- wlug - list.wlug.org.nz

Google News App Bug Is Using Up Gigabytes of Background Data Without Users' Knowledge
by Peter Reutemann 23 Oct '18

23 Oct '18

'A bug in the Google News app for Android is reportedly causing the app to use up excessive amounts of background data, leading to overage charges. "According to dozens of posts on the Google News Help Forum, users have been experiencing this issue as early as June," reports The Verge. "The issue was verified and addressed by a Google News community manager in September, stating that the company was investigating and working toward a fix, but the issue is still ongoing." From the report: Verge reader Zach Dowdle emailed in with his experience, and screenshots of his app and Wi-Fi data usage: "The Google News app is randomly using a ridiculous amount of background data without users' knowledge. The app burned through over 12 gigs of data on my phone while I slept and my Wi-Fi had disconnected. It lead to $75 in overage charges." According to several users, the app burned through mobile data despite having "Download via Wi-Fi" turned on in the settings. In some extreme cases, the Google News app used up to 24GB of data, leading to overage charges of up to $385, users reported. So far, the only solutions seem to be disabling background data, and deleting the app altogether. ' -- source: https://tech.slashdot.org/story/18/10/23/0340211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Reportedly Going To Sell VPN Subscriptions Within Firefox
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla is reportedly preparing to offer a VPN service for Firefox users to help protect them when surfing the web. According to Trusted Reviews, Mozilla has partnered with the ProtonVPN service, "with a new notification piping-up when the browser detects an unsecured connection, or in a scenario when VPN might be preferable to users." >From the report: However, it appears Firefox users will have to pay for the privilege. Austrian site Soeren-hentzschel reports the premium VPN service will be $10 a month, which is what ProtonVPN charges its users. Users will receive a "Firefox Recommends" pop-up when browsing an unsecured wireless network. The pop-up says the VPN service will provide a "private and secure' internet connection. According to the reports, a subset of Firefox 62 users in the United States will begin receiving the pop-up from today. Mozilla will reportedly get a cut of any subscription fee handed over by users to access the VPN service. MSPowerUser points out that this will be the first advertised service that costs money for Firefox users.' -- source: https://tech.slashdot.org/story/18/10/23/0351220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 63 Arrives With Enhanced Tracking Protection, Search Shortcuts, and Picture-in-Picture on Android
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla today launched Firefox 63 for Windows, Mac, Linux, and Android. The release brings Enhanced Tracking Protection, performance improvements on Windows and macOS, search shortcuts, and Picture-In-Picture on Android. From a report: Firefox 63 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play. According to Mozilla, Firefox has about 300 million active users. In other words, it's a major platform that web developers must consider. Firefox 63 for desktop brings support for Enhanced Tracking Protection. [...] Firefox 63's Enhanced Tracking Protection blocks cookies and storage access from third-party trackers, which Mozilla says targets the problem of cross-site tracking without breaking sites and impacting revenue streams like the original Tracking Protection. It does this by preventing known trackers from setting third-party cookies -- the primary method of tracking across sites -- but still gives you the option to block all known trackers (under Firefox Options/Preferences). [...] Search shortcuts essentially pins sites like Google and Amazon on the new tab page. When you click or tap them, you're redirected to Firefox's awesome bar, which automatically fills the corresponding keyword (@google or @amazon in this case) for the search engine. This way, you can type your query, hit enter, and get your search results without having to first load the Google or Amazon homepage. [...] The only major new feature for this Firefox for Android release is a picture-in-picture mode (Android Oreo and up). This means that if you're watching a video in full-screen, when you switch away from Firefox it will move the video into a small floating window, which you can tap to return to the full video player.' -- source: https://news.slashdot.org/story/18/10/23/149223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Announces GNU Kind Communication Guidelines
by Peter Reutemann 23 Oct '18

