- wlug - list.wlug.org.nz

The Infrastructure Mess Causing Countless Internet Outages
by Peter Reutemann 02 Jul '19

02 Jul '19

'Border Gateway Protocol has served the internet well for decades. But when it goes wrong, you notice it. From a report: In a weeks-long stretch in 2014, hackers stole thousands of dollars a day in cryptocurrency from owners. In 2017, internet outages cropped up around the United States for hours. Last year, Google Cloud suffered hours of disruptions. Earlier this month, a large swath of European mobile data was rerouted through the state-backed China Telecom. And on Monday, websites and services around the world -- including the internet infrastructure firm Cloudflare -- experienced hours of outages. These incidents may sound different, but they actually all resulted from problems -- some accidental, some malicious -- with a fundamental internet routing system called the Border Gateway Protocol. The web is distributed, but it's also interconnected. It needs to be so that data can move around worldwide without all being controlled by a single entity. So every time you load a website or send an email, BGP is the system responsible for optimizing the route that data takes across these sprawling, intertwined networks. And when it goes wrong, the whole internet feels it. Originally conceived in 1989 (on two napkins), the version of BGP used today remains largely unchanged since 1994. And though BGP has scaled surprisingly well, there's no denying that the internet is very different than it was 25 years ago. In fact, the way BGP was designed introduces risk of outages, manipulations, and data interception -- all of which have come to pass. The internet's backbone routers -- massive industrial nodes usually run by internet service providers, not the Linksys at your house -- each control a set of IP addresses and routes. ISPs and other large organizations use BGP to announce these routes to the world and calculate paths. Think of it like planning a cross-country drive: You need to know the different route options in each area, so you can stop at all the right corn mazes and the world's largest rocking chair without adding too much extra driving each day. But if your GPS is outdated, you could wind up at a dead end or on a new road that totally bypasses the salt flats.' -- source: https://tech.slashdot.org/story/19/07/01/1316206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Usage on Azure Has Surpassed Windows, Microsoft Developer Reveals
by Peter Reutemann 02 Jul '19

02 Jul '19

'Three and a half years ago, Mark Russinovich, Azure CTO, Microsoft's cloud, said, "One in four [Azure] instances are Linux." Next, in 2017, Microsoft revealed that 40% of Azure virtual machines (VM) were Linux-based. Then in the fall of 2018, Scott Guthrie, Microsoft's executive VP of the cloud and enterprise group, told me in an exclusive interview, "About half Azure VMs are Linux". Now, Sasha Levin, Microsoft Linux kernel developer, in a request that Microsoft be allowed to join a Linux security list, revealed that "the Linux usage on our cloud has surpassed Windows." Shocking you say? Not really. Linux is largely what runs enterprise computing both on in-house servers and on the cloud. Windows Server has been declining for years. In the most recent IDC Worldwide Operating Systems and Subsystems Market Shares report covering 2017, Linux had 68% of the market. Its share has only increased since then.' -- source: https://linux.slashdot.org/story/19/07/01/1333252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany to publish standard on modern secure browsers
by Peter Reutemann 02 Jul '19

02 Jul '19

'Germany's cyber-security agency is working on a set of minimum rules that modern web browsers must comply with in order to be considered secure. The new guidelines are currently being drafted by the German Federal Office for Information Security (or the Bundesamt für Sicherheit in der Informationstechnik -- BSI), and they'll be used to advise government agencies and companies from the private sector on what browsers are safe to use.' -- source: https://www.zdnet.com/article/germany-to-publish-standard-on-modern-secure-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ebooks Purchased From Microsoft Will Be Deleted This Month Because You Don't Really Own Anything Anymore
by Peter Reutemann 02 Jul '19

