- wlug - list.wlug.org.nz

Firefox 74 Arrives With Stricter Add-on Rules, TLS 1.0 and TLS 1.1 Disabled
by Peter Reutemann 11 Mar '20

11 Mar '20

'Mozilla today launched Firefox 74 for Windows, Mac, and Linux. Firefox 74 includes stricter rules for add-ons, TLS 1.0 and TLS 1.1 disabled by default, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/03/10/1515248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04’s zsys adds ZFS snapshots to package management [Updated]
by Peter Reutemann 11 Mar '20

11 Mar '20

'Last October, an experimental ZFS installer showed up in Eoan Ermine, the second interim Ubuntu release of 2019. Next month, Focal Fossa—Ubuntu's next LTS (Long Term Support) release—is due to drop, and it retains the ZFS installer while adding several new features to Ubuntu's system management with the fledgling zsys package. Phoronix reported this weekend that zsys is taking snapshots prior to package-management operations now, so we decided to install the latest Ubuntu 20.04 daily build and see how the new feature works.' -- source: https://arstechnica.com/gadgets/2020/03/ubuntu-20-04s-zsys-adds-zfs-snapsho… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Processors From 2011 To 2019 Vulnerable To Two New Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'AMD processors manufactured between 2011 and 2019 (the time of testing) are vulnerable to two new attacks, research published this week has revealed (PDF). The two new attacks impact the security of the data processed inside the CPU and allow the theft of sensitive information or the downgrade of security features. The research team said it notified AMD of the two issues in August 2019, however, the company has not released microcode (CPU firmware) updates, claiming these "are not new speculation-based attacks," a statement that the research team disagrees with. The two new attacks target a feature of AMD CPUs known as the L1D cache way predictor. Introduced in AMD processors in 2011 with the Bulldozer microarchitecture, the L1D cache way predictor is a performance-centric feature that reduces power consumption by improving the way the CPU handles cached data inside its memory. A high-level explanation is available below: "The predictor computes a uTag using an undocumented hash function on the virtual address. This uTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only oneway instead of all possible ways, reducing the power consumption." The two new attacks were discovered after a team of six academics [...] reverse-engineered this "undocumented hashing function" that AMD processors were using to handle uTag entries inside the L1D cache way predictor mechanism. Knowing these functions, allowed the researchers to recreate a map of what was going on inside the L1D cache way predictor and probe if the mechanism was leaking data or clues about what that data may be. While the attacks can be patched, AMD denies that these two new attacks are a concern, claiming they "are not new speculation-based attacks" and that they should be mitigated through previous patches for speculative execution side channel vulnerabilities. The research team says AMD's response is "rather misleading," and that the attacks still work on fully-updated operating systems, firmware, and software even today.' -- source: https://it.slashdot.org/story/20/03/09/2347202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPN and Ad-Blocking Apps Are Secretly Harvesting User Data
by Peter Reutemann 11 Mar '20

11 Mar '20

'Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps. Four of these -- Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus -- were recently available in the Google Play store. Adblock Focus and Luna VPN were in Apple's App Store. Apple removed Adblock Focus and Google removed Mobile Data after being contacted by BuzzFeed News. The companies said they continue to investigate. Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products. Sensor Tower's app intelligence platform is used by developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps. Randy Nelson, Sensor Tower's head of mobile insights, said the company's apps do not collect sensitive data or personally identifiable information and that "the vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting." But, as BuzzFeed points out, most of the apps are no longer available "because they were removed due to policy violations."' -- source: https://yro.slashdot.org/story/20/03/10/0148245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Vulnerable To New LVI Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.' -- source: https://it.slashdot.org/story/20/03/10/176200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo is Good Enough For Regular Use
by Peter Reutemann 10 Mar '20

10 Mar '20

'Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me. There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.' -- source: https://search.slashdot.org/story/20/03/09/1554252 I've been using DuckDuckGo for a number of years exclusively now and I agree with the author that when I can't find it with DDG, I can't find it with Google either. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Wikipedia's Volunteers Became the Web's Best Weapon Against Misinformation
by Peter Reutemann 10 Mar '20

