- wlug - list.wlug.org.nz

Fwd: [nzpug] some CC licensed ebooks (PDF)
by Peter Reutemann 27 Aug '19

27 Aug '19

Apologies for cross-posting, but these ebooks may be of interest to you. Cheers, Peter -------- Original Message -------- From: "Guy K. Kloss" <guy(a)kloss.nz> Sent: August 27, 2019 6:01:51 PM GMT+10:00 To: New Zealand Python User Group <nzpug(a)googlegroups.com> Subject: [nzpug] some CC licensed ebooks (PDF) Kia ora, there's a Python book here as well, but I didn't check the quality of it. But there are a bunch of other books of varying levels of quality. All licensed in open source (CC-SA) and published (I think) by Stack Overflow. https://goalkicker.com/ The odd one might be interesting to the odd one ... Cheers, Guy -- ----> µ wisdom brought to you by Guy K. Kloss <---- »Wo kämen wir hin, wenn jeder sagen würde | ... guy(a)kloss.nz ... "wo kämen wir hin?" | Phone: +64-9-550 8499 und keiner ginge los, | Mobile: +64-210 2323 715 um zu sehen, wo wir hinkämen« -- You received this message because you are subscribed to the Google Groups "New Zealand Python User Group" group. To unsubscribe from this group and stop receiving emails from it, send an email to nzpug+unsubscribe(a)googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/nzpug/7f89885c-0c08-407b-d9bc-571c2028ed8…. -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Knoppix 8.6 - anyone have the iso?
by Ian Young 26 Aug '19

26 Aug '19

I have not so far been able to download the 4.3 gig DVD iso file after a number of attempts from various mirrors - I have not found any in New Zealand. Anyone have the iso? Professor Knopper has it seems removed systemd from Knoppix. "The still controversial startup systemd, which has been a little outrageous due to security vulnerabilities just recently <https://www.zdnet.com/article/new-linux-systemd-security-holes-uncovered/>, has been integrated in Debian since Jessie [8.0], and has been removed since Knoppix 8.5. I bypass hard dependencies on the boot system with my own packages. To still get a systemd-like session management, and thus retain the ability to shut down and restart the system as a normal user, I run the session manager "elogind" instead. This bypasses systemd's interference with many system components and reduces the complexity of the overall system. If you want to start your own services at startup, you do not need to create any systemd units, but simply enter them in the text file */etc/rc.local*, which contains explanatory examples."

3 2

KDE Konsole v19
by Lawrence D'Oliveiro 24 Aug '19

24 Aug '19

Just did my roughly-monthly Debian Unstable upgrade. The most noticeable change so far (apart from Linux kernel 5.2) is a new version of the KDE Konsole terminal emulator, going from version 18 to version 19. This one has close icons by default on each tab, which I have decided (after closing one tab I didn’t mean to) are too dangerous to click accidentally, so I have turned them off. Another change is that the shortcuts for moving tabs left/right have changed from ctrl-shift-left/right to ctrl-alt-left/right. This means I have to move my fingers slightly from the ctrl-shift-T shortcut that creates a new tab, to the ones for reordering it. On the other hand, I don’t do that too often ...

1 0

Google Chrome Proposes 'Privacy Sandbox' To Reform Advertising Evils
by Peter Reutemann 24 Aug '19

24 Aug '19

'Google's Chrome team proposed a "privacy sandbox" Thursday that's designed to give us the best of both worlds: ads that publishers can target toward our interests but that don't infringe our privacy. From a report: It's a major development in an area where Chrome, the dominant browser, has lagged competitors. Browsers already include security sandboxes, restrictions designed to confine malware to limit its possible damage. Google's proposed privacy sandbox would similarly restrict tracking technology, according to proposal details Google published. The privacy sandbox is "a secure environment for personalization that also protects user privacy," said Justin Schuh, a director of Chrome Engineering focused on security matters, in a privacy sandbox blog post. "Our goal is to create a set of standards that is more consistent with users' expectations of privacy." For example, Chrome would restrict some private data to the browser -- an approach rival Brave Software has taken with its privacy-focused rival web browser. And it could restrict sharing personal data until it's shared across a large group of people using technologies called differential privacy and federated learning.' -- source: https://yro.slashdot.org/story/19/08/22/1453220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How The National Library Preserves New Zealand’s Digital Heritage
by Lawrence D'Oliveiro 24 Aug '19

