- wlug - list.wlug.org.nz

Open Source Initiative Co-Founder Bruce Perens Resigns, Citing Move Toward License 'That Isn't Freedom Respecting'
by Peter Reutemann 06 Jan '20

06 Jan '20

'Bruce Perens (Slashdot reader #3872) co-founded the Open Source Initiative with Eric Raymond in 1998. But on Thursday Perens posted "it seems to me that the organization is rather enthusiastically headed toward accepting a license that isn't freedom respecting. Fine, do it without me, please. "I asked Patrick to cancel my membership, and I would have unsubscribed from OSI lists, including this one, if your server was working..." The issue is a new software license drafted by lawyer Van Lindberg called the Cryptographic Autonomy License (or CAL). Another open-source-community leader familiar with the debate -- who spoke with The Register on condition of anonymity -- claimed Lindberg lobbied OSI directors privately to green-light the license, contrary to an approval process that's supposed to be carried out in public. "I don't think that's an appropriate characterization," said Lindberg, of law firm Dykema, in a phone interview with The Register. "I think there are number of people who from the beginning made up their minds about the Cryptographic Autonomy License. You'll see a lot of people jumping onto any pretext they can find in order to oppose it. With regard to this idea of lobbying, there have been procedural-type communications that I think are entirely reasonable," he added. "But all the substantive debate has been on the license review and license discussion forums...." Perens said he resigned because the OSI appears to have already decided to accept the license. He said he's headed in a different direction, which he called "coherent open source." "We've gone the wrong way with licensing," he said, citing the proliferation of software licenses. He believes just three are necessary, AGPLv3, the LGPLv3, and Apache v2. Meanwhile, the Cryptographic Autonomy License is envisioned for use with the distributed development platform Holo, notes the Register: According to Holo co-founder Arthur Brock, distributed peer-to-peer software needs a license that addresses cryptographic key rights, which is why the Cryptographic Autonomy License has been proposed. "We are trying to say: the only valid way to use our code is if that developer's end-users are the sole authors and controllers of their own private crypto keys," he wrote in a post last year. Lindberg said the Cryptographic Autonomy License is applicable to current web applications but it more meaningful in the context of distributed workloads and distributed computation, which he contends will become more important as people seek alternatives to the centralization of today's cloud-based systems. "A lot of people are very concerned about this concept of owning your data, owning your computer, having the ability to really control your computing experience and have it not be controlled by your cloud provider," said Lindberg. Perens said, "It's a good goal but it means you now need to have a lawyer to understand the license and to respond to your users." Slashdot asked Bruce Perens for details on "Coherent Open Source." Here's what he wrote back...' -- source: https://news.slashdot.org/story/20/01/05/208249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell's Upcoming XPS 13 Linux Laptop Includes a Fingerprint Reader
by Peter Reutemann 06 Jan '20

06 Jan '20

'If you've been following the steady march of progress from Dell's Linux-first Project Sputnik team, you're no doubt aware that the "Developer Edition" variant of the XPS 13 is one of the finest Linux-ready ultrabooks you can buy. Just ahead of CES 2020, Dell is pushing out a few more improvements including a feature that's been hotly requested: fingerprint-reader support. It's one of several enhancements Dell is promising to Linux users for its 10th-generation XPS 13, including a new maximum of 32GB RAM and a redesigned "InfinityEdge" display that adds even more screen real estate, resulting in an adjusted 16:10 aspect ratio to match... Details on fingerprint-reader support are still a bit vague, but Dell says it will be released shortly after the system's February 2020 launch as an OTA (over-the-air) update, and then as part of the preloaded Ubuntu Developer Edition image it ships with the system. Dell's lead on Project Sputnik developer systems, Barton George, also blogged about Dell's new 86-inch 4K interactive touch monitor, as well as their upcoming Latitude 9510 notebook and 2-in-1 laptops, promising "a new ultra-premium class of products" offering 5G mobile broadband capabilities, AI-based productivity capabilities, and 30-plus hours of battery life. The blog post ends by noting that "While project Sputnik is the most visible Linux-based offerings from Dell, it is only a small fraction of the over 150 systems that make up Dell's Linux portfolio."' -- source: https://linux.slashdot.org/story/20/01/05/0137242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Developers and Commits Dropped in 2019
by Peter Reutemann 06 Jan '20

