- wlug - list.wlug.org.nz

Linux Performs Poorly In Low RAM / Memory Pressure Situations On The Desktop
by Peter Reutemann 06 Aug '19

06 Aug '19

'It's been a gripe for many running Linux on low RAM systems especially is that when the Linux desktop is under memory pressure the performance can be quite brutal with the system barely being responsive. The discussion over that behavior has been reignited this week. From a report: Developer Artem S Tashkinov took to the kernel mailing list over the weekend to express his frustration with the kernel's inability to handle low memory pressure in a graceful manner. If booting a system with just 4GB of RAM available, disabling SWAP to accelerate the impact/behavior, and launching a web browser and opening new web pages / tabs can in a matter of minutes bring the system down to its knees. Artem elaborated on the kernel mailing list, "Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I'm not entirely sure why). You will not be able to run new applications or close currently running ones. This little crisis may continue for minutes or even longer. I think that's not how the system should behave in this situation. I believe something must be done about that to avoid this stall."' -- source: https://linux.slashdot.org/story/19/08/06/1839206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Final Red Hat Enterprise Linux 7 Version Released
by Peter Reutemann 06 Aug '19

06 Aug '19

'The last RHEL release, RHEL 7.7, is now available for current Red Hat Enterprise Linux subscribers via the Red Hat Customer Portal. ZDNet reports on what's new: RHEL 7.7's most important updates are support for the latest generation of enterprise hardware and remediation for the recently disclosed ZombieLoad vulnerabilities. The latest RHEL 7 also includes network stack performance enhancements. With this release, you can offload virtual switching operations to network interface card (NIC) hardware. What that means for you is, if you're using virtual switching and network function virtualization (NFV), you'll see better network performance on cloud and container platforms such as Red Hat OpenStack Platform and Red Hat OpenShift. RHEL 7.7 users can also use Red Hat's new predictive problem shooter: Red Hat Insights. This uses a software-as-a-service (SaaS)-based predictive analytics approach to spot, assess, and mitigate potential problems to their systems before they can cause trouble. For developers, RHEL 7.7 comes with Python 3.6 interpreter, and the pip and setup tools utilities. Previously, Python 3 versions were available only as a part of Red Hat Software Collections. Moving on to the cloud, RHEL 7.7 Red Hat Image Builder is now supported. This feature, which is also in RHEL 8, enables you to easily create custom RHEL system images for cloud and virtualization platforms such as Amazon Web Services (AWS), VMware vSphere, and OpenStack. To help cloud-native developers, RHEL 7.7 includes full support for Red Hat's distributed-container toolkit -- buildah, podman, and skopeo -- on RHEL workstations. After building on the desktop, programmers can use Red Hat Universal Base Image to build, run, and manage containerized applications across the hybrid cloud.' -- source: https://linux.slashdot.org/story/19/08/06/208202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Half of All Google Chrome Extensions Have Fewer Than 16 Installs
by Peter Reutemann 05 Aug '19

05 Aug '19

'There are 188,620 extensions available on the Chrome Web Store, and while you might think this provides a wide variety of choices for Chrome users, in reality, most of these extensions are dead or dwindling, with very few having active installations. From a report: All in all, about 50% of all Chrome extensions have fewer than 16 installs, meaning that half of the Chrome extension ecosystem is actually more of a ghost town, according to a recent scan of the entire Chrome Web Store conducted by Extension Monitor. Further, 19,379 extensions (just over 10%) have zero installs, and 25,540 extensions (13% of the total) have just one user. The scan found that there are very few Chrome extensions that managed to establish a dedicated userbase. According to Extension Monitor, around 87% of all extensions have fewer than 1,000 installs.' -- source: https://tech.slashdot.org/story/19/08/05/144246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei Tests Smartphone With Own OS, Could Potentially Start Selling Them Later This Year
by Peter Reutemann 05 Aug '19