24 Aug '19

A nice overview <https://www.stuff.co.nz/national/115118698/how-the-national-library-preserv…> of what it means to preserve historical documents in the digital online age. What happens when the legal obligations of the National Library collide with the terms and conditions of overseas-run sites hosting content posted by New Zealanders? How do you deal with private/defamatory/pornographic material? Proprietary file formats? Some people are even donating their e-mail archives to the Library.

1 0

Fwd: [NZLUG] Windows rebate?
by Peter Reutemann 23 Aug '19

23 Aug '19

Apologies for cross-posting, but this will be of interest to this group as well. Cheers, Peter ---------- Forwarded message --------- From: Atom Smasher <atom(a)smasher.org> Date: Fri, Aug 23, 2019 at 10:49 AM Subject: Re: [NZLUG] Windows rebate? To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> I was hoping this battle had already been fought, but apparently not. After some phone calls, it seems the best course of action now is to contact The Commerce Commission of New Zealand and file a complaint pursuant to the Fair Trading Act. They don't handle these complaints individually, but they will consider them in aggregate. So the more people complain, the more likely that it will be taken seriously. * 0800 943 600 * contact(a)comcom.govt.nz * https://comcom.govt.nz/make-a-complaint Relevant points seem to be that Microsoft has effectively created a monopoly whereby purchasers of new computers are forced to purchase a copy of, and non-transferable license for, their Windows operating system (approx retail price of OEM Windows 10 is $160). Building ones own computer from parts, or purchasing a computer from specialty retailers may be an option in some cases, but this severely limits consumer choices and they're not viable options for a lot of people. While it may not be practical to "force" retailers to stock Windows-free PC hardware, there should be a standard process for obtaining a fair refund for unused and unwanted Windows operating system licenses. -- ...atom ________________________ http://atom.smasher.org/ 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808 ------------------------------------------------- "Sometimes I think we're alone in the universe, and sometimes I think we're not. In either case the idea is quite staggering." -- Arthur C. Clarke _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 6

Security Researchers Find Several Bugs In Nest Security Cameras
by Peter Reutemann 23 Aug '19

23 Aug '19

'Hackers could have logged into your Nest Cam IQ Indoor and watch whatever was happening in your home by taking advantage of a vulnerability found by security researchers. The hackers could have also prevented you from using the camera, or use access to it to break into your home network. Researchers Lilith Wyatt and Claudio Bozzato of Cisco Talos discovered the vulnerabilities and disclosed them publicly on August 19. The two found eight vulnerabilities that are based in the Nest implementation of the Weave protocol. The Weave protocol is designed specifically for communications among Internet of Things or IoT devices. Nest has provided a firmware update that the company says will fix the vulnerabilities. The vulnerabilities apply to version 4620002 of the Nest Cam IQ indoor device. You can check the version of your camera on the Nest app. Nest says that the updates will happen automatically if your camera is connected to the internet. "We've fixed the disclosed bugs and started rolling them out to all Nest Camera IQs," Google said in a statement to ZDNet. "The devices will update automatically so there's no action required from users."' -- source: https://it.slashdot.org/story/19/08/22/2134208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Backdoor found in Webmin, a popular web-based utility for managing Unix servers
by Peter Reutemann 22 Aug '19