06 Jan '20

'Phoronix reports that on New Year's Day, the Linux kernel's Git source tree showed 27,852,148 lines of code, divided among 66,492 files (including docs, Kconfig files, user-space utilities in-tree, etc). Over its lifetime there's been 887,925 commits, and around 21,074 different authors: During 2019, the Linux kernel saw 74,754 commits, which is actually the lowest point since 2013. The 74k commits is compares to 80k commits seen in both 2017 and 2018, 77k commits in 2016, and 75k commits in both 2014 and 2015. Besides the commit count being lower, the author count for the year is also lower. 2019 saw around 4,189 different authors to the Linux kernel, which is lower than the 4,362 in 2018 and 4,402 in 2017. While the commit count is lower for the year, on a line count it's about average with 3,386,347 lines of new code added and 1,696,620 lines removed... Intel and Red Hat have remained the top companies contributing to the upstream Linux kernel.' -- source: https://linux.slashdot.org/story/20/01/04/2335200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Employee error to blame for massive data leak, Wyze says
by Peter Reutemann 02 Jan '20

02 Jan '20

'Loads of folks found brand-new Wyze surveillance cameras under their trees or in their stockings this Christmas. And on Boxing Day, the company itself unwrapped a whole new world of trouble for everyone who uses its products, confirming a data leak that may have exposed personal data for millions of users over the course of a few weeks. Wyze first found out about the problem on the morning of December 26, company cofounder Dongsheng Song said in a corporate blog post. The company's investigation confirmed that user data was "not properly secured" and was exposed from December 4 onward. The database in question was basically a copy of the production database that Wyze created to work with, Song explained. Data points left exposed include user email addresses, camera nicknames, Wi-Fi network information, Wyze device information, some tokens associated with Alexa integrations, and "body metrics for a small number of product beta testers."' -- source: https://arstechnica.com/tech-policy/2019/12/surveillance-camera-company-wyz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi To Change User-Agent String To Chrome Due To Unfair Blocking
by Peter Reutemann 20 Dec '19

20 Dec '19

'Because some internet websites unfairly block browsers from accessing their services, starting with Vivaldi 2.10, released today, the Vivaldi browser plans to disguise itself as Chrome to allow users to access websites that unfairly block them. From a report: Vivaldi will do this by modifying its default user-agent (UA) string to the UA string used by Chrome. A UA string is a piece of text that browsers send to websites when they initiate a connection. The UA String contains data about the browser type, rendering engine, and operating system. For example, a UA string for Firefox on Windows looks like this: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0. UA strings have been in use since the 90s. For decades, websites have used UA agent strings to fine-tune performance and features or block outdated browsers. However, many website owners these days use UA strings to block users from accessing their sites. Some do it because they're not willing to deal with browser-specific bugs, some do it because of pettiness, while big tech companies like Google and Microsoft have done it (and continue to do it) to sabotage competitors on the browser market.' -- source: https://tech.slashdot.org/story/19/12/19/2041250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Nebula VPN routes between hosts privately, flexibly, and efficiently
by Peter Reutemann 20 Dec '19