05 Aug '19

'Huawei is testing a smartphone equipped with Hongmeng, the company's self-developed operating system, which could potentially go on sale by the end of this year, Chinese state-media outlet Global Times reported. From a report: The release of a Hongmeng-powered smartphone would mark a major step for China's Huawei, the world's second-biggest maker of smartphones, as U.S. government actions threaten its access to Google's Android operating system. The device will be priced at around 2,000 yuan ($288), the Global Times said on Sunday, citing unnamed sources. That will place the device toward the low-end segment of the smartphone market. Huawei executives have previously described Hongmeng as an operating system designed for internet-of-things products. Last month the company said the first major devices powered by Hongmeng would be its upcoming line of Honor-brand smart TVs.' -- source: https://mobile.slashdot.org/story/19/08/05/1515218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME and KDE Join Forces To Co-Host Linux App Summit
by Peter Reutemann 05 Aug '19

05 Aug '19

'GNOME and KDE are co-hosting this year's Linux App Summit (LAS) in Barcelona from November 12th to 15th. An anonymous reader shared the big announcement: LAS is the first collaborative event co-hosted by the two organizations since the Desktop Summit in 2009. Both organizations are eager to bring their communities together in building an application ecosystem that transcends individual distros and broadens the market for everyone involved. KDE and GNOME will no longer be taking a passive role in the free desktop sector. With the joint influence of the two desktop projects, LAS will shepherd the growth of the FOSS desktop by encouraging the creation of quality applications, seeking opportunities for compensation for FOSS developers, and fostering a vibrant market for the Linux operating system. * "I am excited to see GNOME and KDE working together on LAS, and I believe that the event will help lay down strong foundations for collaborative cross-project development that would benefit Linux users across all distributions and on any compatible device." -- Christel Dahlskjaer, Private Internet Access and freenode Project Lead. * "Together with GNOME, counting with the collaboration of many distributions and application developers, we'll have the opportunity to work side by side, share our perspectives and offer the platform that the next generation of solutions will be built on." -- Aleix Pol Gonzalez, KDE e.V Vice-President says about the inaugural effort about LAS. * "By partnering with KDE we show the desire to build the kind of application ecosystem that demonstrates that Open Source and Free Software are important; the technology and organization we build to achieve this is valuable and necessary." -- GNOME executive director, Neil McGovern * "The desktop wars is not really a thing any more. It makes more sense to work together and pool resources." -- Paul Brown, a KDE Communications Specialist (quoted by ZDNet) ZDNet called the collaboration "a major step forward," giving their story the headline "GNOME and KDE work together on the Linux desktop." But the Twitter feed for the KDE community quickly clarified that KDE "is working with GNOME to create a common, fair, sustainable and open app ecosystem, not a desktop." "The GNOME and KDE communities want to provide users with free and open applications that will respect their privacy and rights. That is what Linux App Summit is about."' -- source: https://linux.slashdot.org/story/19/08/03/0240209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Just Stopped Displaying 'www' and 'https' In Chrome's Address Bar
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Google has finally chopped the 'www' from Chrome's address bar after delaying the controversial move due to a backlash," reports TechRepublic: The move to remove 'www' was initially planned for last year, when Google announced it would cut "trivial subdomains" from the address bar in Chrome 69. Now Google has begun truncating the visible URL in Chrome for desktop and Android, rolling out the change in version 76 of the browser, released this week. By default sites in Chrome now no longer display the "https" scheme or the "www" subdomain, with the visible address starting after this point. To view the full URL, users now have to click the address bar twice on desktop and once on mobile. Google has argued the move is driven by a desire for greater simplicity and usability of Chrome... However the announcement provoked a fresh wave of criticism, from those who say the move will confuse users and even potentially make it easier for them to inadvertently connect to fake sites... There are also some who claim Google's motivation in changing how the URL is displayed may be to make it harder for users to tell whether they are on a page hosted on Google's Accelerated Mobile Pages subdomain... Google says it has also built a Chrome extension that doesn't obfuscate the URL to "help power users recognize suspicious sites and report them to Safe Browsing". Despite the backlash from some online, Chrome isn't the first browser to truncate the URL in this way, with Apple's Safari similarly hiding the full address. ' -- source: https://tech.slashdot.org/story/19/08/03/0317238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Quietly Gives Alexa's Voice Recordings a 'No Human Review' Option
by Peter Reutemann 04 Aug '19