22 Aug '19

'A backdoor mechanism was found in Webmin, a popular web-based application used by system administrators to manage remote Unix-based systems, such as Linux, FreeBSD, or OpenBSD servers. The backdoor mechanism would allow a remote attacker to execute malicious commands with root privileges on the machine running Webmin. Once this machine is compromised, an attacker could then use it to launch attacks on the systems managed through Webmin. [...] According to one of the Webmin developers, the vulnerability was not the result of a coding mistake, but was actually "malicious code injected into compromised build infrastructure."' -- source: https://www.zdnet.com/article/backdoor-found-in-webmin-a-popular-web-based-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Ditches Desserts as Q Becomes 10
by Peter Reutemann 22 Aug '19

22 Aug '19

'The next version of the Android operating system (OS) will not be named after a dessert or sweet treat, ending a tradition that started in 2009. From a report: Following the pattern, the name of the new version would have started with Q. But Google said it had ditched the naming scheme because it made it difficult for consumers to know which version of the OS was the latest. The new edition, which will be released later this year, will be called Android 10. Previous versions of the mobile operating system have been nicknamed Jellybean, Kitkat and Lollipop' -- source: https://tech.slashdot.org/story/19/08/22/187243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Planet Needs a New Internet
by Peter Reutemann 22 Aug '19

22 Aug '19

'When climate change comes for our coffee and our wine, we'll moan about it on Twitter, read about it on our favorite websites, and watch diverting videos on YouTube to fill the icy hole in our hearts. We'll do all this until the websites go dark and the networks go down because eventually, climate change will come for our internet, too. That is, unless we can get the web ready for the coming storms. Huge changes will be needed because right now, the internet is unsustainable. On the one hand, rising sea levels threaten to swamp the cables and stations that transmit the web to our homes; rising temperatures could make it more costly to run the data centers handling ever-increasing web traffic; wildfires could burn it all down. On the other, all of those data centers, computers, smartphones, and other internet-connected devices take a prodigious amount of energy to build and to run, thus contributing to global warming and hastening our collective demise. To save the internet and ourselves, we'll need to harden and relocate the infrastructure we've built, find cleaner ways to power the web, and reimagine how we interact with the digital world. Ultimately, we need to recognize that our tremendous consumption of online content isnâ(TM)t free of consequences -- if we're not paying, the planet is. You probably don't think about it when you're liking a photo or reading an article, but everything you do online is underpinned by a globe-spanning labyrinth of physical infrastructure. There are the data centers hosting the web and managing enormous flows of information on the daily. There are the fiber cables transmitting data to into our homes and offices, and even across oceans. There are cell towers sending and receiving countless calls and texts on the daily.' -- source: https://tech.slashdot.org/story/19/08/22/1733253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KNOPPIX Live GNU/Linux System Is Now Based on Debian GNU/Linux 10 "Buster"
by Peter Reutemann 21 Aug '19

21 Aug '19

'KNOPPIX 8.6 is now available based on the software repositories of the recently released Debian GNU/Linux 10 "Buster" operating system series, but also packing some elements from the Debian Uunstable (Sid) repos. It's powered by the latest Linux 5.2 kernel series and X.Org Server 7.7 display server to support newer graphics cards and computer hardware. Best of all, Knoppix 8.6 is shipping with both 32-bit and 64-bit kernels to support old and new computers. The 64-bit version of KNOPPIX 8.6 supports machines with more than 4GB of RAM (system memory), as well as chroot into 64-bit installations for system rescue tasks. Moreover, the bootloader starts the 64-bit kernel automatically whenever a 64-bit CPU is detected.' -- source: https://news.softpedia.com/news/knoppix-live-gnu-linux-system-is-now-based-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bitbucket Dropping Support For Mercurial
by Peter Reutemann 21 Aug '19