02 Jul '19

'Anyone who bought ebooks through the Microsoft Store is in for a rude shock in the coming days. The good news? You can get a refund. The bad news? All of your books are going to be deleted this month. Microsoft announced in April that it would stop selling ebooks and that any books the company already sold would stop working in early July because the DRM servers were being shut off. Yes, you read that correctly. Those books that you “bought” are going to disappear. Even the “free” books that you downloaded through Microsoft will be deleted.' -- source: https://gizmodo.com/ebooks-purchased-from-microsoft-will-be-deleted-this-mo… Possible solution to keep the books - remove the DRM: https://www.techradar.com/news/software/how-to-remove-ebook-drm-with-calibr… https://apprenticealf.wordpress.com/2012/09/10/drm-removal-tools-for-ebooks/ https://apprenticealf.wordpress.com/2011/01/13/ebooks-formats-drm-and-you-%… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ask Slashdot: What's Your 'Backup' Browser?
by Peter Reutemann 01 Jul '19

01 Jul '19

'Slashdot's gotten over 17,000 votes in its poll about which web browser people use on their desktop. (The current leader? Firefox, with 53% of the vote, followed by Chrome with 30%.) But Slashdot reader koavf asks an interesting follow-up question: "What's everyone's go-to Plan B browser and why?"' -- source: https://news.slashdot.org/story/19/06/30/2220257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Sees Lots of Hardware Headaches Ahead
by Peter Reutemann 30 Jun '19

30 Jun '19

'Linux founder Linus Torvalds "warns that managing software is about to become a lot more challenging, largely because of two hardware issues that are beyond the control of DevOps teams," reports DevOps.com. An anonymous reader shares their report about Torvalds remarks at the KubeCon + CloudNative + Open Source Summit China conference: The first, Torvalds said, is the steady stream of patches being generated for new cybersecurity issues related to the speculative execution model that Intel and other processor vendors rely on to accelerate performance... Each of those bugs requires another patch to the Linux kernel that, depending on when they arrive, can require painful updates to the kernel, Torvalds told conference attendees. Short of disabling hyperthreading altogether to eliminate reliance on speculative execution, each patch requires organizations to update both the Linux kernel and the BIOS to ensure security. Turning off hyperthreading eliminates the patch management issue, but also reduces application performance by about 15 percent. The second major issue hardware issue looms a little further over the horizon, Torvalds said. Moore's Law has guaranteed a doubling of hardware performance every 18 months for decades. But as processor vendors approach the limits of Moore's Law, many developers will need to reoptimize their code to continue achieving increased performance. In many cases, that requirement will be a shock to many development teams that have counted on those performance improvements to make up for inefficient coding processes, he said.' -- source: https://news.slashdot.org/story/19/06/28/2245250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tech Press Rushes To Cover New Linus Torvalds Mailing List Outburst
by Peter Reutemann 30 Jun '19

30 Jun '19

'"Linux frontman Linus Torvalds thinks he's 'more self-aware' these days and is 'trying to be less forceful' after his brief absence from directing Linux kernel developers because of his abusive language on the Linux kernel mailing list," reports ZDNet. "But true to his word, he's still not necessarily diplomatic in his communications with maintainers..." Torvalds' post-hiatus outburst was directed at Dave Chinner, an Australian programmer who maintains the Silicon Graphics (SGI)-created XFS file system supported by many Linux distros. "Bullshit, Dave," Torvalds told Chinner on a mailing list. The comment from Chinner that triggered Torvalds' rebuke was that "the page cache is still far, far slower than direct IO" -- a problem Chinner thinks will become more apparent with the arrival of the newish storage-motherboard interface specification known as Peripheral Express Interconnect Express (PCIe) version 4.0. Chinner believes page cache might be necessary to support disk-based storage, but that it has a performance cost.... "You've made that claim before, and it's been complete bullshit before too, and I've called you out on it then too," wrote Torvalds. "Why do you continue to make this obviously garbage argument?" According to Torvalds, the page cache serves its correct purpose as a cache. "The key word in the 'page cache' name is 'cache'," wrote Torvalds.... "Caches work, Dave. Anybody who thinks caches don't work is incompetent. 99 percent of all filesystem accesses are cached, and they never do any IO at all, and the page cache handles them beautifully," Torvalds wrote. "When you say the page cache is slower than direct IO, it's because you don't even see or care about the *fast* case. You only get involved once there is actual IO to be done." "The thing is," reports the Register, "crucially, Chinner was talking in the context of specific IO requests that just don't cache well, and noted that these inefficiencies could become more obvious as the deployment of PCIe 4.0-connected non-volatile storage memory spreads." Here's how Chinner responded to Torvalds on the mailing list. "You've taken one single statement I made from a huge email about complexities in dealing with IO concurrency, the page cache and architectural flaws in the existing code, quoted it out of context, fabricated a completely new context and started ranting about how I know nothing about how caches or the page cache work." The Register notes their conversation also illustrates a crucial difference from closed-source software development. "[D]ue to the open nature of the Linux kernel, Linus's rows and spats play out in public for everyone to see, and vultures like us to write up about."' -- source: https://news.slashdot.org/story/19/06/28/2339245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's New ReCAPTCHA Has a Dark Side
by Peter Reutemann 28 Jun '19

