- wlug - list.wlug.org.nz

Mozilla and Scroll Partner To Test Alternative Funding Models for the Web
by Peter Reutemann 25 Feb '19

25 Feb '19

'News subscription service Scroll, which is yet to launch to consumers but has received the backing of several top publishers, courted another major player today: Mozilla. The browser maker says it will work with Scroll to better understand how consumers react to ad-free experiences on the web and subscription-based funding models. As part of the deal, Mozilla said it would test features and product ideas provided by Scroll, which itself has been conducting internal tests with a number of outlets. Small groups of Firefox users will be invited at random to share feedback and also respond to surveys, Mozilla said.' -- source: https://news.slashdot.org/story/19/02/25/1819244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Drupal 7 Will Reach End-of-Life in November of 2021
by Peter Reutemann 25 Feb '19

25 Feb '19

'Drupal 7, which was first released in January 2011, will reach end of life (EOL) in November of 2021, the Drupal Association said today. What this means for your Drupal 7 sites is, as of November 2021: 1. Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7. 2. There will be no more core commits to Drupal 7. 3. The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits. 4. All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to. 5. On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported. 6. After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support. 7. Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites. 8. Now is the time to start planning your migration to Drupal' -- source: https://developers.slashdot.org/story/19/02/25/1953224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

holding packages
by Peter Reutemann 25 Feb '19

25 Feb '19

Hi everyone If you want to keep a certain package at a fixed version, you can "hold" that package on a debian system like this: https://help.ubuntu.com/community/PinningHowto#Introduction_to_Holding_Pack… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Experts Find Serious Problems With Switzerland's Online Voting System
by Peter Reutemann 22 Feb '19

22 Feb '19

'Switzerland made headlines this month for the transparency of its internet voting system when it launched a public penetration test and bug bounty program to test the resiliency of the system to attack. But after source code for the software and technical documentation describing its architecture were leaked online last week, critics are already expressing concern about the system's design and about the transparency around the public test. Cryptography experts who spent just a few hours examining the leaked code say the system is a poorly constructed and convoluted maze that makes it difficult to follow what's going on and effectively evaluate whether the cryptography and other security measures deployed in the system are done properly. "Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said. The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."' -- source: https://developers.slashdot.org/story/19/02/21/2227234 At least they had a public test to figure that out, rather than an actual election... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of websites threatened by highly critical code-execution bug in Drupal
by Peter Reutemann 22 Feb '19

22 Feb '19

'Millions of sites that run the Drupal content management system run the risk of being hijacked until they're patched against a vulnerability that allows hackers to remotely execute malicious code, managers of the open source project warned Wednesday. CVE-2019-6340, as the flaw is tracked, stems from a failure to sufficiently validate user input, managers said in an advisory. Hackers who exploited the vulnerability could, in some cases, run code of their choice on vulnerable websites. The flaw is rated highly critical. "Some field types do not properly sanitize data from non-form sources," the advisory stated. "This can lead to arbitrary PHP code execution in some cases."' -- source: https://arstechnica.com/information-technology/2019/02/millions-of-websites… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Netflix..
by John 22 Feb '19

22 Feb '19

Does anyone know how to get Netflix to work in Firefox?? Cheers John..

1 0

Severe Vulnerabilities Uncovered In Popular Password Managers
by Peter Reutemann 21 Feb '19