21 Aug '19

'Bitbucket, once one of the largest Mercurial repository hosting sites, said Tuesday it plans to remove Mercurial features and repositories from its platform on June 1, 2020. In a blog post, Bitbucket wrote: As we surpass 10 million registered users on the platform, we're at a point in our growth where we are conducting a deeper evaluation of the market and how we can best support our users going forward. After much consideration, we've decided to remove Mercurial support from Bitbucket Cloud and its API. Bitbucket will stop letting users create new Mercurial repositories starting February 1, 2020, and start removing all the Mercurial repositories four months later. So you will want to backup your repositories and switch to a different platform in the coming months. A different user pointed out, "Another shitty aspect of bitbucket dropping mercurial support and deleting all the old repositories in 2020: all yt pull request discussions from before 2017 are going to be deleted. There's valuable context for how the code got written in those discussions." Several users have expressed their concerns over this decision. Sebastien Jodogne, CSO at Osimis, said, "This is an extremely concerning decision that endangers diversity in the computer science industry by pushing the de facto hegemony of git." For those of you affected by this, you can consider a number of platforms including SourceForge to host and manage your repositories. ' -- source: https://developers.slashdot.org/story/19/08/20/1654253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

IBM is Moving OpenPower Foundation To The Linux Foundation
by Peter Reutemann 21 Aug '19

21 Aug '19

'IBM makes the Power Series chips, and as part of that has open sourced some of the underlying technologies to encourage wider use of these chips. The open source pieces have been part of the OpenPower Foundation. Today, the company announced it was moving the foundation under The Linux Foundation, and while it was at it, announced it was open sourcing several other important bits. From a report: Ken King, general manager for OpenPower at IBM, says that at this point in his organization's evolution, they wanted to move it under the auspices of the Linux Foundation. But IBM didn't stop there. It also announced that it was open sourcing some of the technical underpinnings of the Power Series chip to make it easier for developers and engineers to build on top of the technology. Perhaps most importantly, the company is open sourcing the Power Instruction Set Architecture (ISA). These are "the definitions developers use for ensuring hardware and software work together on Power," the company explained. King sees open sourcing this technology as an important step for a number of reasons around licensing and governance. "The first thing is that we are taking the ability to be able to implement what we're licensing, the ISA instruction set architecture, for others to be able to implement on top of that instruction set royalty free with patent rights," he explained. The company is also putting this under an open governance workgroup at the OpenPower Foundation.' -- source: https://news.slashdot.org/story/19/08/20/197244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WebKit Introduces New Tracking Prevention Policy
by Peter Reutemann 21 Aug '19

21 Aug '19

'WebKit, the open source HTML engine used by Apple's Safari browser and a number of others, has created a new policy on tracking prevention. The short version is that many forms of tracking will now be treated the same way as security flaws, being blocked or mitigated with no exceptions. While on-site tracking will still be allowed (and is practically impossible to prevent anyway), all forms of cross-site tracking and covert tracking will be actively and aggressively blocked.' -- source: https://it.slashdot.org/story/19/08/20/1522235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

tilix - terminal emulator
by Peter Reutemann 20 Aug '19

20 Aug '19

Hi everyone I've been a long-term user of the gnome terminal and then the mate terminal (after switching to Linux Mint). Despite the tab-support that these terminals offer, there were occasions when I missed being able to tile (ie vertical or horizontal split) in the same window rather than opening another window (and then moving/resizing it to make it fit better). Over the last month or so, I've been trialing "tilix" as my everyday terminal and I have to say that I'm very happy with it! According to the website, tilix is "an advanced GTK3 tiling terminal emulator that follows the Gnome Human Interface Guidelines" Here is the project page (incl screenshots) if you want to know more: https://gnunn1.github.io/tilix-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Is Your HDMI Cable Streaming-Compatible?
by Lawrence D'Oliveiro 20 Aug '19

20 Aug '19

It seems <https://www.stuff.co.nz/sport/rugby/rugby-world-cup/115128021/rugby-world-c…> that some people hoping to watch streams of the Rugby World Cup on a TV or external monitor connected via an HDMI cable from their PC may be out of luck. If the client software thinks you’re trying to record the stream, it will block it. And some cables will trigger this block, even if they’re just connecting to a monitor.