28 Jun '19

'We've all tried to log into a website or submit a form only to be stuck clicking boxes of traffic lights or storefronts or bridges in a desperate attempt to finally convince the computer that we're not actually a bot. For many years, this has been one of the predominant ways that reCaptcha -- the Google-run internet bot detector -- has determined whether a user is a bot or not. But last fall, Google launched a new version of the tool, with the goal of eliminating that annoying user experience entirely. Now, when you enter a form on a website that's using reCaptcha V3, you won't see the "I'm not a robot" checkbox, nor will you have to prove you know what a cat looks like. Instead, you won't see anything at all. Google is also now testing an enterprise version of reCaptcha v3, where Google creates a customized reCaptcha for enterprises that are looking for more granular data about users' risk levels to protect their site algorithms from malicious users and bots. But this new, risk-score based system comes with a serious trade-off: users' privacy. According to two security researchers who've studied reCaptcha, one of the ways that Google determines whether you're a malicious user or not is whether you already have a Google cookie installed on your browser. It's the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time. But according to Mohamed Akrout, a computer science PhD student at the University of Toronto who has studied reCaptcha, it appears that Google is also using its cookies to determine whether someone is a human in reCaptcha v3 tests. Akrout wrote in an April paper about how reCaptcha v3 simulations that ran on a browser with a connected Google account received lower risk scores than browsers without a connected Google account. "Because reCaptcha v3 is likely to be on every page of a website, if you're signed into your Google account there's a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3 -- and there many be no visual indication on the site that it's happening, beyond a small reCaptcha logo hidden in the corner," the report adds.' -- source: https://tech.slashdot.org/story/19/06/27/2139219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard on Windows early preview
by Peter Reutemann 28 Jun '19

28 Jun '19

'WireGuard is a new peer-to-peer VPN technology that has the potential for greater speed, smaller attack surface, and easier configuration than commonly used and better-established VPN platforms such as OpenVPN and IPSec. It has been available on Linux, FreeBSD, macOS, Android, and even iOS for quite some time now, with Windows being the one platform frustratingly missing. There are good reasons for that—lead developer Jason Donenfeld didn't want to inherit the problems of OpenVPN's OpenTAP adapter code, and when he investigated Microsoft's built-in VPN API, he didn't like that either. So his first move was to take a giant step backward on the Windows platform and develop an extremely simple virtual adapter that could be used not only for WireGuard, but also for other projects that might need the same kind of very basic, socket-and-tunnel functionality. This became Wintun. For the moment, WireGuard for Windows is still in what creator Jason Donenfeld refers to as "pre-alpha," with an alpha build due out sometime in the next week or two. The good news is that it's an easy install now, with no dev-fu required to get it running happily on a Windows 10 (or Server 2016, as seen below) system. There are self-contained, signed MSI installers for both 64-bit and 32-bit builds there; downloading and running them just works, with no complaints from Defender about unsigned or untrusted anything. I was curious about what makes v0.0.14 "pre-alpha" rather than merely "alpha." Donenfeld told me one reason he called it pre-alpha was to keep journalists like me (as well as the generally unadventurous) from writing about it before it's ready.' -- source: https://arstechnica.com/information-technology/2019/06/taking-a-spin-on-wir… Here's the link the article covering the Linux version: https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connectio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Launches GeckoView-Powered Firefox Preview For Android
by Peter Reutemann 27 Jun '19

