- wlug - list.wlug.org.nz

'Mozilla VPN' Launches in Six Countries
by Peter Reutemann 20 Jul '20

20 Jul '20

'"Starting today, there's a VPN on the market from a company you trust," Mozilla announced Wednesday. Mozilla VPN is now officially available for Windows and Android in six countries: the U.S., Canada, the U.K., Singapore, Malaysia, and New Zealand, and it'll be coming to even more countries later this year, reports the Verge: The service is available for $4.99 a month, and, like other VPNs, it's designed to make your web-browsing more private and secure. As part of the move, the service is being rebranded from Firefox Private Network to Mozilla VPN, a change that was announced last month. Mozilla argues that its VPN service has a couple of advantages over its many competitors. It says it should offer a faster browsing experience in many cases because it's based on a protocol with less than a third of the lines of code of an average VPN service provider. The company is also banking on the reputation it's built up with its privacy-focused browser, and it adds that it only collects the information it needs to run a service and doesn't keep user data logs. The VPN's launch follows beta trials in the US, which also included tests of a VPN built directly into the Firefox browser. Last month, Mozilla announced that it would be testing asking users to pay $2.99 a month for unlimited usage of the extension, which is designed to mask your traffic within the browser rather than at a system-wide level.' -- source: https://tech.slashdot.org/story/20/07/19/0437230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VPN With 'Strict No-Logs Policy' Exposed Millions of User Log Files
by Peter Reutemann 19 Jul '20

19 Jul '20

'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all." A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.' -- source: https://it.slashdot.org/story/20/07/17/2338230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

LibreOffice Ructions
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

From <https://www.theregister.com/2020/07/16/libreoffice_ecosystem_beyond_utterly…>: Michael Meeks: “Words fail me to express how beyond-utterly-broken the existing TDF / desktop model is for the ecosystem around selling desktop LibreOffice.” As you may know, LibreOffice is overseen by The Document Foundation, which is a charity registered in Germany. And it currently has about €1.5 million in the bank. However, owing to peculiarities of German law (or maybe just the way they are interpreting it), none of that money is actually allowed to be spent on software development.

1 0

The Pros & Cons Of Virtual Meetings
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

<https://www.theregister.com/2020/07/16/virtual_internet_governance_meeting_…>: The move to virtual meetings among internet governance bodies has had mixed results ... “Previously, physical intergovernmental meetings were represented by a select few per economy that could afford to travel to these closed-door meetings. Economies with smaller travel budgets and small delegations tend to be at a disadvantage in terms of getting their views adequately represented.” But smaller nations may have another problem: unreliable internet access. ... “In addition, virtual meetings do not lend themselves well to effective ‘corridor chats’, where many private conversations and negotiations take place at the sidelines of the meeting. ...” “Remote participants in a virtual meeting generally come with pre-baked positions that sometimes become intractable due to the lack of opportunities for proper engagement ... [resulting in] the inability to reach a compromise in an effective and efficient manner.”

1 0

New Pine64 phones with upgraded hardware begin shipping in August
by Peter Reutemann 17 Jul '20

17 Jul '20

'Yesterday, Pine64 announced the end of the PinePhone UBPorts Community Edition campaign—but more importantly, the company declared the beginning of the postmarketOS Community Edition campaign. The base version of the new run of PinePhones shares the same $149 price point and the same basic technical specs as the original developer edition—but there's also a new, upgraded "Convergence Package" available at $199. Before anyone gets too excited, we need to make something clear—these devices, while attractively priced, should be considered beta gadgets for tinkerers to experiment and play with. They are not yet fully functional phones, and in their current development status, they are unlikely to be anyone's full-time daily-usage smartphone. The apps don't all work yet—including making calls—and battery life still leaves a lot to be desired.' -- source: https://arstechnica.com/gadgets/2020/07/pine64-launches-postmarketos-editio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 84 Arrives With SameSite Cookie Changes, Web OTP API and Web Animations
by Peter Reutemann 17 Jul '20