21 Feb '19

Not sure whether this also applies to the Linux/cross-platform versions... 'Independent Security Evaluators (ISE) published an assessment on Tuesday with the results of testing with several popular password managers, including LastPass and KeePass. The team said that each password management solution "failed to provide the security to safeguard a user's passwords as advertised" and "fundamental flaws" were found that "exposed the data they are designed to protect." The vulnerabilities were found in software operating on Windows 10 systems. In one example, the master password which users need to use to access their cache of credentials was stored in PC RAM in a plaintext, readable format. ISE was able to extract these passwords and other login credentials from memory while the password manager in question was locked. It may be possible that malicious programs downloaded to the same machine by threat actors could do the same. The report has summarized the main findings based on each password management solution. Here's what ISE had to say about LastPass and KeePass -- two of the most popular password managers available: "LastPass obfuscates the master password while users are typing in the entry, and when the password manager enters an unlocked state, database entries are only decrypted into memory when there is user interaction. However, ISE reported that these entries persist in memory after the software enters a locked state. It was also possible for the researchers to extract the master password and interacted-with password entries due to a memory leak." "KeePass scrubs the master password from memory and is not recoverable. However, errors in workflows permitted the researchers from extracting credential entries which have been interacted with. In the case of Windows APIs, sometimes, various memory buffers which contain decrypted entries may not be scrubbed correctly."' -- source: https://it.slashdot.org/story/19/02/21/070204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Claims a Fighter of Pirated Apps is a Front For Ad Fraud
by Peter Reutemann 21 Feb '19

21 Feb '19

'A company that claims to combat app piracy is a pirate itself, according to a report Oracle released this week. From a report: Oracle claims the company, Tapcore, has been perpetrating a massive ad fraud on Android devices by infecting apps with software that ring up fake ad impressions and drain people's data. Based in The Netherlands, Tapcore works with developers to identify when apps are pirated and then enables developers to make money from those bootleg copies by serving ads. Oracle says that Tapcore's anti-piracy code was a Trojan horse that was generating fake mobile websites to trick ad serving platforms into paying them for non-existent ad inventory. "The code is delivering a steady stream of invisible video ads and spoofing domains," Dan Fichter, VP of software development at Oracle Data Cloud, tells Ad Age. "On all those impressions it looked like the advertiser was running ads on legitimate mobile websites. Not only were they not on a website, they were on an invisible web browser." On its website, Tapcore says it works with more than 3,000 apps, serving 150 million ad impressions a day. The apps whose pirated versions it has worked with include titles like "Perfect 365," "Draw Clash of Clans," "Vertex" and "Solitaire: Season 4," according to Oracle's report.' -- source: https://yro.slashdot.org/story/19/02/21/1238254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Researchers Say Software Alone Can't Mitigate Spectre Chip Flaws
by Peter Reutemann 21 Feb '19

21 Feb '19

'A group of researchers say that it will be difficult to avoid Spectre bugs in the future unless CPUs are dramatically overhauled. From a report: Google researchers say that software alone is not enough to prevent the exploitation of the Spectre flaws present in a variety of CPUs. The team of researchers -- including Ross McIlroy, Jaroslav Sevcik, Tobias Tebbi, Ben L Titzer and Toon Verwaest -- work on Chrome's V8 JavaScript engine. The researchers presented their findings in a paper distributed through ArXiv and came to the conclusion that all processors that perform speculative execution will always remain susceptible to various side-channel attacks, despite mitigations that may be discovered in future. ' -- source: https://hardware.slashdot.org/story/19/02/21/1630210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Launches ELISA, an Open Source Project For Building Safety-Critical Systems
by Peter Reutemann 21 Feb '19

21 Feb '19

'The Linux Foundation today launched Enabling Linux in Safety Applications (ELISA), an open source project comprising tools intended to help companies build and certify Linux-based systems whose failure could result in loss of human life, significant property damage, or environmental damage. From a report: In partnership with British chip designer Arm, BMW, autonomous platforms company Kuka, Linutronix, and Toyota, ELISA will work with certification and standardization bodies in "multiple industries" to establish ways Linux can form the foundation of safety-critical systems across industries.' -- source: https://linux.slashdot.org/story/19/02/21/1559217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Psion Palmtop Successor Has Arrived and It Runs Android and Linux
by Peter Reutemann 21 Feb '19