20 Dec '19

'Last month, the engineering department at Slack—an instant messaging platform commonly used for community and small business organization—released a new distributed VPN mesh tool called Nebula. It's difficult to coherently explain Nebula in a nutshell. According to the people on Slack's engineering team, they asked themselves "what is the easiest way to securely connect tens of thousands of computers, hosted at multiple cloud service providers in dozens of locations around the globe?" And (developing) Nebula was the best answer they had. It's a portable, scalable overlay networking tool that runs on most major platforms, including Linux, MacOS, and Windows, with some mobile device support planned for the near future. Nebula-transmitted data is fully encrypted using the Noise protocol framework, which is also used in modern, highly security-focused projects such as Signal and WireGuard. Unlike more traditional VPN technologies—including WireGuard—Nebula automatically and dynamically discovers available routes between nodes and sends traffic down the most efficient path between any two nodes rather than forcing everything through a central distribution point.' -- source: https://arstechnica.com/gadgets/2019/12/nebula-vpn-routes-between-hosts-pri… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Facebook is Building an Operating System So it Can Ditch Android
by Peter Reutemann 20 Dec '19

20 Dec '19

'Facebook doesn't want its hardware like Oculus and Portal to be at the mercy of Google because they rely on its Android operating system. >From a report: That's why Facebook has tasked a co-author of Microsoft's Windows NT named Mark Lucovsky with building the social network an operating system from scratch, according the The Information's Alex Heath. "We really want to make sure the next generation has space for us," says Facebook's VP of hardware Andrew 'Boz' Bosworth. "We don't think we can trust the marketplace or competitors to ensure that's the case. And so we're gonna do it ourselves." By moving to its own OS, Facebook could have more freedom to bake social interaction -- and hopefully privacy -- deeper into its devices. It could also prevent a disagreement between Google and Facebook from derailing the roadmaps of Oculus, Portal, or future gadgets. One added bonus of moving to a Facebook-owned operating system? It could make it tougher to force Facebook to spin out some of its acquisitions, especially if Facebook goes with Instagram branding for its future augmented reality glasses.' -- source: https://tech.slashdot.org/story/19/12/19/1747243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple, Google, and Amazon team up to create “CHIP,” a new smart home standard
by Peter Reutemann 19 Dec '19

19 Dec '19

'Apple, Google, Amazon, and the Zigbee Alliance have all teamed up to make a new smart home standard. The new working group went live today under the name of "Project Connected Home over IP" with announcement blog posts from Google, Apple, Zigbee, and a new website, connectedhomeip.com. The name doesn't sound too catchy until you realize "Connected Home over IP" abbreviates to "CHIP" which, across all these blog posts, is quietly used only a single time in the official FAQ. According to the new website, "The goal of the Connected Home over IP project is to simplify development for manufacturers and increase compatibility for consumers." But thanks to XKCD, we all know that one new standard to "unite them all" often just results in making one additional standard available, but assuming the companies involved actually support their own standard, this could—maybe—make things easier for consumers.' -- source: https://arstechnica.com/gadgets/2019/12/apple-google-and-amazon-team-up-for… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate Speech Row: Fine Or Jail Anyone Who Calls People Boffins, Geeks or Eggheads, Psychology Nerd Demands
by Lawrence D'Oliveiro 19 Dec '19

19 Dec '19

>From <https://www.theregister.co.uk/2019/12/18/nerds_hate_speech/>: Labeling super-smart people with terms like nerd, geek, or boffin is hate speech, and should be punishable as such, argues lecturer and Harley-Street psychotherapist Dr Sonja Falck. ... She then embarked on a “contextual analysis of literature” and decided that calling someone a boffin was equivalent to the worst racial slurs. A couple of points occur to me. One is, one should be careful of the logical pitfalls of arguing “A is no better than B”. Because the flip side of that is that you are also saying “B is no worse than A”. In the process of trying to demonize A, and in the absence of any additional evidence for your position, you could be seen to be trivializing B. The other point is that targeted groups seem to be granted a licence to own terms which are used as slurs against them. These terms become accepted as commonplace inside the group, that nobody outside is allowed to use.