1 0

New Attack exploiting serious Bluetooth weakness can intercept sensitive data
by Peter Reutemann 20 Aug '19

20 Aug '19

'Researchers have demonstrated a serious weakness in the Bluetooth wireless standard that could allow hackers to intercept keystrokes, address books, and other sensitive data sent from billions of devices. Dubbed Key Negotiation of Bluetooth—or KNOB for short—the attack forces two or more devices to choose an encryption key just a single byte in length before establishing a Bluetooth connection. Attackers within radio range can then use commodity hardware to quickly crack the key. From there, attackers can use the cracked key to decrypt data passing between the devices. The types of data susceptible could include keystrokes passing between a wireless keyboard and computer, address books uploaded from a phone to a car dashboard, or photographs exchanged between phones. KNOB doesn't require an attacker to have any previously shared secret material or to observe the pairing process of the targeted devices. The exploit is invisible to Bluetooth apps and the operating systems they run on, making the attack almost impossible to detect without highly specialized equipment. KNOB also exploits a weakness in the Bluetooth standard itself. That means, in all likelihood, that the vulnerability affects just about every device that's compliant with the specification. The researchers have simulated the attack on 14 different Bluetooth chips—including those from Broadcom, Apple, and Qualcomm—and found all of them to be vulnerable. "The Key Negotiation Of Bluetooth (KNOB) attack exploits a vulnerability at the architectural level of Bluetooth," the researchers wrote in a research paper published this week. "The vulnerable encryption key negotiation protocol endangers potentially all standard compliant Bluetooth devices, regardless [of] their Bluetooth version number and implementation details. We believe that the encryption key negotiation protocol has to be fixed as soon as possible."' -- source: https://arstechnica.com/information-technology/2019/08/new-attack-exploitin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should HTTPS Certificates Expire After Just 397 Days?
by Peter Reutemann 19 Aug '19

19 Aug '19

'Google has made a proposal to the unofficial cert industry group that "would cut lifespan of SSL certificates from 825 days to 397 days," reports ZDNet. No vote was held on the proposal; however, most browser vendors expressed their support for the new SSL certificate lifespan. On the other side, certificate authorities were not too happy, to say the least. In the last decade and a half, browser makers have chipped away at the lifespan of SSL certificates, cutting it down from eight years to five, then to three, and then to two. The last change occured in March 2018, when browser makers tried to reduce SSL certificate lifespans from three years to one, but compromised for two years after pushback from certificate authorities. Now, barely two years later after the last change, certificate authorities feel bullied by browser makers into accepting their original plan, regardless of the 2018 vote... This fight between CAs and browser makers has been happening in the shadows for years. As HashedOut, a blog dedicated to HTTPS-related news, points out, this proposal is much more about proving who controls the HTTPS landscape than everything. "If the CAs vote this measure down, there's a chance the browsers could act unilaterally and just force the change anyway," HashedOut said. "That's not without precendent, but it's also never happened on an issue that is traditionally as collegial as this. "If it does, it becomes fair to ask what the point of the CA/B Forum even is. Because at that point the browsers would basically be ruling by decree and the entire exercise would just be a farce." Security researcher Scott Helme "claims that this process is broken and that bad SSL certificates continue to live on for years after being mississued and revoked -- hence the reason he argued way back in early 2018 that a shorter lifespan for SSL certificates would fix this problem because bad SSL certs would be phased out faster." But the article also notes that Timothy Hollebeek, DigiCert's representative at the CA/B Forum argues that the proposed change "has absolutely no effect on malicious websites, which operate for very short time periods, from a few days to a week or two at most. After that, the domain has been added to various blacklists, and the attacker moves on to a new domain and acquires new certificates."' -- source: https://tech.slashdot.org/story/19/08/18/1833223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Patches Three High-Severity Vulnerabilities
by Peter Reutemann 18 Aug '19

