- wlug - list.wlug.org.nz

A Large Number of Top Free VPN Apps Either Have Chinese Ownership or Are Based in China
by Peter Reutemann 21 Jan '19

21 Jan '19

'William Chalk, reporting for HackerNoon: After big names like Whatsapp, Snapchat, and Facebook, VPNs are the most searched-for applications in the world. "VPN" is the second-highest non-branded search term behind "games", and free apps completely dominate the search results. The most popular applications have amassed hundreds of millions of installs between them worldwide, yet there seems to be very little attention paid to the companies behind them, and very little scrutiny done on behalf of the marketplaces hosting them. We investigated the top free VPN apps in the App Store and Google Play Store. We found that very few of these hugely popular apps do anywhere near enough to deserve the trust of those looking to protect their privacy online. We recorded the top 20 free apps in the search results for "VPN" in the App and Play Store for UK and US locales. In total, these applications have been downloaded 80 million times from Google and 4 million times each month from Apple. Our investigation discovered that over half of the top free VPN apps either have Chinese ownership or are actually based in China, which has aggressively clamped down on VPN services in recent years and maintains an iron grip on the internet within its borders. Furthermore, we found the majority of these apps have insufficient formal privacy protections and non-existent user support.' -- source: https://yro.slashdot.org/story/19/01/21/1425201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular WordPress Plugin WPML Hacked By Angry Former Employee
by Peter Reutemann 20 Jan '19

20 Jan '19

'A very popular WordPress plugin was hacked over the weekend after a hacker defaced its website and sent a mass message to all its customers revealing the existence of supposed unpatched security holes. From a report: In a follow-up mass email, the plugin's developers blamed the hack on a former employee, who also defaced their website. The plugin in question is WPML (or WP MultiLingual), the most popular WordPress plugin for translating and serving WordPress sites in multiple languages. According to its website, WPML has over 600,000 paying customers and is one of the very few WordPress plugins that is so reputable that it doesn't need to advertise itself with a free version on the official WordPress.org plugins repository. But on Saturday, ET timezone, the plugin faced its first major security incident since its launch in 2007. The attacker, which the WPML team claims is a former employee, sent out a mass email to all the plugin's customers.' -- source: https://tech.slashdot.org/story/19/01/20/2156231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Quest For Free/Libre Non-Linear Video Editors
by Lawrence D'Oliveiro 20 Jan '19

20 Jan '19

A good summary <http://libregraphicsworld.org/blog/entry/the-quest-for-sustainable-free-lib…> of the state of various efforts to create Free Software video editor apps, covering all the ones you have likely heard of, and maybe some you haven’t.

1 0

Today Is The 110th Of October
by Lawrence D'Oliveiro 17 Jan '19

17 Jan '19

Microsoft’s “October 2018” Windows 10 update takes another step towards general rollout: Select Windows 10 devices are now automatically downloading Microsoft’s troubled 1809 update, according to the support page for the operating system. <https://www.theregister.co.uk/2019/01/17/windows_10_roll_out/>

1 0

Collection 1 Data Breach Exposes More Than 772 Million Email Addresses
by Peter Reutemann 17 Jan '19

17 Jan '19

'A collection of almost 773 million unique email addresses and just under 22 million unique passwords were exposed on cloud service MEGA. Security researcher Troy Hunt said the collection of data, dubbed Collection #1, totaled over 12,000 separate files and more than 87GB of data. ZDNet reports: "What I can say is that my own personal data is in there and it's accurate; right email address and a password I used many years ago," Hunt wrote. "In short, if you're in this breach, one or more passwords you've previously used are floating around for others to see." Some passwords, including his own, have been "dehashed", that is converted back to plain text. Hunt said he gained the information after multiple people reached out to him with concerns over the data on MEGA, with the Collection #1 dump also being discussed on a hacking forum. "The post on the forum referenced 'a collection of 2000+ dehashed databases and Combos stored by topic' and provided a directory listing of 2,890 of the files," Hunt wrote. The collection has since been removed. You can visit Hunt's Have I Been Pwned service to see if you are affected by this br' -- source: https://yro.slashdot.org/story/19/01/17/0552201 Link to have I been Pwned: https://haveibeenpwned.com/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Kills Its Experimental Firefox Test Pilot Program 3 Years After Launch
by Peter Reutemann 16 Jan '19