1 0

IoT is becoming popular
by leoole123＠yandex.ru 19 Dec '19

19 Dec '19

Smart technologies are rapidly spreading among ordinary users. More and more intelligent and remotely controlled equipment appears in our lives. But let’s see not from the user’s side. Let’s mind like a creator’s. Where is it better to place a “control center”? More and more integrators are transferring their capacities to the public cloud; there is formed a system for management. Labels from all things come through the gateways and are processed directly in the cloud. If the Internet connection is interrupted, all modules continue to work, and immediately after the appearance of the connections are synchronized. More details here: https://www.sim-networks.com/en/blog/iot-solutions-in-sim-cloud

1 0

Open Source Gets No Respect, Episode #310
by Lawrence D'Oliveiro 18 Dec '19

18 Dec '19

The developer of FUSE for macOS <https://www.theregister.co.uk/2019/12/16/fuse_macos_closed_source/> found that, while many companies were including his software in their commercial products, they were curiously reluctant to offer him any actual monetary support for his work. So he took the drastic step of making the latest version closed-source. While it continues to be available for non-commercial use at no charge, commercial vendors will need to license it for inclusion in their products. The result? He has actually got a bunch of licensing deals signed now.

2 1

Dyktando
by jakub.adecki＠interia.pl 18 Dec '19

18 Dec '19

Zachęcaj swojeg dzieco aby uczyło się ortografi. Zasady gramatyki i ortografii są konieczne do sukcesu w życiu. Za każdym razem warto dokonać korekty niewłaściwej pisowni. Dlatego tak ważne jest systematyczne ćwiczenie i nauka prawidłowej pisowni wyrazów. Sprawdź https://dyktanda.pl/

1 0

Microsoft Begins Accepting Extensions For Its Edge Chromium Browser
by Peter Reutemann 18 Dec '19

18 Dec '19

'Microsoft's new Chromium-based Edge browser is now open to developers to submit extensions. The updated version of Edge is set to launch on January 15. From a report: Microsoft says that if a developer has already created an extension for Google Chrome, there shouldn't be any additional work to port it over to Edge Chromium. The browser will be the new default delivered to all 900 million Windows 10 users, so developers should have no reason not to port their extensions over.' -- source: https://slashdot.org/story/19/12/17/1621248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla To Add Second DNS-over-HTTPS (DoH) Provider in Firefox
by Peter Reutemann 18 Dec '19

18 Dec '19

'Mozilla has announced that NextDNS would be joining Cloudflare as the second DNS-over-HTTPS (DoH) provider inside Firefox. From a report: The browser maker says NextDNS passed the conditions imposed by its Trusted Recursive Resolver (TRR) program, and can now be added as a second option for DoH inside Firefox. These conditions include (1) limiting the data NextDNS collects from the DoH server used by Firefox users; (2) being transparent about the data they collect; and (3) promising not to censor, filter, or block DNS traffic unless specifically requested by law enforcement. DNS-over-HTTPS, or DoH, is a new feature that was added to Firefox last year. When enabled, it encrypts DNS traffic coming in and out of the browser. DNS traffic is not only encrypted but also moved from port 53 (for DNS traffic) to port 443 (for HTTPS traffic), effectively hiding DNS queries and replies inside the browser's normal stream of HTTPS content. This encrypted DNS traffic reaches a so-called DoH resolver. Here, the DoH traffic is decrypted and the DoH resolver makes the DNS query on the user's behalf, receives the result, encrypts it, and sends it back to the user's browser -- also disguised inside encrypted HTTPS content.' -- source: https://tech.slashdot.org/story/19/12/17/1922254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Npm Team Warns of New 'Binary Planting' Bug
by Peter Reutemann 17 Dec '19