10 Mar '20

'Fast Company just published a 4,000 appreciation of Wikipedia's volunteer editors: [W]hile places like Facebook, YouTube, and Twitter struggle to fend off a barrage of false content, with their scattershot mix of policies, fact-checkers, and algorithms, one of the web's most robust weapons against misinformation is an archaic-looking website written by anyone with an internet connection, and moderated by a largely anonymous crew of volunteers. "I think there's a part of that that is encouraging, that says that a radically open, collaborative worldwide project can build one of the most trusted sites on the internet," says Ryan Merkley, the chief of staff at the Wikimedia Foundation, the 400-person nonprofit that provides support to Wikipedia's community of editors. "There's another piece of that that is quite sad," he adds, "because it's clear that part of being one of the most trusted sites on the internet is because everything else has collapsed around us...." [U]nlike parts of the web where toxic information tends to spread, the encyclopedia has one big advantage: Its goal is not to "scale." It's not selling anything, not incentivizing engagement, not trying to get you to spend more time on it. Thanks to donations from thousands of donors around the world, there are no advertisers or investors to please, no algorithms to gather data or stir up emotions or personalize pages; everyone sees the same thing. That philanthropic spirit drives Wikipedia's volunteers, too, who come to the website not to share memes or jokes or even discuss the news but, marvelously, to build a reliable account of reality.... Despite the trolls and propagandists, the majority of errors, especially on controversial and highly trafficked pages, go away within minutes or hours, thanks to its phalanx of devoted volunteers. (Out of Wikipedia's 138 million registered users, about 138,000 have actively edited in the past month.) The site is self-governed according to a Byzantine body of rules that aim for courtesy and a "show your work" journalistic ethics built on accurate and balanced reporting. Vigilant community-built bots can alert Wikipedians to some basic suspicious behavior, and administrators can use restrictions to temporarily lock down the most vulnerable pages, keeping them safe from fly-by editors who are not logged in. "Most of these edits are small improvements to phrasing or content," says a 73-year-old retired physicist from Massachusetts who's done hundreds of edits himself. He adds that "a few are masterpieces, and some are vandalism."' -- source: https://news.slashdot.org/story/20/03/09/0346251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Says it Will Generate Random Browser Fingerprints To Preserve User Privacy
by Peter Reutemann 10 Mar '20

10 Mar '20

'The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.' -- source: https://yro.slashdot.org/story/20/03/09/1822258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Plans to Launch 'Forge', a Code-Hosting/Collaboration Platform
by Peter Reutemann 09 Mar '20

09 Mar '20

'The Free Software Foundation (FSF) announced plans to launch a public code hosting and collaboration platform ("forge") this year. Members of the FSF tech team are currently reviewing ethical web-based software that will help teams work on their projects, with features like merge requests, bug tracking, and other common tools. "Infrastructure is very important for free software, and it's unfortunate that so much free software development currently relies on sites that don't publish their source code, and require or encourage the use of proprietary software," FSF wrote in a blog post. "Our GNU ethical repository criteria aim to set a high standard for free software code hosting, and we hope to meet that with our new forge." As of now, the team said it has been researching a list of candidate programs and analyzing them in terms of ethical and practical criteria. The FSF blog post adds that "We plan on contributing improvements upstream for the new forge software we choose, to boost its score on those criteria... "We'll communicate with the upstream developers to request improvements and help clarify any questions related to the ethical repository criteria."' -- source: https://developers.slashdot.org/story/20/03/08/0323217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blu-ray discs on Linux
by Ian Young 08 Mar '20

08 Mar '20

Hello all, Having acquired a laptop with a Blu-ray drive and then a Blu-ray disc I had a go at playing the disc with various live Linux versions. The closest was having the disc recognised and opening a player window (VLC iirc) but alas with no sound or vision. Other attempts failed with messages about no AACs being available or being unable to recognise the disc. A cursory survey of various web sources indicates that the best plan is to give up or use Windows. Anyone managed to get anywhere with this in Linux? The disc in question is by the band King Crimson live in Mexico titled Meltdown. Described as NTSC, Zone ABC, LPCM playable in all B-R players and drives. Thanks ~ Ian Y

2 1