16 Jan '19

'Mozilla has announced that it is closing Firefox Test Pilot, an experimental program it launched three years ago. Firefox Test Pilot allowed users to try out potential new built-in Firefox features to understand if they are popular with users. The company says the program was used by an average of 100,000 daily users. A report adds: It's worth noting here that Test Pilot is separate from the various beta versions of Firefox, which are early iterations designed to fine-tune features intended for the prime-time Firefox. Test Pilot, on the other hand, is more about Mozilla dipping its toes in the water to see whether a new feature is worth pursuing at all in the main version of the app, or even as a standalone product. Ultimately, it allows Firefox developers to take bigger risks with their ideas.' -- source: https://news.slashdot.org/story/19/01/16/1752250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Guy Made a Computer Mouse That is Also a Functional Laptop
by Peter Reutemann 14 Jan '19

14 Jan '19

'A YouTube user who goes by Electronic Grenade has designed a computer mouse that is also a functional laptop. From a report: As detailed in a video published on Sunday, the computer mouse computer consists of a 3d-printed mouse, a Raspberry Pi microcontroller, a small keyboard, and a handful of components that were taken from a normal computer mouse. "Even though the screen is attached to the mouse, the sensitivity of the mouse makes it not that hard to follow along with what is happening on the screen," Electronic Grenade said in the video. Nevertheless, the mouse does have its faults. According to Electronic Grenade, a few resource intensive applications will occasionally cause the mouse computer to crash.' -- source: https://it.slashdot.org/story/19/01/14/1656224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gimp presentation
by John 14 Jan '19

14 Jan '19

Hi All, Is anyone prepared to share their knowledge on some of the aspects of Gimp at one of the meetings. My particular interests are: Working with layers. Creating and editing animations. Quick and dirty brush tips Air brush settings etc. Cheers John..

2 2

GNOME Internet Radio Locator 1.6.0 Released
by Peter Reutemann 14 Jan '19

14 Jan '19

'GNOME Internet Radio Locator 1.6.0 is now freely available for GNOME systems. The 1.6.0 release is a stable release with Internet radio stations from Norway, Sweden, Denmark, England, Scotland, France and Belgium, as well as U.S.A., Canada, Mexico and Guatemala, mapped for GNOME Maps and city text search interface with auto-completion for 76 world cities that are featured in this release. You may download the 1.6.0 release of GNOME Internet Radio Locator here and download packages for Fedora 28 and 29 on x86_64 here' -- source: https://tech.slashdot.org/story/19/01/13/209247 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vga..
by John 12 Jan '19

12 Jan '19

Hi All, If anyone has a VGA cable that they do not love anymore could you please bring to the meeting for me as I just gave my one to my neighbor. Dumb I know but that is what I do all the time... Cheers John..

2 1

Robocall -- New Kind Of Scammer?
by Lawrence D'Oliveiro 12 Jan '19

12 Jan '19

I just received an odd phone call which just played a (somewhat muffled and over-compressed) recorded message saying something like “This is Spark NZ informing you that your internet service is going to be terminated. For further information press 1, or press 2 for other queries.” After a few seconds, during which I did nothing, it hung up. I think I may have received a similar call maybe 2-3 weeks ago, because I heard a voice speaking on top of my recorded voice telling the caller to leave a message, but I was too far away at the time to make out what was being said.

3 4

Malware Found Preinstalled On Some Alcatel Smartphones
by Peter Reutemann 11 Jan '19