23 Oct '18

'Richard Stallman has announced the GNU Kind Communication Guidelines, an effort "to start guiding people towards kinder communication." The Guidelines differ from a Code of Conduct in that it's trying to be proactive about kindness around free software development over being rules with possible actions when breaking them. These new GNU communication guidelines can be found at GNU.org along with Stallman's commentary. >From the guidelines: A code of conduct states rules, with punishments for anyone that violates them. It is the heavy-handed way of teaching people to behave differently, and since it only comes into action when people do something against the rules, it doesn't try to teach people to do better than what the rules require. To be sure, the appointed maintainer(s) of a GNU package can, if necessary, tell a contributor to go away; but we do not want to need to have recourse to that. The idea of the GNU Kind Communication Guidelines is to start guiding people towards kinder communication at a point well before one would even think of saying, "You are breaking the rules." The way we do this, rather than ordering people to be kind or else, is try to help people learn to make their communication more kind. I hope that kind communication guidelines will provide a kinder and less strict way of leading a project's discussions to be calmer, more welcoming to all participants of good will, and more effective.' -- source: https://news.slashdot.org/story/18/10/23/1418225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Motorola Becomes First Smartphone Company To Sell DIY Repair Kits To Its Customers
by Peter Reutemann 23 Oct '18

23 Oct '18

'As Apple continues to fight independent repair, Motorola has partnered with iFixit and pledged to support the right to repair movement. From a report: It is excellent news that Motorola has decided to make it as easy as possible for you to repair your phone. The company announced that it would begin selling replacement parts for all of its recent phones to customers, and it has partnered with iFixit to sell repair kits for phones like the Moto X, Z, G4, G5, and Droid Turbo 2. The kits come with tools, genuine Motorola-branded replacement parts, and instructions on how to fix your device. iFixit is currently selling replacement batteries, screens, and digitizer assemblies. "Motorola is setting an example for major manufacturers to embrace a more open attitude towards repair," iFixit wrote in a blog post announcing the partnership. "For fixers like us, this partnership is representative of a broader movement in support of our Right to Repair. It's proof that OEM manufacturers and independent repair can co-exist. Big business and social responsibility, and innovation and sustainability, don't need to be mutually exclusive."' -- source: https://hardware.slashdot.org/story/18/10/23/1526248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rockstar Patent Consortium
by Lawrence D'Oliveiro 23 Oct '18

23 Oct '18

Hi folks. In our discussion on patents last night, I was trying to think of the name of this consortium that had acquired the patents from Nortel when it went bust. I was pretty sure it was called “Rockstar”, and I was right: <https://www.techdirt.com/articles/20131101/15353825101/patent-troll-shell-c…>. The outfit is/was owned by Microsoft and Apple, and one of the first things it did was to sue Google and a bunch of major makers of Android devices.

1 0

Now Apps Can Track You Even After You Uninstall Them
by Peter Reutemann 22 Oct '18

22 Oct '18

'If it seems as though the app you deleted last week is suddenly popping up everywhere, it may not be mere coincidence. From a report: Companies that cater to app makers have found ways to game both iOS and Android, enabling them to figure out which users have uninstalled a given piece of software lately -- and making it easy to pelt the departed with ads aimed at winning them back. Adjust, AppsFlyer, MoEngage, Localytics, and CleverTap are among the companies that offer uninstall trackers, usually as part of a broader set of developer tools. Their customers include T-Mobile US, Spotify Technology, and Yelp. Critics say they're a fresh reason to reassess online privacy rights and limit what companies can do with user data. "Most tech companies are not giving people nuanced privacy choices, if they give them choices at all," says Jeremy Gillula, tech policy director at the Electronic Frontier Foundation, a privacy advocate. Some providers say these tracking tools are meant to measure user reaction to app updates and other changes. Jude McColgan, chief executive officer of Boston's Localytics, says he hasn't seen clients use the technology to target former users with ads. Ehren Maedge, vice president for marketing and sales at MoEngage Inc. in San Francisco, says it's up to the app makers not to do so. "The dialogue is between our customers and their end users," he says. "If they violate users' trust, it's not going to go well for them." Adjust, AppsFlyer, and CleverTap didn't respond to requests for comment, nor did T-Mobile, Spotify, or Yelp. Uninstall tracking exploits a core element of Apple's and Google's mobile operating systems: push notifications. Developers have always been able to use so-called silent push notifications to ping installed apps at regular intervals without alerting the user -- to refresh an inbox or social media feed while the app is running in the background, for example. But if the app doesn't ping the developer back, the app is logged as uninstalled, and the uninstall tracking tools add those changes to the file associated with the given mobile device's unique advertising ID, details that make it easy to identify just who's holding the phone and advertise the app to them wherever they go.' -- source: https://yro.slashdot.org/story/18/10/22/1956257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds is Back in Charge of Linux
by Peter Reutemann 22 Oct '18