17 Dec '19

' The team behind npm, the biggest package manager for JavaScript libraries, issued a security alert yesterday, advising all users to update to the latest version (6.13.4) to prevent "binary planting" attacks. From a report: Npm (Node.js Package Manager) devs say the npm command-line interface (CLI) client is impacted by a security bug -- a combination between a file traversal and an arbitrary file (over)write issue. The bug can be exploited by attackers to plant malicious binaries or overwrite files on a user's computer. The vulnerability can be exploited only during the installation of a boobytrapped npm package via the npm CLI. "However, as we have seen in the past, this is not an insurmountable barrier," said the npm team, referring to past incidents where attackers planed backdoored or boobytrapped packages on the official npm repository. Npm devs say they've been scanning the npm portal for packages that may contain exploit code designed to exploit this bug, but have not seen any suspicious cases. "That does not guarantee that it hasn't been used, but it does mean that it isn't currently being used in published packages on the [official npm] registry," npm devs said.' -- source: https://it.slashdot.org/story/19/12/16/1513245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Halts Chrome 79 Rollout After It Breaks Some Android Apps
by Peter Reutemann 16 Dec '19

16 Dec '19

'Chrome 79 is creating an issue with WebView (the Android component that allows apps to display content from the web), reports 9to5Google: On Friday morning, Android developers reliant on WebView and local storage began encountering an issue where their apps lost data after users updated to version 79 of WebView. Those affected took to Chromium's bug tracker, and have described the incident as a "catastrophe" and "major issue." To end users, it's as if apps were entirely reset and just downloaded for the first time. This includes saved data disappearing or being logged out. Given the level of system opacity, most will blame developers for a problem that's out of their hands. By that afternoon, Google engineers responded and isolated the issue to "profile layout changes" where "local storage was missed off the list of files migrated." A member of the Chromium team apologized Saturday morning, with the Chrome/WebView rollout halted after 50% of devices already received the update. At the highest priority level (P0), Google is currently "working on a solution that minimizes the data loss, and that can be rolled out safely." The last guidance for a patch is 5-7 days.' -- source: https://tech.slashdot.org/story/19/12/15/181240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Link in Bio' is a Slow Knife
by Peter Reutemann 15 Dec '19

15 Dec '19

'Anil Dash: We don't even notice it anymore -- "link in bio." It's a pithy phrase, usually found on Instagram, which directs an audience to be aware that a pertinent web link can be found on that user's profile. Its presence is so subtle, and so pervasive, that we barely even noticed it was an attempt to kill the web. Links on the web are incredibly powerful. There are decades of theory behind the role of hyperlinks in hypertext -- did you know in most early versions, links were originally designed to be two-way? You'd be able to see every page on the web that links to this one. But even in the very simple form that we've ended up with on the World Wide Web for the last 30 years, links are incredibly powerful, opening up valuable connections between unexpected things. For a closed system, those kinds of open connections are deeply dangerous. If anyone on Instagram can just link to any old store on the web, how can Instagram -- meaning Facebook, Instagram's increasingly-overbearing owner -- tightly control commerce on its platform? If Instagram users could post links willy-nilly, they might even be able to connect directly to their users, getting their email addresses or finding other ways to communicate with them. Links represent a threat to closed systems. Here's the thing, though: people like links. So closed systems have to present a pressure release valve. Hashtags are a great way out. They use the semiotics of links (early versions of hashtags on social platforms were really barely more than automated links to a search for a particular term) but are also constrained by the platforms they live on. A hashtag is easier to gather into a database, to harvest, to monetize. It's much easier, sure, but it also doesn't have all the messiness of a real link. Instagram doesn't have to worry that clicking on its hashtags will accidentally lead people to Twitter, or vice versa.' -- source: https://tech.slashdot.org/story/19/12/12/1540216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Building Your Own Open Source, Privacy-Protecting Voice Assistant With A Raspberry Pi
by Peter Reutemann 15 Dec '19