21 Feb '19

'A lot of people probably remember the 1990s palmtop computers made by Psion fondly. The clamshell-design palmtops were pocketable, black and white, but had a working stylus and a fantastic tactile foldout QWERTY keyboard that you could type pretty substantial documents on or even write code with. A different company -- Planet Computers -- has now produced a spiritual successor to the old Psion palmtops called the Gemini PDA that is much like an old Psion but with the latest Android smartphone hardware in it and a virtually identical tactile keyboard. It can also dual boot to Linux (Debian, Ubuntu, Sailfish) alongside Android. The technical specs are a MediaTek deca-core processor, 4GB RAM, 64GB storage (plus microSD slot), 4G, 802.11c Wi-Fi, GPS, Bluetooth, eSIM support, and 4,220mAh battery. The screen measures in at 5.99-inches with a 2,160 x 1,080 (403ppi) resolution. The only thing missing seems to be the stylus -- but perhaps that would have complicated manufacturing of this niche-device in its first production r' -- source: https://hardware.slashdot.org/story/19/02/20/2241216 Yes, it's back! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Blu-Ray On The Way Out?
by Lawrence D'Oliveiro 20 Feb '19

20 Feb '19

Samsung has given up developing new Blu-Ray players, and is going to stop selling them in the US altogether <https://arstechnica.com/gadgets/2019/02/samsung-says-it-will-stop-making-ne…>. Seems like downloads and streaming are taking over from physical discs, and UHD was never a big part of the latter anyway. One surprising fact is that DVD-Video still accounts for over half of such sales, at least in the US.

1 0

Why Do You Need A 4GHz Quadcore To Run Facebook?
by Lawrence D'Oliveiro 20 Feb '19

20 Feb '19

An example <https://twitter.com/themikepan/status/1093035372186034176> of how Facebook obfuscates its HTML rendering to defeat ad blockers. (Link found from this article <https://www.theregister.co.uk/2019/02/19/cern_browser_reawakened/> on a resurrection of the first Web browser from CERN).

1 0

Linux Subsystem Files To Become Accessible via Windows File Explorer
by Peter Reutemann 19 Feb '19

19 Feb '19

'One of Windows Subsystem for Linux's more annoying tricks is it's hard to get at your Linux files from Windows. From a report: Oh, you can do it, but you take a real chance of ruining the files. To quote Microsoft, "DO NOT, under ANY circumstances, access, create, and/or modify files in your distro's filesystem using Windows apps, tools, scripts, consoles, etc." In the forthcoming Windows 10 April 2019 Update, aka Windows 10 19H1, this Linux file problem will finally be fixed. According to Craig Loewen, a Microsoft programming manger working on Windows Subsystem for Linux (WSL), "The next Windows update is coming soon and we're bringing exciting new updates to WSL with it! These include accessing the Linux file system from Windows, and improvements to how you manage and configure your distros in the command line."' -- source: https://linux.slashdot.org/story/19/02/19/2119226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Not To Build A PC, And How Not To Respond To Those Criticizing You For It
by Lawrence D'Oliveiro 19 Feb '19

19 Feb '19

About four months ago, The Verge posted a video on its YouTube channel explaining the basics of building your own PC. Unfortunately, the video was full of mistakes, some small, some potentially more troublesome. Naturally this was pointed out in the comments. Also several other more techie-oriented channels responded with their own critique videos, some quite scathing. Rather than admit its mistake, the company decided to simply block comments for that video, and eventually take it down altogether. (Though not before it had accumulated a few thousand downvotes.) Now, within the last week or so, it has suddenly decided to go after those critique videos, and force them to be taken down on the basis of copyright infringement, because they contain extracts from the original item. Extracts which, under US fair use law, it was perfectly legal for them to include. Naturally, these heavy-handed attempts at censorship provoked a great deal of anger and protest, and the company has had to relent. If it was trying to downplay any lingering evidence of its previous embarrassment, this was absolutely not the way to do it. The phrase “Streisand Effect” immediately comes to mind, where an attempt by the eponymous celebrity to suppress pictures of the outside of her home, taken from public property, only caused them to be spread more widely. <https://www.youtube.com/results?search_query=the+verge+pc+build+takedown> Origin of the Streisand Effect: <https://www.techdirt.com/articles/20030624/1231228.shtml>