22 Oct '18

'At Open Source Summit Europe in Edinburgh, Scotland, Linus Torvalds is meeting with Linux's top 40 or so developers at the Maintainers' Summit. This is his first step back in taking over Linux's reins. From a report: A little over a month ago, Torvalds has stepped back from running the Linux development community. Then, in a note to the Linux Kernel Mailing List (LKML), Torvalds has said, "I need to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely." To do, this he took time off "to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely. I am going to take time off and get some assistance on how to understand people's emotions and respond appropriately." That time is over. Torvalds is back. Whether he'll be a kinder and gentler Torvalds remains to be seen. In the Linux 4.19 announcement, Greg Kroah-Hartman, Linux's temporary leader and maintainer of the stable branch, wrote: "Linus, I'm handing the kernel tree back to you. You can have the joy of dealing with the merge window :)"' -- source: https://linux.slashdot.org/story/18/10/22/1145234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now, For Something Remarkably Soothing ...
by Lawrence D'Oliveiro 19 Oct '18

19 Oct '18

Here is Brian Eno’s famous Windows 95 startup sound, slowed down by 40:1, so it is now nearly 4 minutes long: <https://soundcloud.com/ideoforms/windows-95-startup-sound>.

2 1

OpenBSD 6.4 Released
by Peter Reutemann 19 Oct '18

19 Oct '18

'The 45th version of the OpenBSD project has been released, bringing more hardware support (Radeon driver updates, Intel microcode integration, and more), a virtualization tool that supports the disk format qcow2, and a network interface where you can quickly join and switch between different Wi-Fi networks. Root.cz also notes that audio recording is now disabled by default. If you need to record audio, it can be enabled with the new sysctl variable. An anonymous Slashdot reader first shared the announcement. You can download it from any of the mirrors here.' -- source: https://bsd.slashdot.org/story/18/10/18/2056242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday?
by Peter Reutemann 18 Oct '18

18 Oct '18

Hi everyone Any suggestions for a topic/presentation next Monday, the last meeting before the AGM in November? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Linux 18.10 'Cosmic Cuttlefish' Arrives
by Peter Reutemann 18 Oct '18

18 Oct '18

'Ubuntu 18.10 Cosmic Cuttlefish, the latest version of Ubuntu, is now available to download. From a report: Under the hood, the Cosmic Cuttlefish boasts the 4.18 Linux Kernel. This updates comes with better support for for AMD and Nvidia GPU, USB Type-C and Thunderbolt, a way for unprivileged users to mount Filesystem in Userspace (FUSE) can be mounted by, and CPUfreq performance improvements. On top of this, you'll find the freshest version of GNOME 3.30. You can, of course, use other desktops, but GNOME, since Ubuntu 17.10, is Ubuntu's default desktop. You'll be glad to know that GNOME is faster than it has been for a while. That's because some nasty memory leaks have been patched. Canonical has also added some performance tweaks that didn't make it into the GNOME 3.30 upstream. Ubuntu 18.10 also comes with a new desktop theme, the Yaru Community theme installed by default, for your visual enjoyment.' -- source: https://news.slashdot.org/story/18/10/18/1840201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

After $5 billion EU antitrust fine, Google will start charging for Android apps
by Peter Reutemann 17 Oct '18