15 Dec '19

'PC Magazine's "tech nerd" Whitson Gordon writes that "Once you start using a smart speaker to set reminders, play the news, or turn the lights on, it's hard to go back." But if you want the convenience of voice control without the data-collecting tech giant behind the scenes, an open-source project called Mycroft is a great alternative. And you can run it right on a Raspberry Pi. Mycroft is a free, open-source voice assistant designed to run on Linux-based devices... Mycroft has been around for quite a few years, but it's recently gained a bit more notoriety thanks to privacy concerns surrounding data collection at Amazon and Google. Unlike those assistants, Mycroft only collects data if you opt in during setup. And for the users who do opt in, Mycroft promises never to sell your data to advertisers or third parties -- instead, it only uses it to help developers improve the product. Mycroft even uses the privacy-focused DuckDuckGo as its search engine instead of Google when you ask for information. Mycroft makes its own smart speaker called the Mark I, though it's currently sold out with a new Mark II (video here) on the way. However, since the project is open-source, you can install Mycroft on just about any Linux machine, including the Raspberry Pi (thanks to a pre-made build called Picroft). Using Mycroft on the Pi is free, but you can also subscribe to a $1.99-per-month plan to help support its development -- you'll even get a few goodies, like other voices that sound more lifelike than the default robotic voice.' -- source: https://hardware.slashdot.org/story/19/12/14/1954242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Sells Its 30,000,000th Raspberry Pi
by Peter Reutemann 15 Dec '19

15 Dec '19

'In a reply to a Twitter post, Raspberry Pi Foundation's CEO Eben Upton announced that they have sold their thirty-millionth Raspberry Pi. "We don't get sales returns from our licensees until month end," Upton acknowledged in a later tweet, but "at the end of November, we were at 29.8Mu, with a monthly run rate of 500-600ku..."' -- source: https://build.slashdot.org/story/19/12/14/203231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Managing Spectre/Meltdown-Style Vulnerabilities At AWS
by Lawrence D'Oliveiro 15 Dec '19

15 Dec '19

Some insights <https://www.theregister.co.uk/2019/12/10/linux_kernel_aws/> into the different priorities often faced by different groups faced with the same problem. Linux kernel developer Greg Kroah-Hartman says to avoid most of these “MDS” (“Microarchitectural Data Sampling”) vulnerabilities, you must turn off Intel’s hyperthreading, full stop. Amazon, on the other hand, find that the resulting 30-40% performance loss is unacceptable for many of their customers. So they have come up with a tweaked scheduler algorithm for their Linux kernels that avoids running two different guests on the same physical core at the same time. With this and other careful management, they claim to be able to keep their customers safe from each other, with much less dramatic performance impact. But then you have the downside that the mainline kernel is not interested in accepting patches with such narrow applicability. Of course Amazon would like to come up with something they will accept, just to reduce their own maintenance burden.

1 0

Mozilla To Force All Add-on Devs To Use 2FA To Prevent Supply-Chain Attacks
by Peter Reutemann 14 Dec '19

14 Dec '19

'Mozilla announced this week that all developers of Firefox add-ons must enable a two-factor authentication (2FA) solution for their account. From a report: "Starting in early 2020, extension developers will be required to have 2FA enabled on AMO [the Mozilla Add-Ons portal]," said Caitlin Neiman, Add-ons Community Manager at Mozilla. "This is intended to help prevent malicious actors from taking control of legitimate add-ons and their users," Neiman added. When this happens, hackers can use the developers' compromised accounts to ship tainted add-on updates to Firefox users. Since Firefox add-ons have a pretty privileged position inside the browser, an attacker can use a compromised add-on to steal passwords, authentication/session cookies, spy on a user's browsing habits, or redirect users to phishing pages or malware download sites. These types of incidents are usually referred to as supply-chain attacks.' -- source: https://it.slashdot.org/story/19/12/13/152239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Two of China's Largest Tech Firms Are Uniting To Create a New 'Domestic OS'
by Peter Reutemann 13 Dec '19