1 0

Inside the DNSpionage hacks that hijack domains at an unprecedented scale
by Peter Reutemann 18 Feb '19

18 Feb '19

'Since the beginning of the year, the US government and private security companies have been warning of a sophisticated wave of attacks that’s hijacking domains belonging to multiple governments and private companies at an unprecedented scale. On Monday, a detailed report provided new details that helped explain how and why the widespread DNS hijackings allowed the attackers to siphon huge numbers of email and other login credentials. The article, published by KrebsOnSecurity reporter Brian Krebs, said that, over the past few months, the attackers behind the so-called DNSpionage campaign have compromised key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies. Monday’s article goes on to report that the attackers, who are believed to be based in Iran, also took control of domains belonging to two highly influential Western services—the Netnod Internet Exchange in Sweden and the Packet Clearing House in Northern California. With control of the domains, the hackers were able to generate valid TLS certificates that allowed them to launch man-in-the-middle attacks that intercepted sensitive credentials and other data.' -- source: https://arstechnica.com/information-technology/2019/02/inside-the-dnspionag… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SGM next Monday
by Peter Reutemann 18 Feb '19

18 Feb '19

Hi society members For those paying/active society members that are not on meetup.com, here is the link to our SGM next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/258276544/ It is just a very short one, before the actual WLUG meeting, to go through some charter stuff. (Apologies, I thought I sent out a reminder last month, but I can't seem to find that email, so probably got lost in work stress) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meeting next Monday
by Peter Reutemann 18 Feb '19

18 Feb '19

Hi everyone We have a meeting coming up next Monday: 'Ian Stewart will talk about his experience of attempting to give an old Huawei router a new lease of life using OpenWRT (https://openwrt.org/)' https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884258/ Cheers Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Scans All IP Addresses of Austria, Finds a Ton of Things That Shouldn't Be Online
by Peter Reutemann 18 Feb '19

18 Feb '19

'Christian Haschek scanned the entire Austrian IP space and found IP cameras, printers, and industrial control systems and a range of other devices that should not be online.' -- source: https://yro.slashdot.org/story/19/02/18/0017246 -- blog: https://blog.haschek.at/2019/i-scanned-austria.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] RNZ Mediawatch--Geeks’ Gathering Goes Under The Radar
by Ian Stewart 17 Feb '19

17 Feb '19

In the Mediawatch Radio NZ broadcast Geeks' gathering goes under the media radar, David Lane, president of the NZ Open Source Society<https://nzoss.org.nz/>, stated that all the talks [given at the Linux Conference in Christchurch] are all available for anyone to watch on youtube right now. The following link takes you to the youtube summary page with the links to videos of all the presentations... https://www.youtube.com/user/linuxconfau2019/videos There are over 160 videos, and the average video is about 40 minutes, so there is over one hundred hours of viewing. An alternative to using youtube is to go to... http://mirror.linux.org.au/pub/linux.conf.au/2019/ ... select the presentation room, the day of the week, and the presentation can be downloaded in either mp4 or webm format. It's good to see in the list of credits<http://mirror.linux.org.au/pub/linux.conf.au/2019/README.md> for the core team that helped to make the videos there is a Waikato man that we haven't seen for a while, William McKee. cheers, Ian.