27 Jun '19

'Mozilla today announced Firefox Preview, a pilot of its new Android browser. Firefox Preview, which is powered by Mozilla's own GeckoView engine, will ultimately replace the current Firefox for Android mobile app "this fall." At the same time, Mozilla has put Firefox Focus for Android development on hold. If you're a developer or just an early adopter, you can download Firefox Preview from Google Play. On desktop, Firefox is the second most popular browser after Chrome. Firefox holds about 10% desktop market share, according to Net Applications. On mobile, however, Firefox has less than 0.5% share. Despite regular releases alongside the desktop browser over the years, Firefox's mobile share has not improved.' -- source: https://news.slashdot.org/story/19/06/27/1720215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Demonstrate How US Emergency Alert System Can Be Hijacked and Weaponized
by Peter Reutemann 27 Jun '19

27 Jun '19

'After an emergency alert was accidentally sent to Hawaii residents last year, warning of an impending nuclear ballistic missile attack, researchers at the University of Colorado Boulder were prompted to ask the question: How easy would it be to exploit the nation's emergency alert systems, wreaking havoc on the American public via fake or misleading alerts? In short, they found that it wasn't very difficult at all. Motherboard reports: Their full study was recently unveiled at the 2019 International Conference on Mobile Systems, Applications and Services (MobiSys) in Seoul, South Korea. It documents how spoofing the Wireless Emergency Alert (WEA) program to trick cellular users wasn't all that difficult. To prove it, researchers built a mini "pirate" cell tower using easily-available hardware and open source software. Using isolated RF shield boxes to mitigate any real-world harm, they then simulated attacks in the 50,000 seat Folsom Field at the University. 90 percent of the time, the researchers say they were able to pass bogus alerts on to cell phones within range. The transmission of these messages from the government to the cellular tower is secure. It's the transmission from the cellular tower to the end user that's open to manipulation and interference, the researchers found. The vulnerability potentially impacts not just US LTE networks, but LTE networks from Europe to South Korea. ' -- source: https://tech.slashdot.org/story/19/06/26/2347257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security firms demonstrate subdomain hijack exploit vs. EA/Origin
by Peter Reutemann 26 Jun '19

26 Jun '19

'Israeli security firms Check Point and CyberInt partnered up this week to find, exploit, and demonstrate a nasty security flaw that allows attackers to hijack player accounts in EA/Origin's online games. The exploit chains together several classic types of attacks—phishing, session hijacking, and cross-site scripting—but the key flaw that makes the entire attack work is poorly maintained DNS.' -- source: https://arstechnica.com/information-technology/2019/06/security-firms-demon… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel, Arm To Help Create New IoT Standard For Device Onboarding
by Peter Reutemann 26 Jun '19

26 Jun '19

'Intel is working with rival Arm to create a new industry standard for an important issue in the Internet of Things market: making sure that devices are properly configured and connected to the cloud. From a report: The Santa Clara, Calif.-based chipmaker announced on Wednesday that the company is a founding member of the new IoT Technical Working Group within the FIDO Alliance, an industry consortium founded by PayPal, Lenovo and others in 2012 to develop standards for password-less authentication. The goal of FIDO's IoT Technical Working Group, which will also include experts from Microsoft, Google and Amazon, is to create a standard specification for "large-scale IoT onboarding," the process in which devices are configured and connected to IoT cloud management services at the time of installation. Lorie Wigle, the executive in charge of Intel's platform security efforts, told CRN that it is important to create a standard around IoT onboarding because many companies currently face challenges with the practice when it comes to handling large-scale deployments and security. [...] Once FIDO develops the standard, market forces will compel companies to adhere and participate, according to Wigle, who said it will also increase device variety, lower costs and accelerate deployments.' -- source: https://it.slashdot.org/story/19/06/26/1524200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Now Allows Users To Auto-Delete Their Location History
by Peter Reutemann 26 Jun '19