13 Dec '19

'The two biggest OS (operating system) makers in China announced plans last week to unite and jointly build a new "domestic operating system." From a report: The two companies are China Standard Software (CS2C) and Tianjin Kylin Information (TKC), two of China's largest software firms, with known ties to the Beijing government. Both companies are known on the local Chinese OS market. CS2C created "China's Windows XP clone," known as the NeoKylin OS, and TKC is the current steward of Kylin, China's first-ever homegrown operating system. CS2C and TKC plan to set up a new company in which they'll become investors, and through which the new joint OS will be developed. The new company will handle the new operating system's development, technological decisions, marketing, branding, financials, and sales. The current Kylin and NeoKylin operating systems will serve as a base for the new OS, the two said.' -- source: https://tech.slashdot.org/story/19/12/12/146246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Police Raid NGINX Moscow Office
by Peter Reutemann 13 Dec '19

13 Dec '19

'Russian police have raided today the Moscow offices of NGINX, Inc., a subsidiary of F5 Networks and the company behind the internet's most popular web server technology. From a report: Equipment was seized and employees were detained for questioning. Moscow police executed the raid after last week the Rambler Group filed a copyright violation against NGINX Inc., claiming full ownership of the NGINX web server code. The Rambler Group is the parent company of rambler.ru, one of Russia's biggest search engines and internet portals. According to copies of the search warrant posted on Twitter today, Rambler claims that Igor Sysoev developed NGINX while he was working as a system administrator for the company, hence they are the rightful owner of the project. Sysoev created NGINX in the early 2000s and open-sourced the NGINX code in 2004. In 2009, he founded NGINX, Inc., a US company, to provide adjacent tools and support services for NGINX deployments. The company is based in San Francisco, but has offices all over the world, including Moscow. The NGINX server's source code is still free and managed through an open-source model, although a large chunk of the project's primary contributors are NGINX, Inc. employees, who have a firm grip on the project's stewardship.' -- source: https://news.slashdot.org/story/19/12/12/175245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Inside the Podcast that Hacks Ring Camera Owners Live on Air
by Peter Reutemann 13 Dec '19

13 Dec '19

'In the NulledCast podcast hackers livestream the harassment of Ring camera owners after accessing their devices. Hundreds of people can listen. From a report: A blaring siren suddenly rips through the Ring camera, startling the Florida family inside their own home. "It's your boy Chance on Nulled," a voice says from the Ring camera, which a hacker has taken over. "How you doing? How you doing?" "Welcome to the NulledCast," the voice says. The NulledCast is a podcast livestreamed to Discord. It's a show in which hackers take over people's Ring and Nest smarthome cameras and use their speakers to talk to and harass their unsuspecting owners. In the example above, Chance blared noises and shouted racist comments at the Florida family. "Sit back and relax to over 45 minutes of entertainment," an advertisement for the podcast posted to a hacking forum called Nulled reads. "Join us as we go on completely random tangents such as; Ring & Nest Trolling, telling shelter owners we killed a kitten, Nulled drama, and more ridiculous topics. Be sure to join our Discord to watch the shows live." Software to hack Ring cameras has recently become popular on the forum. The software churns through previously compromised email addresses and passwords to break into Ring cameras at scale. This has led to a recent spate of hacks that have occurred both during the podcast and at other times, several of which have been covered by local media outlets. In Brookhaven a hacker shouted at a sleeping woman through her hacked Ring camera to wake-up. In Texas, a hacker demanded a couple pay a bitcoin ransom. Hackers targeted a family in DeSoto County, Mississippi, and spoke through the device to one of the young children.' -- source: https://yro.slashdot.org/story/19/12/12/204240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Customizing A KDE Desktop
by Lawrence D'Oliveiro 11 Dec '19

11 Dec '19

A video <https://www.youtube.com/watch?v=uyz4-KZOzyI> showing how to set up KDE with an Apple-style dock and the application menu at the top of the screen (with some extra widgets added). Not something I would do myself, but it shows how configurable KDE can be.

1 0