04 Aug '19

'"Amazon Alexa users can now choose whether human reviewers listen to recordings of their exchanges with the AI assistant," reports VentureBeat, citing an Amazon spokesperson. To ensure people don't listen to voice recordings collected following each exchange with Alexa, go to Settings, tap the Alexa Privacy link, then choose Manage How Your Data Improves Alexa. Users can also delete their voice recordings via the Alexa app or Amazon website. The news follows Amazon's introduction of an "Alexa, delete what I said today" voice command in May... Earlier this week, Google and Apple both pledged to suspend some of their voice data review by people. ' -- source: https://yro.slashdot.org/story/19/08/04/0159227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Vulnerabilities Found In WPA3 WiFi Standard
by Peter Reutemann 04 Aug '19

04 Aug '19

'Slashdot reader Artem S. Tashkinov writes: Mathy Vanhoef and Eyal Ronen have recently disclosed two new additional bugs impacting WPA3. The security researched duo found the new bugs in the security recommendations the WiFi Alliance created for equipment vendors in order to mitigate the initial Dragonblood attacks [found by the same two security researchers]. "Just like the original Dragonblood vulnerabilities from April, these two new ones allow attackers to leak information from WPA3 cryptographic operations and brute-force a WiFi network's password," reports ZDNet. More from ZDNet: "[The] Wi-Fi standard is now being updated with proper defenses, which might lead to WPA3.1," Vanhoef said. "Although this update is not backwards-compatible with current deployments of WPA3, it does prevent most of our attacks," the researchers said. But besides just disclosing the two new Dragonblood vulnerabilities, the two researchers also took the chance to criticize the WiFi Alliance again for its closed standards development process that doesn't allow for the open-source community to contribute and prevent big vulnerabilities from making it into the standard in the first place. "This demonstrates that implementing Dragonfly and WPA3 without side-channel leaks is surprisingly hard," the researchers said. "It also, once again, shows that privately creating security recommendations and standards is at best irresponsible and at worst inept." While these type of feedback might be ignored when coming from other researchers, it means more when it comes from Vanhoef. The Belgian researchers is the one who discovered the KRACK attack that broke the WPA2 WiFi authentication standard and forced the WiFi Alliance to develop the WPA3 standard, which it launched in June 2018.' -- source: https://mobile.slashdot.org/story/19/08/04/1821237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Listening Post On VPNs
by Lawrence D'Oliveiro 03 Aug '19

03 Aug '19

This week’s episode of “The Listening Post” on Al Jazeera <https://www.aljazeera.com/programmes/listeningpost/2019/07/vazajato-dirty-d…> covers, in the latter part, an overview of the increasing popularity of VPNs. It also mentions some of their potential pitfalls.

1 0

Did Facebook End The Encryption Debate?
by Peter Reutemann 02 Aug '19

02 Aug '19

'Forbes contributor Kalev Leetaru argues that "the encryption debate is already over -- Facebook ended it earlier this year." The ability of encryption to shield a user's communications rests upon the assumption that the sender and recipient's devices are themselves secure, with the encrypted channel the only weak point... [But] Facebook announced earlier this year preliminary results from its efforts to move a global mass surveillance infrastructure directly onto users' devices where it can bypass the protections of end-to-end encryption. In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user's device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted. The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service... If Facebook's model succeeds, it will only be a matter of time before device manufacturers and mobile operating system developers embed similar tools directly into devices themselves, making them impossible to escape... Governments would soon use lawful court orders to require companies to build in custom filters of content they are concerned about and automatically notify them of violations, including sending a copy of the offending content. Rather than grappling with how to defeat encryption, governments will simply be able to harness social media companies to perform their mass surveillance for them, sending them real-time alerts and copies of the decrypted content. Putting this all together, the sad reality of the encryption debate is that after 30 years it is finally over: dead at the hands of Facebook. If the company's new on-device content moderation succeeds it will usher in the end of consumer end-to-end encryption and create a framework for governments to outsource their mass surveillance directly to social media companies, completely bypassing encryption. In the end, encryption's days are numbered and the world has Facebook to thank. ' -- source: https://it.slashdot.org/story/19/07/27/206248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1