26 Jun '19

'Google today began rolling out location history deletion tools to Android and iOS, giving users a relatively simple way to limit the scope of Google's location tracking. Users can only choose between deleting data after three or 18 months. In a blog post, Google wrote: Choose a time limit for how long you want your activity data to be saved -- 3 or 18 months -- and any data older than that will be automatically deleted from your account on an ongoing basis. These controls are coming first to Location History and Web & App Activity and will roll out in the coming weeks.' -- source: https://yro.slashdot.org/story/19/06/26/1730250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Will Give You a Fake Browsing History To Fool Advertisers
by Peter Reutemann 26 Jun '19

26 Jun '19

'Security through obscurity is out, security through tomfoolery is in. >From a report: That's the basic philosophy sold by Track THIS, "a new kind of incognito" browsing project, which opens up 100 tabs crafted to fit a specific character -- a hypebeast, a filthy rich person, a doomsday prepper, or an influencer. The idea is that your browsing history will be depersonalized and poisoned, so advertisers won't know how to target ads to you. It was developed as a collaboration between mschf (pronounced "mischief") internet studios and Mozilla's Firefox as a way of promoting Firefox Quantum, the newest Firefox browser. [...] Just a warning -- if you use Track THIS it may take several minutes for all 100 tabs to load. (I used Chrome as my browser.) But when as it gradually loads, it's like taking a first-person journey through someone else's consciousness.' -- source: https://yro.slashdot.org/story/19/06/26/192258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Discovers The Command Line
by Lawrence D'Oliveiro 26 Jun '19

26 Jun '19

A review <https://www.theregister.co.uk/2019/06/25/microsofts_new_terminal_put_throug…> of Microsoft’s revamped Windows Terminal app. Features like session tabs and customizable profiles should be familiar to users of Linux terminal apps. The biggest downside seems to be that this is a UWP app, which means it only works with specific versions of Window 10. Actually, Windows had a sort-of-remotable/virtualizable-command-line support before. The difference is, all the *nix-type systems implement this using “PTY” (“pseudo-terminal”) devices, which one process (like an SSH server or GUI terminal emulator) can open and use to drive other processes on the other side, which act as though they are connecting to a real terminal. All the fancy screen stuff (e.g. direct addressing, coloured text) is done by sending in-band “escape sequences”, which real terminals (which are all museum pieces now) used to respond to, and which the terminal emulators nowadays faithfully mimic. However, Microsoft didn’t like the whole escape-sequence idea; instead, it implemented a whole API it called “ConHost”, where the application had to make special calls to affect the display in special ways. This sounds more advanced than the crude-sounding escape-sequence idea from the 1970s, yet it turns out that the Microsoft approach makes it awkward to implement those same SSH servers and GUI terminal emulators that we take for granted in the Linux world. So now the company is back-pedalling away from that, and towards good old PTYs and escape sequences, in its new “ConPTY” architecture. There is still one issue I don’t think they’ve addressed yet, though <https://forums.theregister.co.uk/forum/all/2019/06/25/microsofts_new_termin…>: ... a working select() would be nice. MS's function cannot wait across a set of fd's of different types (such as a serial port and a network socket). In the end I gave up and used the cygwin platform, which has a working select(), which was enough to do the job of talking to a telehone exchange via RS232 and fielding network requests at the same time. The unix philosophy that at the end of the day, everything is a file, pays huge dividends. Using cygwin also gave me a nice simple tcgetattr()/tcsetattr() which allowed serial port setup in a tiny amount of code, compared to the sheer lovecraftian horror that is the windows API for such things. I still find it remarkable that the Cygwin folks were able to implement a function on top of Windows that Microsoft itself seems unable to figure out.