11 Jan '19

'A weather app that comes preinstalled on Alcatel smartphones contained malware that surreptitiously subscribed device owners to premium phone numbers behind their backs. The app, named "Weather Forecast-World Weather Accurate Radar," was developed by TCL Corporation, a Chinese electronics company that among other things owns the Alcatel, BlackBerry, and Palm brands. The app is one of the default apps that TCL installs on Alcatel smartphones, but it was also made available on the Play Store for all Android users --where it had been downloaded and installed more than ten million times. But at one point last year, both the app included on some Alcatel devices and the one that was available on the Play Store were compromised with malware. How the malware was added to the app is unclear. TCL has not responded to phone calls requesting comment made by ZDNet this week. The app reportedly harvested users' data and sent it to China. It collected geographic locations, email addresses, and IMEI codes, which it sent back to TCL. Upstream, a UK-based mobile security firm, also found that "the malicious code hidden inside the app would also attempt to subscribe users to premium phone numbers that incurred large charges on users' phone bills," reports ZDNet. "All in all, the company says it detected and blocked over 27 million transaction attempts across seven markets, which would have created losses of around $1.5 million to phone owners if they hadn't been blocked." Upstream notes that most of the behavior they've seen originated only from two types of smartphones: Pixi 4 and A3 Max models.' -- source: https://it.slashdot.org/story/19/01/10/2117234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet
by Peter Reutemann 10 Jan '19

10 Jan '19

'Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws.' -- source: https://linux.slashdot.org/story/19/01/10/1759253 BTW This is an FYI, not a reason to start a flame war again... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tool Automates Phishing Attacks That Bypass 2FA
by Peter Reutemann 09 Jan '19

09 Jan '19

'A new penetration testing tool published at the start of the year by a security researcher can automate phishing attacks with an ease never seen before and can even blow through login operations for accounts protected by two-factor authentication (2FA). From a report: Named Modlishka --the English pronunciation of the Polish word for mantis -- this new tool was created by Polish researcher Piotr Duszynski. Modlishka is what IT professionals call a reverse proxy, but modified for handling traffic meant for login pages and phishing operations. It sits between a user and a target website -- like Gmail, Yahoo, or ProtonMail. Phishing victims connect to the Modlishka server (hosting a phishing domain), and the reverse proxy component behind it makes requests to the site it wants to impersonate. The victim receives authentic content from the legitimate site --let's say for example Google -- but all traffic and all the victim's interactions with the legitimate site passes through and is recorded on the Modlishka server.' -- source: https://it.slashdot.org/story/19/01/09/1817234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash-5.0 release available
by Peter Reutemann 08 Jan '19

08 Jan '19

'This release fixes several outstanding bugs in bash-4.4 and introduces several new features. The most significant bug fixes are an overhaul of how nameref variables resolve and a number of potential out-of-bounds memory errors discovered via fuzzing. There are a number of changes to the expansion of $@ and $* in various contexts where word splitting is not performed to conform to a Posix standard interpretation, and additional changes to resolve corner cases for Posix conformance. The most notable new features are several new shell variables: BASH_ARGV0, EPOCHSECONDS, and EPOCHREALTIME. The `history' builtin can remove ranges of history entries and understands negative arguments as offsets from the end of the history list. There is an option to allow local variables to inherit the value of a variable with the same name at a preceding scope. There is a new shell option that, when enabled, causes the shell to attempt to expand associative array subscripts only once (this is an issue when they are used in arithmetic expressions). The `globasciiranges' shell option is now enabled by default; it can be set to off by default at configuration time. There are a few incompatible changes between bash-4.4 and bash-5.0. The changes to how nameref variables are resolved means that some uses of namerefs will behave differently, though I have tried to minimize the compatibility issues. By default, the shell only sets BASH_ARGC and BASH_ARGV at startup if extended debugging mode is enabled; it was an oversight that it was set unconditionally and caused performance issues when scripts were passed large numbers of arguments.' -- source: http://lists.gnu.org/archive/html/bug-bash/2019-01/msg00063.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fwd: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members!
by Peter Reutemann 08 Jan '19