18 Aug '19

'Intel's latest patches "stomped out three high-severity vulnerabilities and five medium-severity flaws," reports Threatpost: One of the more serious vulnerabilities exist in the Intel Processor Identification Utility for Windows, free software that users can install on their Windows machines to identify the actual specification of their processors. The flaw (CVE-2019-11163) has a score of 8.2 out of 10 on the CVSS scale, making it high severity. It stems from insufficient access control in a hardware abstraction driver for the software, versions earlier than 6.1.0731. This glitch "may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access" according to Intel. Users are urged to update to version 6.1.0731. Intel stomped out another high-severity vulnerability in its Computing Improvement Program, which is program that Intel users can opt into that uses information about participants' computer performance to make product improvement and detect issues. However, the program contains a flaw (CVE-2019-11162) in the hardware abstraction of the SEMA driver that could allow escalation of privilege, denial of service or information disclosure... A final high-severity flaw was discovered in the system firmware of the Intel NUC (short for Next Unit of Computing), a mini-PC kit used for gaming, digital signage and more. The flaw (CVE-2019-11140) with a CVSS score of 7.5 out of 10, stems from insufficient session validation in system firmware of the NUC. This could enable a user to potentially enable escalation of privilege, denial of service and information disclosure. An exploit of the flaw would come with drawbacks -- a bad actor would need existing privileges and local access to the victim system. The article notes that the patches "come on the heels of a new type of side-channel attack revealed last week impacting millions of newer Intel microprocessors manufactured after 2012."' -- source: https://it.slashdot.org/story/19/08/18/0030201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slackware, the Longest Active Linux Distro, Finally Has a Patreon Page
by Peter Reutemann 18 Aug '19

18 Aug '19

'"Slackware is the longest active Linux distribution project, founded in 1993," writes TheBAFH (Slashdot reader #68,624). "Today there are many Linux distributions available, but I've remained dedicated to this project as I believe it still holds an important place in the Linux ecosystem," writes Patrick J. Volkerding on a new Patreon page. He adds that Slackware's users "know that Slackware can be trusted not to constantly change the way things work, so that your investment in learning Slackware lasts longer than it would with a system that's a moving target... Your support is greatly appreciated, and will make it possible for me to continue to maintain this project." TheBAFH writes: The authenticity of the Patreon page has been confirmed by Mr. Volkerding in a post in the Slackware forum of LinuxQuestions.org. "I was going to wait to announce it until I had a few more planned updates done in -current that would be getting things closer to an initial 15.0 beta release, but since it's been spotted in the wild I'll confirm it." Slashdot also emailed Patrick J. Volkerding at Slackware.com last summer and confirmed that that is indeed the account that he's posting from on LinuxQuestions. At the time, he was still trying to find the time to get a Patreon page set up. "I've been trying to catch up on nearly a decade of neglecting everything other than Slackware, but I'm at least getting more caught up."' -- source: https://linux.slashdot.org/story/19/08/16/238254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unique Kaspersky AV User ID Allowed 3rd-Party Web Tracking
by Peter Reutemann 15 Aug '19

15 Aug '19

'Kaspersky antivirus solutions injected in the web pages visited by its users an identification number unique for each system. This started in late 2015 and could be used to track a user's browsing interests. From a report: Versions of the antivirus product, paid and free, up to 2019, displayed this behavior that allows tracking regardless of the web browser used, even when users started private sessions. Signaled by c't magazine editor Ronald Eikenberg, the problem was that a JavaScript from a Kaspersky server loaded from an address that included a unique ID for every user. Scripts on a website can read the HTML source and glean the Kaspersky identifier, which Eikenberg determined to remain unchanged on the system.' -- source: https://it.slashdot.org/story/19/08/15/1849235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Found World-Readable Database Used To Secure Buildings Around the Globe
by Peter Reutemann 15 Aug '19