2 1

Steam and Ubuntu clash over 32-bit libs
by Peter Reutemann 26 Jun '19

26 Jun '19

'It has been a tumultuous week for gaming on Linux. Last Tuesday afternoon, Canonical's Steve Langasek announced that 32-bit libs would be frozen (kept as-is, with no new builds or updates) as of this October's interim 19.10 release, codenamed "Eoan Ermine." Langasek was pretty clear that this did not mean abandoning support for running 32-bit applications, however. "While this means we will not provide 32-bit builds of new upstream versions of libraries, there are a number of ways that 32-bit applications can continue to be made available to users of later Ubuntu releases, as detailed in [4]. We will be working to polish the 32-bit support story over the course of the 19.10 development cycle. To follow the evolution of this support, you can participate in the discourse thread at [5]." Unfortunately, that part of the announcement may not have been entirely clear to all who read it. This group may include Steam lead Pierre-Loup Griffais, who responded by breaking up with Ubuntu in a tweet. "Ubuntu 19.10 and future releases will not be officially supported by Steam or recommended to our users. We will evaluate ways to minimize breakage for existing users, but will also switch our focus to a different distribution, currently TBD." Two days later, Canonical issued another public statement making it very explicit that support for commonly used 32-bit libs would be continued. That statement has been widely reported as an "about-face" from Canonical, but it appears to be more of a clarification of the original statement. The heart of the issue is that 32-bit computing represents an incredibly wide attack surface, with lessening amounts of active maintenance to discover, analyze, and patch flaws and exploits. Canonical, like any company, needs to apply its developer resources intelligently, so it looks for ways to remove unnecessary cruft where possible. The vast majority of 32-bit code is cruft. "We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed... We do think it’s reasonable to expect the community to participate and to find the right balance between enabling the next wave of capabilities and maintaining the long tail," Canonical said in a statement. "Nevertheless, in this case it’s relatively easy for us to change plan and enable natively in Ubuntu 20.04 LTS the applications for which there is a specific need." Canonical also promised it would work with "the WINE, Ubuntu Studio and gaming communities to use container technology to address the ultimate end of life of 32-bit libraries; it should stay possible to run old applications on newer versions of Ubuntu. Snaps and LXD enable us both to have complete 32-bit environments, and bundled libraries, to solve these issues in the long term."' -- source: https://arstechnica.com/gaming/2019/06/steam-and-ubuntu-clash-over-32-bit-l… The article mentions "Solus", which I've only come across once before in 2017. Anybody keen on giving that a swirl at the next meeting? -- project page: https://getsol.us/home/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Dyn DNS Services Shutting Down in 2020
by Peter Reutemann 25 Jun '19

25 Jun '19

'Oracle has sent the following email to customers of DYN service: Since Oracle acquired Dyn in 2016 (and subsequently acquired Zenedge), the engineering teams have been working diligently to integrate Dyn;s products and network into the Oracle Cloud Infrastructure. With the completion of this upgrade to Oracle Cloud Infrastructure. Oracle is announcing the end-of-life for the free Standard DNS service in favor of the enhanced, paid subscription version on the Oracle Cloud Infrastructure platform. On May 31, 2020, the 'EOL Date', the Standard DNS will be retired and will no longer be available. The following capabilities are not currently supported in Oracle Cloud Infrastructure DNS: Webhop (HTTP redirect), Dynamic DNS, Zone transfer to external nameservers, and DNSSEC. ' -- source: https://developers.slashdot.org/story/19/06/25/1920223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Silex Malware is Bricking IoT Devices, Has Scary Plans
by Peter Reutemann 25 Jun '19