17 Oct '18

'Google is adjusting to life in the EU after the $5.05 billion (€4.34 billion) antitrust fine levied against it by the European Commission earlier this year. Google is still appealing the initial ruling, which found that Google used Android to illegally dominate the search market, but for now Google will comply with the ruling and offer looser licensing agreements to Android device makers. In a post on the official Google Blog titled "Complying with the EC’s Android decision," Google outlined a few changes coming to the Google app licensing agreements that it offers to Android OEMs. As you might recall from the numerous times we've written about it, this announcement is a change to the secretive "Mobile Application Distribution Agreement" (MADA) document that is a requirement for getting access to the Play Store and other Google apps. What we think of as a commercial "Android" device comes in two parts. The core Android OS is free and open source—anyone can take it and do whatever they want with it without Google's involvement. If you want the Play Store, Google Maps, Gmail, and all the other Google apps you need to make a viable commercial smartphone, though, you need to talk to Google and sign a MADA, which comes with a ton of restrictions. Google's new MADA makes three big changes. First, Google's blog states "Android partners wishing to distribute Google apps may also build non-compatible, or forked, smartphones and tablets for the European Economic Area (EEA)." [...] Google says it will also unbundle Search and Chrome from the rest of the Google apps. [...] The last change is definitely a shocker. Breaking up Google's licensing agreement is going to have a financial impact on OEMs. As Google puts it, "Since the pre-installation of Google Search and Chrome together with our other apps helped us fund the development and free distribution of Android, we will introduce a new paid licensing agreement for smartphones and tablets shipped into the EEA." That's right, OEMs now have to pay to access the Google apps, but Google doesn't say how much. The core Android OS, Google says "will remain free and open source." [...]' -- source: https://arstechnica.com/gadgets/2018/10/google-to-charge-oems-for-android-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Finds Simple Way of Backdooring Windows PCs and Nobody Notices for Ten Months
by Peter Reutemann 17 Oct '18

17 Oct '18

' A security researcher from Colombia has found a way of gaining admin rights and boot persistence on Windows PCs that's simple to execute and hard to stop -- all the features that hackers and malware authors are looking for from an exploitation technique. From a report: What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns. Discovered by Sebastian Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID). The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts. Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.' -- source: https://it.slashdot.org/story/18/10/17/1849255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Former Top Waymo Engineer Altered Code To Go on 'Forbidden Routes', Report Says
by Peter Reutemann 17 Oct '18

17 Oct '18

'In the early days of what ultimately became Waymo, Google's self-driving car division (known at the time as "Project Chauffeur"), there were "more than a dozen accidents, at least three of which were serious," according to a new article in The New Yorker . From a report: The magazine profiled Anthony Levandowski, the former Google engineer who was at the center of the Waymo v. Uber trade secrets lawsuit. According to the article, back in 2011, Levandowski also modified the autonomous software to take the prototype Priuses on "otherwise forbidden routes." Citing an anonymous source, The New Yorker reports that Levandowski sat behind the wheel as the safety driver, along with Isaac Taylor, a Google executive. But while they were in the car, the Prius "accidentally boxed in another vehicle," a Camry. As The New Yorker wrote: "A human driver could easily have handled the situation by slowing down and letting the Camry merge into traffic, but Google's software wasn't prepared for this scenario. The cars continued speeding down the freeway side by side. The Camry's driver jerked his car onto the right shoulder. Then, apparently trying to avoid a guard rail, he veered to the left; the Camry pinwheeled across the freeway and into the median. Levandowski, who was acting as the safety driver, swerved hard to avoid colliding with the Camry, causing Taylor to injure his spine so severely that he eventually required multiple surgeries." This was apparently just one of several accidents in Project Chauffeur's early days.' -- source: https://tech.slashdot.org/story/18/10/17/204215 Just another reason why self-driving cars should be open-sourced... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MongoDB Switches Up Its Open-Source License
by Peter Reutemann 17 Oct '18