15 Aug '19

'Researchers said they have found a publicly accessible database containing almost 28 million records -- including plain-text passwords, face photos, and personal information -- that was used to secure buildings around the world. Ars Technica reports: Researchers from vpnMentor reported on Wednesday that the database was used by the Web-based Biostar 2 security system sold by South Korea-based Suprema. Biostar uses facial recognition and fingerprint scans to identify people authorized to enter warehouses, municipal buildings, businesses, and banks. vpnMentor said the system has more than 1.5 million installations in a wide range of countries including the U.S., the UK, Indonesia, India, and Sri Lanka. According to vpnMentor, the 23-gigabyte database contained more than 27.8 million records used by Biostar to secure customer facilities. The data included usernames, passwords and user IDs in plaintext, building access logs, employee records including start dates, personal details, mobile device data, and face images. The researchers said the data also included more than 1 million records containing actual fingerprint scans, but the report provided no data to support the claim. "The vpnMentor researchers said they discovered the exposed database on August 5 and privately reported the finding two days later," reports Ars Technica. "The data wasn't secured until Tuesday, six days later."' -- source: https://it.slashdot.org/story/19/08/14/2256231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 15 Aug '19

15 Aug '19

Well, my nomination, anyway <https://forums.theregister.co.uk/forum/all/2019/08/13/windows_notepad_flaw/…>: ... looking at XP era material with a code profiler is like looking at a Vegas motel room under a strong blacklight. Some things cannot be unseen.

1 0

Tech firms “can and must” put backdoors in encryption, AG Barr says
by Peter Reutemann 15 Aug '19

15 Aug '19

'US Attorney General William Barr today launched a new front in the feds' ongoing fight against consumer encryption, railing against the common security practice and lamenting the "victims" in its wake. "The deployment of warrant-proof encryption is already imposing huge costs on society," Barr claimed in remarks at a cybersecurity conference held at Fordham University Tuesday morning. Barr added that encryption "seriously degrades" law enforcement's ability to "detect and prevent a crime before it occurs," as well as making eventual investigation and prosecution of crime more difficult. The existence of encryption means "converting the Internet and communications into a law-free zone" that criminals will happily take advantage of to do more crimes, Barr added, likening it to a neighborhood that local cops have abandoned. The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. He also accused tech firms of "dogmatic" posturing, saying lawful backdoor access "can be and must be" done, adding, "We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement, without materially weakening the security provided by encryption."' -- source: https://arstechnica.com/tech-policy/2019/07/tech-firms-can-and-must-put-bac… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Researcher Makes Legit-Looking iPhone Lightning Cables That Will Hijack Your Computer
by Peter Reutemann 14 Aug '19

14 Aug '19

'A researcher known as MG has modified Lightning cables with extra components to let him remotely connect to the computers that the cables are connected to. "It looks like a legitimate cable and works just like one. Not even your computer will notice a difference. Until I, as an attacker, wirelessly take control of the cable," MG said. Motherboard reports: One idea is to take this malicious tool, dubbed O.MG Cable, and swap it for a target's legitimate one. MG suggested you may even give the malicious version as a gift to the target -- the cables even come with some of the correct little pieces of packaging holding them together. MG typed in the IP address of the fake cable on his own phone's browser, and was presented with a list of options, such as opening a terminal on my Mac. From here, a hacker can run all sorts of tools on the victim's computer. The cable comes with various payloads, or scripts and commands that an attacker can run on the victim's machine. A hacker can also remotely "kill" the USB implant, hopefully hiding some evidence of its use or existence. MG made the cables by hand, painstakingly modifying real Apple cables to include the implant. "In the end, I was able to create 100 percent of the implant in my kitchen and then integrate it into a cable. And these prototypes at Def con were mostly done the same way," he said. MG did point to other researchers who worked on the implant and graphical user interface. He is selling the cables for $200 each. ' -- source: https://apple.slashdot.org/story/19/08/13/2240213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0