25 Jun '19

'A new strain of malware is wiping the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017. From a report: Named Silex, this malware began operating earlier today, about three-four hours before this article's publication. The malware had bricked around 350 devices when this reporter began investigating its operations, and the number quickly spiked to 2,000 wiped devices by the time we published, an hour later. Attacks are still ongoing, and according to an interview with the malware's creator, they are about to intensify in the coming days. According to Akamai researcher Larry Cashdollar, who first spotted the malware earlier today, Silex works by trashing an IoT device's storage, dropping firewall rules, removing the network configuration, and then halting the device. It's as destructive as it can get without actually frying the IoT device's circuits. To recover, victims must manually reinstall the device's firmware, a task too complicated for the majority of device owners' -- source: https://tech.slashdot.org/story/19/06/25/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Reverses Decision, Says It Will Continue To Support 32-bit Packages
by Peter Reutemann 25 Jun '19

25 Jun '19

'Canonical has issued a statement on Ubuntu's 32-bit future, saying it will continue to build and maintain a 32-bit archive going forward. >From a report: Of course, there was some negativity surrounding the decision -- as is common with everything in the world today. In particular, developers of WINE were upset, since their Windows compatibility layer depends on 32-bit, apparently. In a statement, Canonical said: "Thanks to the huge amount of feedback this weekend from gamers, Ubuntu Studio, and the WINE community, we will change our plan and build selected 32-bit i386 packages for Ubuntu 19.10 and 20.04 LTS. We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed. Community discussions can sometimes take unexpected turns, and this is one of those. The question of support for 32-bit x86 has been raised and seriously discussed in Ubuntu developer and community forums since 2014. That's how we make decisions."' -- source: https://linux.slashdot.org/story/19/06/24/1826241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Featuring Faster CPU, Up To 4GB of RAM Launched
by Peter Reutemann 25 Jun '19

25 Jun '19

'Raspberry Pi today introduced a new version of its popular line of single-board computer. The Raspberry Pi 4 Model B is the fastest Raspberry Pi ever, with the company promising "desktop performance comparable to entry-level x86 PC systems." The specifications are: A 1.5GHz quad-core 64-bit ARM Cortex-A72 CPU (~3x performance); 1GB, 2GB, or 4GB of LPDDR4 SDRAM; full-throughput Gigabit; Ethernet; dual-band 802.11ac wireless networking; Bluetooth 5.0; two USB 3.0 and two USB 2.0 ports; dual monitor support, at resolutions up to 4K; VideoCore VI graphics, supporting OpenGL ES 3.x; 4Kp60 hardware decode of HEVC video; and complete compatibility with earlier Raspberry Pi products. It starts at $35.' -- source: https://hardware.slashdot.org/story/19/06/24/141229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Resilient?
by Ian Young 24 Jun '19

24 Jun '19

Alas several attempts to unzip the Resilient desktop file have failed - never got as far as trying to write a USB. Mostly failure was silent - Engampra and File Roller. Ark in KDE did condescend to say 'Failed to write data for entry'. ~ Ian Y

2 1

Potent Firefox 0-day used to install undetected backdoors on Macs
by Peter Reutemann 23 Jun '19

23 Jun '19

'Hackers exploited a pair of potent zero-day vulnerabilities in Firefox to infect Mac users with a largely undetected backdoor, according to accounts pieced together from multiple people. Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system. Interestingly, a researcher at Google's Project Zero had privately reported the code-execution flaw to Mozilla in mid April. On Monday, as Mozilla was readying a fix for the array.pop flaw, unknown hackers deployed an attack that combined working exploits for both vulnerabilities. The hackers then used the attack against employees of Coinbase, according to Philip Martin, chief information security officer for the digital currency exchange.' -- source: https://arstechnica.com/information-technology/2019/06/potent-firefox-0day-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch'
by mailinglist 23 Jun '19