17 Oct '18

'MongoDB is taking action against cloud giants who are taking its open-source code and offering a hosted commercial version of its database to their users without playing by the open-source rules. The company announced today that it has issued a new software license, the Server Side Public License (SSPL), "that will apply to all new releases of its MongoDB Community Server, as well as all patch fixes for prior versions," reports TechCrunch. From the report: For virtually all regular users who are currently using the community server, nothing changes because the changes to the license don't apply to them. Instead, this is about what MongoDB sees as the misuse of the AGPLv3 license. "MongoDB was previously licensed under the GNU AGPLv3, which meant companies who wanted to run MongoDB as a publicly available service had to open source their software or obtain a commercial license from MongoDB," the company explains. "However, MongoDB's popularity has led some organizations to test the boundaries of the GNU AGPLv3." So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."' -- source: https://developers.slashdot.org/story/18/10/16/2039253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

libssh 0.8.4 and 0.7.6 security and bugfix release
by Peter Reutemann 16 Oct '18

16 Oct '18

'This is an important security and maintenance release in order to address CVE-2018-10933. libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials. The bug was discovered by Peter Winter-Smith of NCC Group.' -- source: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… -- via twitter: https://twitter.com/FioraAeterna/status/1052294419607506944 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So It’s Not Just Me
by Lawrence D'Oliveiro 16 Oct '18

16 Oct '18

Given the number of tech-support scam calls I’ve been getting, I was starting to feel picked on. But it turns out it’s New Zealand as a whole that’s being picked on, with “more than three-quarters” of Kiwis sampled in a Microsoft study reporting that they had been targeted by these scammers <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121434…>. We are also more likely than any other nation (out of the 16 that took part in the survey) to experience fake popup browser notifications. But then, thinking about it, the “global average” of 62% of respondents getting the scam attempts smells rather strongly of sampling bias to me. It’s hard to believe that nearly two-thirds of the entire world population has been getting these calls ...

1 0

Paul Allen Has Died
by Lawrence D'Oliveiro 15 Oct '18

15 Oct '18

The Microsoft co-founder you didn’t hear so much about has lost his decades-long battle with cancer <https://www.aljazeera.com/news/2018/10/microsoft-founder-paul-allen-dies-ag…>. He was a philanthropist who quietly supported many causes with his riches. One of these was the Seattle Living Computer Museum <https://www.youtube.com/watch?v=Jk4J6y37OkY>, which has been working on getting various old classic machines back in working condition.

1 0

Rivals ARM and Intel Make Peace To Secure Internet of Things
by Peter Reutemann 15 Oct '18

15 Oct '18

'Rival semiconductor giants ARM and Intel have agreed to work together to manage networks of connected devices from both firms, clearing a major stumbling block to market growth of the so-called Internet of Things (IoT). From a report: Britain's ARM, a unit of Japan's Softbank, said on Monday it had struck a strategic partnership with Intel to use common standards developed by Intel for managing IoT devices, connections and data. The IoT involves connecting simple chips that detect distance, motion, temperature, pressure and images to be used in an ever wider range of electronics such as lights, parking meters or refrigerators. Some of the world's dumbest electronics devices get smarter by becoming connected into cloud networks, but also harder to protect. ARM's agreement to adopt Intel standards for securely managing such networks marks a breakthrough that promises to drive the spread of IoT across many industries, the two companies said.' -- source: https://it.slashdot.org/story/18/10/15/1338259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Shares Thoughts on Microsoft Joining Open Invention Network's Patent Non-Aggression Pact
by Peter Reutemann 14 Oct '18

14 Oct '18

'Earlier this week, Microsoft announced that it was joining the open-source patent consortium Open Invention Network (OIN). The press release the two shared this week was short on details on how the two organizations intend to work together and what does the move mean to, for instance, the billions of dollars Microsoft earns each year from its Android patents (since Google is a member of OIN, too.) Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software, has weighed in on the subject: While [this week's] announcement is a step forward, we call on Microsoft to make this just the beginning of their efforts to stop their patent aggression efforts against the software freedom community. The OIN patent non-aggression pact is governed by something called the Linux System Definition. This is the most important component of the OIN non-aggression pact, because it's often surprising what is not included in that Definition especially when compared with Microsoft's patent aggression activities. Most importantly, the non-aggression pact only applies to the upstream versions of software, including Linux itself. We know that Microsoft has done patent troll shakedowns in the past on Linux products related to the exfat filesystem. While we at Conservancy were successful in getting the code that implements exfat for Linux released under GPL (by Samsung), that code has not been upstreamed into Linux. So, Microsoft has not included any patents they might hold on exfat into the patent non-aggression pact. We now ask Microsoft, as a sign of good faith and to confirm its intention to end all patent aggression against Linux and its users, to now submit to upstream the exfat code themselves under GPLv2-or-later. This would provide two important protections to Linux users regarding exfat: (a) it would include any patents that read on exfat as part of OIN's non-aggression pact while Microsoft participates in OIN, and (b) it would provide the various benefits that GPLv2-or-later provides regarding patents, including an implied patent license and those protections provided by GPLv2 (and possibly other GPL protections and assurances as well).' -- source: https://yro.slashdot.org/story/18/10/14/2140221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The OS That Did Too Much
by Lawrence D'Oliveiro 13 Oct '18