17 Jul '20

'Google today launched Chrome 84 for Windows, Mac, Linux, Android, and iOS. Chrome 84 resumes SameSite cookie changes, includes the Web OTP API and Web Animations API, and removes older Transport Layer Security (TLS) versions. [...] First deprecated with Chrome 81 in April, TLS 1.0 and TLS 1.1 have now been completely removed with Chrome 84. This is notable for anyone who manages a website, even if they donâ(TM)t use Chrome at home or at work. TLS is a cryptographic protocol designed to provide communications security over a computer network -- websites use it to secure all communications between their servers and browsers. TLS also succeeds Secure Sockets Layer (SSL) and thus handles the encryption of every HTTPS connection.' -- source: https://it.slashdot.org/story/20/07/16/1444257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA On Securing VPNs
by Lawrence D'Oliveiro 16 Jul '20

16 Jul '20

Bruce Schneier reports <https://www.schneier.com/blog/archives/2020/07/nsa_on_securing.html> on an advisory from the US National Security Agency on how to secure your VPN setup. The document is available in a 10-page or 2-page version. The tips can be summarized as * Reduce the VPN gateway attack surface * Verify on CNSSP-15-compliant algorithms are in use * Avoid using default settings * Remove unused or non-compliant cryptography suites * Apply vendor-provided updates The one about not using default settings I found interesting, the explanation given being that “many vendors provide default configurations, automated configuration scripts, or graphical user interface wizards to aid in the deployment of VPNs”, but that these tools/defaults may prioritize ease of setup over security, and therefore enable extra options that should not be enabled. The longer version gives detailed configuration examples.

1 0

Microsoft urges patching severe-impact, wormable server vulnerability
by Peter Reutemann 16 Jul '20

16 Jul '20

'Microsoft is urgently advising Windows server customers to patch a vulnerability that allows attackers to take control of entire networks with no user interaction and, from there, rapidly spread from computer to computer. The vulnerability, dubbed SigRed by the researchers who discovered it, resides in Windows DNS, a component that automatically responds to requests to translate a domain into the IP address computers need to locate it on the Internet. By sending maliciously formed queries, attackers can execute code that gains domain administrator rights and, from there, take control of an entire network. The vulnerability, which doesn’t apply to client versions of Windows, is present in server versions from 2003 to 2019. SigRed is formally tracked as CVE-2020-1350. Microsoft issued a fix as part of this month's Update Tuesday.' -- source: https://arstechnica.com/information-technology/2020/07/microsoft-urges-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank To Sell ARM?
by Lawrence D'Oliveiro 15 Jul '20

15 Jul '20

Just four years after acquiring it, SoftBank now wants to sell off Arm Holdings, the company that creates (and licenses) designs for ARM chips <https://www.theregister.com/2020/07/14/softbank_considering_arm_sale_report/>. Besides SoftBank’s well-known string of recent investment missteps, there was this interesting quote: Speaking to The Register, one company insider said SoftBank was dissatisfied with Arm's business model and wanted it to charge more for royalties. But if it does that, it just makes alternatives like RISC-V look more competitive.

1 0

Rust Code In The Linux Kernel?
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Looks like several kernel developers, up to and including Linus Torvalds himself, are receptive <https://www.theregister.com/2020/07/13/rust_code_in_linux_kernel/> towards including code written in Mozilla’s Rust language in the Linux kernel. Albeit Torvalds sees it being used, initially at least, in parts “not very central to the kernel itself”, like drivers. A principal feature of Rust is the strict way it manages memory pointers, to limit the scope for common mistakes like memory leaks and double-frees. But unlike other languages like Java, Go or Kotlin, it does not bake the overhead of garbage collection into the language itself. This makes it more suitable for high-performance and lower-level tasks than those languages. More info here: <https://www.rust-lang.org/>.

1 0