1 0

RNZ Mediawatch--Geeks’ Gathering Goes Under The Radar
by Lawrence D'Oliveiro 15 Feb '19

15 Feb '19

Did you know that the annual linux.conf.au gathering was held in Christchurch last month? And that Linus Torvalds was there, wandering around the Canterbury University campus? Neither did I. Radio New Zealand’s Mediawatch program from a couple of weeks ago goes into the reasons why there was no media coverage of the event. Partly they might have been put off by some of the more esoteric and technical subjects being discussed. But in among them were some topics that should be considered more relevant to the “mainstream”, such as how automation could be doing away with many jobs being done by humans, leaving only the low-paying ones. The item includes an interview with NZOSS president Dave Lane, in which he incidentally mentions that Radio New Zealand’s online presence is built on Open Source, and that stuff.co.nz was, until recently, doing the same, and was also the one part of the Fairfax online media empire that was making money. Until that system was replaced with one based on expensive and proprietary Adobe products. And now they are not making nearly as much money. Coincidence? You be the judge. <https://www.radionz.co.nz/national/programmes/mediawatch/audio/2018680533/g…> By the way, it seems they have stopped making Ogg versions of items like these available for playback or download -- the links for the above one are only for an MP3 version. Also, I don’t agree that the distinction between “artificial intelligence” and “machine learning” is that clear-cut. I did a graduate course on AI back in the day, and it was already a pretty fuzzy concept back then. Except for one quite concise, mathematically-based definition I came across that appealed to me: “solving NP problems in polynomial time”.

2 2

Open Source Project Aims To Make Ubuntu Usable on Arm-Powered Windows Laptops
by Peter Reutemann 14 Feb '19

14 Feb '19

'A group of programmers and device hackers are working to bring proper support for Ubuntu to Arm-powered Windows laptops, starting with first-generation Snapdragon 835 systems, like the HP Envy x2 and Asus NovaGo. From a report: The aarch64-laptops project provides prebuilt images for the aforementioned notebook PCs, as well as the Lenovo Miix 630. Although Ubuntu and other Linux distributions support aarch64 (ARMv8) by default, various obstacles including the design and configuration of Qualcomm Snapdragon processors make these default images not practically usable. The aarch64-laptops project developers are aiming to address these difficulties, though work is still ongoing. Presently, the TouchPad does not work properly on the Asus, with all three lacking proper support for on-board storage and Wi-Fi, which rely on UFS support. According to their documentation, this is being worked on upstream.' -- source: https://news.slashdot.org/story/19/02/14/1448221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

R-Pi manufacturing moving out of UK.
by Ian Stewart 14 Feb '19

14 Feb '19

David Cleevely is an entrepreneur based in Cambridge, England. In 2014 he became Chairman of the Raspberry Pi Foundation and of Raspberry Pi Trading. Earlier this week he sent out the twitter: With a heavy heart I have sent the first email laying the ground for moving manufacturing out of the UK because of Brexit and the tariff and certification problems it will cause. Real businesses. Real employment. Real taxes. Lost. The twitter discussion is here<https://twitter.com/DavidCleevely/status/1094916009276919808>. ...Your next R-Pi may be Irish or Dutch. cheers, Ian.

2 1

The BuzzFeed Bubble Bursts: Mass Layoffs Across Digital Media
by Lawrence D'Oliveiro 14 Feb '19

14 Feb '19

Facebook and Google are not only sucking the oxygen out of advertising revenues for newspapers, they are also doing the same for online news outlets, such as BuzzFeed, the Huffington Post, and Vice. <https://www.aljazeera.com/programmes/listeningpost/2019/02/buzzfeed-bubble-…>

1 0

The Second Navstar GPS Rollover Approaches
by Lawrence D'Oliveiro 12 Feb '19

12 Feb '19

The US GPS* protocol represents times using a 10-bit field for the week number. This has already rolled over once, from 1023 back to 0, back in 1999, which broke some devices that hadn’t been designed to cope with it. A second rollover is now approaching, as of April 6th (the first Saturday in April). Guess what’s going to happen this time ... <https://www.theregister.co.uk/2019/02/12/current_gps_epoch_ends/> *Seems the original official name “Navstar” has been dropped, and “GPS”, instead of being a generic term for such satellite-based navigation systems, is now the specific name of the US one.

1 0