13 Oct '18

You may have heard of the recent Windows 10 update (now withdrawn) that was causing some users to lose their files. There is an analysis of the problem, reported here <https://www.theregister.co.uk/2018/10/10/microsoft_windows_deletion_bug/>. It was a consequence of a feature known as “Known Folder Redirection”, which it seems only exists because of the drive-letter limitations of Windows. The closest analogue might be Linux mount points or symlinks, only the Windows version is more complicated, in usual Microsoft fashion. One mystery is that the bug was reported by multiple testers months before release, yet it seems their reports were ignored.

1 0

Facebook Offers Update On Recent Hack — And It's Bad. Here's How To Find Out If You Were Affected And What It Means
by Peter Reutemann 13 Oct '18

13 Oct '18

'Late last month Facebook announced the service had been hacked, resulting in the theft of data from 50 million users. Today Facebook finally issued an update on what the company's continuing investigation has found regarding the scale and scope of the attack. While the official press release presents the findings in a matter-of-fact manner, tech reporters have been quick to point out that the actual risks posed by what the attackers possess are alarming. The hackers used an exploit particular to the "View As" feature that allowed them to steal access tokens, letting the hackers take over accounts they did not already possess the passwords to. Facebook's press release notes that "the attackers already controlled a set of accounts, which were connected to Facebook friends." Starting by taking over friends of those initial accounts, the hackers stole tokens for "about 400,000" accounts. From there, the hackers used a portion of those accounts' friend lists to take over 30 million accounts. The press release is quick to note that this is less than Facebook's initial assessment that 50 million accounts had been compromised ("about 30 million actually had their tokens stolen," emphasis Facebook's).' -- source: http://digg.com/2018/facebook-hack-30-million-users-contact-info-2fa Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Rebukes Australia's 'Dangerously Ambiguous' Anti-Encryption Bill
by Peter Reutemann 13 Oct '18

13 Oct '18

'Apple has strongly criticized Australia's anti-encryption bill, calling it "dangerously ambiguous" and "alarming to every Australian." >From a report: The Australian government's draft law -- known as the Access and Assistance Bill -- would compel tech companies operating in the country, like Apple, to provide "assistance" to law enforcement and intelligence agencies in accessing electronic data. The government claims that encrypted communications are "increasingly being used by terrorist groups and organized criminals to avoid detection and disruption," without citing evidence. But critics say that the bill's "broad authorities that would undermine cybersecurity and human rights, including the right to privacy" by forcing companies to build backdoors and hand over user data -- even when it's encrypted. Now, Apple is the latest company after Google and Facebook joined civil and digital rights groups -- including Amnesty International -- to oppose the bill, amid fears that the government will rush through the bill before the end of the year. In a seven-page letter to the Australian parliament, Apple said that it "would be wrong to weaken security for millions of law-abiding customers in order to investigate the very few who pose a threat." The company adds, "We appreciate the government's outreach to Apple and other companies during the drafting of this bill. While we are pleased that some of the suggestions incorporated improve the legislation, the unfortunate fact is that the draft legislation remains dangerously ambiguous with respect to encryption and security. This is no time to weaken encryption. Rather than serving the interests of Australian law enforcement, it will just weaken the security and privacy of regular customers while pushing criminals further off the grid."' -- source: https://apple.slashdot.org/story/18/10/12/1856202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers
by Peter Reutemann 13 Oct '18

13 Oct '18

'A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.' -- source: https://mobile.slashdot.org/story/18/10/12/2052202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0