23 Jun '19

I thought Chrome being an extension of Google was fairly obvious.The thing I don't understand is why duck duck go and Firefox are free.Sent from my Samsung Galaxy smartphone.-------- Original message --------From: Peter Reutemann <fracpete(a)waikato.ac.nz> Date: 23/06/2019 10:49 (GMT+12:00) To: wlug List <wlug(a)list.waikato.ac.nz> Subject: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch' '"You open your browser to look at the Web. Do you know who is lookingback at you?" warns Washington Post technology columnist Geoffrey A.Fowler:Over a recent week of Web surfing, I peered under the hood of GoogleChrome and found it brought along a few thousand friends. Shopping,news and even government sites quietly tagged my browser to let ad anddata companies ride shotgun while I clicked around the Web. This wasmade possible by the Web's biggest snoop of all: Google. Seen from theinside, its Chrome browser looks a lot like surveillance software...My tests of Chrome vs. Firefox unearthed a personal data caper ofabsurd proportions. In a week of Web surfing on my desktop, Idiscovered 11,189 requests for tracker "cookies" that Chrome wouldhave ushered right onto my computer but were automatically blocked byFirefox. These little files are the hooks that data firms, includingGoogle itself, use to follow what websites you visit so they can buildprofiles of your interests, income and personality... And that's notthe half of it. Look in the upper right corner of your Chrome browser.See a picture or a name in the circle? If so, you're logged in to thebrowser, and Google might be tapping into your Web activity to targetads. Don't recall signing in? I didn't, either. Chrome recentlystarted doing that automatically when you use Gmail.Chrome is even sneakier on your phone. If you use Android, Chromesends Google your location every time you conduct a search. (If youturn off location sharing it still sends your coordinates out, justwith less accuracy.)The columnist concludes that "having the world's biggest advertisingcompany make the most popular Web browser was about as smart asletting kids run a candy shop," and argues that through itsDoubleclick and other ad businesses, Google "is the No. 1 cookie maker-- the Mrs. Fields of the web."He also reports that Firefox is now working on ways to block browser"fingerprintin'-- source: https://news.slashdot.org/story/19/06/21/1922233Cheers, Peter-- Peter ReutemannDept. of Computer ScienceUniversity of Waikato, NZ+64 (7) 858-5174http://www.cms.waikato.ac.nz/~fracpete/http://www.data-mining.co.nz/_______________________________________________wlug mailing list | wlug(a)list.waikato.ac.nzUnsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

1 0

Chrome 'Has Become Surveillance Software. It's Time to Switch'
by Peter Reutemann 22 Jun '19

22 Jun '19

'"You open your browser to look at the Web. Do you know who is looking back at you?" warns Washington Post technology columnist Geoffrey A. Fowler: Over a recent week of Web surfing, I peered under the hood of Google Chrome and found it brought along a few thousand friends. Shopping, news and even government sites quietly tagged my browser to let ad and data companies ride shotgun while I clicked around the Web. This was made possible by the Web's biggest snoop of all: Google. Seen from the inside, its Chrome browser looks a lot like surveillance software... My tests of Chrome vs. Firefox unearthed a personal data caper of absurd proportions. In a week of Web surfing on my desktop, I discovered 11,189 requests for tracker "cookies" that Chrome would have ushered right onto my computer but were automatically blocked by Firefox. These little files are the hooks that data firms, including Google itself, use to follow what websites you visit so they can build profiles of your interests, income and personality... And that's not the half of it. Look in the upper right corner of your Chrome browser. See a picture or a name in the circle? If so, you're logged in to the browser, and Google might be tapping into your Web activity to target ads. Don't recall signing in? I didn't, either. Chrome recently started doing that automatically when you use Gmail. Chrome is even sneakier on your phone. If you use Android, Chrome sends Google your location every time you conduct a search. (If you turn off location sharing it still sends your coordinates out, just with less accuracy.) The columnist concludes that "having the world's biggest advertising company make the most popular Web browser was about as smart as letting kids run a candy shop," and argues that through its Doubleclick and other ad businesses, Google "is the No. 1 cookie maker -- the Mrs. Fields of the web." He also reports that Firefox is now working on ways to block browser "fingerprintin' -- source: https://news.slashdot.org/story/19/06/21/1922233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0