)." The personal data collected can be shared with Muse Group employees, auditors, advisors, legal representatives and "similar agents," potential company buyers, and "any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, or (ii) to exercise, establish or defend our legal rights."' -- source: https://yro.slashdot.org/story/21/07/05/2155212 How long before a fork occurs that will strip out these bits? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Infinidash: The Most Amazing Amazon Web Services Product ... That Never Was
by Lawrence D'Oliveiro 05 Jul '21

05 Jul '21

It all started with one person wondering how long it would take after merely mentioning the name of some hypothetical new AWS-based product before it started appearing in job ads. So he made up a product name, put out a tweet, and waited. It took just three days <https://www.theregister.com/2021/07/05/infinidash/>. I had a look at the linked job ad, and it still contains the sentence “Infinidash is at the core of everything we do”, with absolutely no hint that it might be tongue-in-cheek. This is just a continuation of the long-standing phenomenon among HR departments and employment agencies putting out job ads requiring something like “5+ years experience in Technology X”, when Technology X has only been around for a few months.

1 0

Microsoft To Add Support for Linux GUI Apps on Windows 10 Later This Year
by Peter Reutemann 03 Jul '21

03 Jul '21

'Microsoft is making the promised support for Linux graphical user interface (GUI) apps on Windows 10 available to customers as of the next Windows 10 release, officials said on May 25. Microsoft officials made the announcement on Day 1 of its virtual Build 2021 developers conference. From a report: During his Day 1 keynote, CEO Satya Nadella basically acknowledged there will be another event "soon" about the next Windows. He said: ""And soon we will share one of the most significant updates of Windows of the past decade." He said he has been self-hosting it over the past several months and called it "the next generation of Windows." Microsoft released a preview of Linux GUI apps on the Windows Subsystem for Linux (WSL) in April, 2021. This capability is meant to allow developers to run their preferred Linux tools, utilities and apps directly on Windows 10. With GUI app support, users can now run GUI apps for testing, development and daily use without having to set up a virtual machine.' -- source: https://linux.slashdot.org/story/21/05/25/1639238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Google Is Working On an HTTPS-Only Mode For Chrome
by Peter Reutemann 01 Jul '21

01 Jul '21

'Following in the footsteps of browsers like Mozilla Firefox and Microsoft Edge, Google Chrome is also in line to receive an HTTPS-Only Mode that will upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible. Currently, the new Chrome HTTPS-Only Mode is still under development in Chrome Canary distributions. Work is being done to add specific settings in the browser's interface, and no actual HTTP-to-HTTPS functionality is currently present. The feature is expected to be ready for Chrome 93, set to be released later this fall.' -- source: https://tech.slashdot.org/story/21/06/30/1734234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0