08 Jan '19

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: Dave Lane <president(a)nzoss.org.nz> Date: Tue, Jan 8, 2019 at 4:08 PM Subject: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members! To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hello everyone, The organisers of 2019's Linux.conf.au (it's here in Christchurch in 2 weeks - 21-25 Jan!) have kindly extended a discount offer to full (financial) NZOSS members, which makes the hobbyist registration price $399 (discounted from $549, so $150 reduction!) for those wanting to attend! Given that the savings is substantially more than the cost of becoming an NZOSS member ($40 - https://members.nzoss.nz) seems quite worthwhile! If you haven't been to an LCA before (this'll be my 6th), they're superb. Go. I'll provide the discount code to any current (or recent 🙂 ) financial members requesting one... The window for registration closes on 15 January, so don't dilly-dally! Hope to see many of you there! Dave -- Dave Lane, President, New Zealand Open Source Society e: president(a)nzoss.org.nz m: 021 229 8147 w: http://nzoss.org.nz ―― View topic http://groups.nzoss.org.nz/r/topic/60OKMe2P8pajbBBtpNRr4L Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Denies Using Fingerprinting To Track Its Users
by Peter Reutemann 08 Jan '19

08 Jan '19

'Responding to a forum post that accused it of 'fingerprinting users', privacy-centric search engine DuckDuckGo says that fears are unfounded and that it is not tracking its users. The allegation was made after the Firefox extension CanvasBlocker showed a warning to users. The suggestion of fingerprinting -- gathering as much information as possible about a user through their browser to create a unique identifier that can be used for tracking -- is clearly something that would seem to sit in opposition to what DuckDuckGo claims to stand for. The company CEO says the accusation is simply wrong.' -- source: https://search.slashdot.org/story/19/01/07/194206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sony Appears To Be Blocking Kodi On Its Recent Android TVs
by Peter Reutemann 08 Jan '19

08 Jan '19

'Several reports indict that at least some of Sony's recent Android TVs are actively blocking Kodi, the open-source, cross-platform streaming and media player that allows you to access and play local, network, and remote content. Android Police reports: The official Kodi project Twitter account pointed out Sony's deficiency a couple of days ago, but reports on the Kodi forums of issues installing and running the app from the Play Store go even further back to last year. A handful of affected enthusiasts believe they have discovered the cause of the problem: Sony seems to be blocking the package ID for the app from being installed/run. Supporting this theory is the fact that recompiling the app from scratch with a different ID allows it to work. ' -- source: https://yro.slashdot.org/story/19/01/07/2211200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meetings for 2019
by Peter Reutemann 08 Jan '19

08 Jan '19

Hi everyone I finally have all the room bookings for 2019 sorted (the guys doing the bookings are overworked and understaffed due to holidays). The university changed its policy around providing rooms on holiday from a "we'll coordinate with security" to a "should not be allowed". Instead of going to the pub three times (Jan/Apr/Oct), listening to pub quizzes, I decided to break with our 4th Monday tradition for these months and have the meetings on the 3rd Monday instead. Here's the complete list of meetings for 2019, for those that don't use meetup.com: Jan 21 -- 3rd Monday Feb 25 Mar 25 Apr 15 -- 3rd Monday May 27 Jun 24 Jul 22 Aug 26 Sep 23 Oct 21 -- 3rd Monday Nov 25 Here is the link to our meetup.com community page: https://www.meetup.com/WaikatoLinuxUsersGroup/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Cars: Tesla Isn't The Only Automaker Running Linux Under the Hood
by Peter Reutemann 06 Jan '19

06 Jan '19

'ZDNet reports that by 2020, "many, if not most, new cars will be running with Linux." While some companies, like Tesla, run their own homebrew Linux distros, most rely on Automotive Grade Linux (AGL). AGL is a collaborative cross-industry effort developing an open platform for connected cars with over 140 members... Its membership includes Audi, Ford, Honda, Mazda, Nissan, Mercedes, Suzuki, and the world's biggest automobile company: Toyota. Why? "Automakers are becoming software companies, and just like in the tech industry, they are realizing that open source is the way forward," said Dan Cauchy, AGL's executive director, in a statement. Car companies know that while horsepower sells, customers also want smart infotainment systems, automated safe drive features, and, eventually, self-driving cars. Linux and open-source company can give them all of that. The AGL's goal is to develop an open-source, common platform for infotainment systems: The Unified Code Base (UCB). This is a Linux distribution and open-source software platform for car infotainment, telematics, and instrument cluster applications... The AGL's hope is that this will serve as a de facto industry standard. It's well on its way. Yesterday Hyundai announced that they were also joining both the AGL effort and the Linux Foundation.' -- source: https://tech.slashdot.org/story/19/01/05/1928205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Eben Upton Remembers The Years Before the First Raspberry Pi
by Peter Reutemann 06 Jan '19

06 Jan '19

'Tech Republic re-visits the story of the earliest attempts to build the Raspberry Pi, and the dramatic launch of a quest "to rekindle the curiosity about computing in a generation immersed in technology but indifferent to how it worked." [T]he dominant computers -- games consoles and later tablets and smartphones -- no longer offered an invitation to create, but rather to consume. Eben Upton recalls a bonfire party in 2007 where an 11-year-old boy told him he wanted to be an electrical engineer, and his disappointment at realizing the boy didn't have access to a computer he could program on. "I said, 'Oh, what computer have you got?'. He said, 'I've got a Nintendo Wii'. And there was just that awful feeling about there being a kid who was excited, a kid who was showing concrete interest in our profession, and who didn't have access to a programmable computer, a computer of any sort. He just had a games console." At this time Upton was working as a system-on-a-chip architect at chip designer Broadcom, and realized he had the skills to try to halt this drift away from computers that encouraged users to code. Upton describes the Raspberry Pi as "a very conscious attempt" to bring back the easily programmable home computers that he remembered as a child in the 1980s -- and he was gratified at its success. "Even early on you started to see those pictures of kids lying on the living room floor, looking up at the TV with Raspberry Pi plugged into it, the same way we used to." It was named "Pi" because it booted into a version of Python, and Raspberry because "There's a lot of fruit-named computer companies, and the 'blowing a raspberry' thing was also deliberate." It's gone on to become the world's third best-selling general-purpose computer.' -- source: https://developers.slashdot.org/story/19/01/05/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux commands for measuring disk activity
by Peter Reutemann 04 Jan '19

04 Jan '19

'Linux systems provide a handy suite of commands for helping you see how busy your disks are, not just how full. In this post, we examine five very useful commands for looking into disk activity. Two of the commands (iostat and ioping) may have to be added to your system, and these same two commands require you to use sudo privileges, but all five commands provide useful ways to view disk activity.' -- source: https://www.networkworld.com/article/3330497/linux/linux-commands-for-measu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

DCP – Transfer Files Between Linux Hosts Using Peer-to-Peer Network
by Peter Reutemann 04 Jan '19

04 Jan '19

'People often need to copy or share files over the network. Many of us are used to using tools such as rsync or scp to transfer files between machines. In this tutorial, we are going to review another tool that can help you copy files between hosts in a network – Dat Copy (dcp). Dcp does not require SSH to be used or configured in order to copy your files. Furthermore it does not require any configuration to securely copy your files.' -- source: https://www.tecmint.com/dcp-copy-files-between-linux-servers/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mickey Mouse Will Be Public-Domain Soon; But What Will It Mean?
by Lawrence D'Oliveiro 03 Jan '19

03 Jan '19

Wonder of wonders, there has been no followup to the Sonny Bono Copyright Term Extension Act of 1998 <https://arstechnica.com/tech-policy/2019/01/a-whole-years-worth-of-works-ju…>. That means more and more interesting things are going to fall into the public domain from this year onwards. However, things are not going to be simple: the original incarnation of Walt Disney’s Mickey Mouse will be in the public domain after 2024, but later versions will still be under copyright, and the trademarks will also continue to be in effect. How will that work? Probably in the same way that “intellectual property” usually works: the one with the biggest legal budget wins.

1 0

Examples Of How Not To Code
by Lawrence D'Oliveiro 03 Jan '19

03 Jan '19

Presenting the “Damn Vulnerable Serverless Application” <https://www.theregister.co.uk/2019/01/03/damn_vulnerable_serverless_applica…>, the latest in a line of “damn vulnerable” apps that are chock-full of deliberately-introduced security vulnerabilities. My worry about this sort of thing is the mindless-copy-and-paste crowd. We already see the effects of posting sample code with error-checking omitted “just to keep things simple”, along with exhortations to use it only as a guide, not to be slavishly copied; such exhortations are routinely ignored. From there, it seems only a small step to completely miss the context of such counterexample code, and actually use it as something to be followed.

1 0