- wlug - list.wlug.org.nz

Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs
by Peter Reutemann 11 Oct '18

11 Oct '18

'Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.' -- source: https://yro.slashdot.org/story/18/10/11/1925256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Plex for Linux Now Available as a Snap
by Peter Reutemann 11 Oct '18

11 Oct '18

'Today, a very popular app, Plex Media Server, gets the Snap treatment. In other words, you can install the media server program without any headaches -- right from the Snap store. "In adopting the universal Linux app packaging format, Plex will make its multimedia platform available to an ever-growing community of Linux users, including those on KDE Neon, Debian, Fedora, Manjaro, OpenSUSE, Zorin and Ubuntu. Automatic updates and rollback capabilities are staples of Snap software, meaning Plex users will always have the best and latest version running," says Canonical.' -- source: https://linux.slashdot.org/story/18/10/11/193246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apache OpenOffice, the Schrodinger's Application: No One Knows If It's Dead or Alive, No One Really Wants To Look Inside
by Peter Reutemann 11 Oct '18

11 Oct '18

'British IT news outlet The Register looks at the myriad of challenges Apache OpenOffice faces today. From the report: Last year Brett Porter, then chairman of the Apache Software Foundation, contemplated whether a proposed official blog post on the state of Apache OpenOffice (AOO) might discourage people from downloading the software due to lack of activity in the project. No such post from the software's developers surfaced. The languid pace of development at AOO, though, has been an issue since 2011 after Oracle (then patron of the project) got into a fork-fight with The Document Foundation, which created LibreOffice from the OpenOffice codebase, and asked developers backing the split to resign. Back in 2015, Red Hat developer Christian Schaller called OpenOffice "all but dead." Assertions to that effect have continued since, alongside claims to the contrary. Almost a year ago, Jim Jagielski, a member of the Apache OpenOffice Project Management Committee, insisted things were going well and claimed there was renewed interest in the project. For all the concern about AOO, no issues have been raised recently before the Apache Foundation board to suggest ongoing difficulties. The project is due to provide an update this month, according to a spokesperson for the foundation.' -- source: https://apache.slashdot.org/story/18/10/11/1719238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations
by Peter Reutemann 10 Oct '18

10 Oct '18

Apologies for cross-posting, but I though this might be of interest to this list. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill <...> Date: Thu, Oct 11, 2018 at 10:50 AM Subject: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi NZOSS, Linux.Conf.Au 2019 is being held in Christchurch, New Zealand at the end of January 2019 (21-25 January). Early Bird tickets are on sale *this month* (https://linux.conf.au/attend/tickets/) As usual at LCA, we (Simon Lyall and I) are running a System Administration Miniconf at LCA2019, and we're looking for your proposals for presentations: http://sysadmin.miniconf.org/cfp19.html Please pass this on anywhere else you think people might be interested. The LCA2019 Sysadmin Miniconf CFP text is included below for your convenience. Ewen PS: The Sysadmin Miniconf is part of LCA2019; you'll need a ticket to LCA2019 to attend/speak. Grab your ticket for LCA2019 while the Early Bird pricing is available :-) -=- cut here -=- Call for Presentations Linux.conf.au 2019 Systems Administration Miniconf There will be a one day mini conference on Linux Systems Administration held as part of linux.conf.au 2019. LCA2019 will be held in Christchurch, New Zealand on 21 - 25 January 2019. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. This is our 13th Sysadmin Miniconf at Linux.conf.au. Previous presentations can be found at the website: https://sysadmin.miniconf.org/. Presentation Topics =================== We welcome talks on best current practice, new developments in Systems Administration, cutting edge techniques and technologies, and ways to better manage Linux environments large and small. Topics for presentations could include (but are not limited to): Virtualisation and Cloud Computing Kubernetes / Docker / Containers / Orchestration Infrastructure/Platform/Software as a Service (IAAS, PAAS, SAAS) Sysadmin Administration in a "serverless" environment (FAAS) DevOps and SysAdmin Culture Systems Administration Best Practice Monitoring and metrics. Collection, storage and presentation Networkng: IPv6, SDN (Software Defined Networking), performance DevOps, Configuration Management and provisioning Bootstrapping systems, Lifecycle Management Dealing with BYOD Backups in a virtual/distributed world Troubleshooting techniques Keeping legacy systems functioning War stories from the "Real World" Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Unix/Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= We are now seeking proposals for presentations at the mini-conference. We have openings for: 15-25 minute short presentations 5-10 minute "lightning talks" Please note, due to the single day available (and whole-LCA opening before morning tea), we expect the majority of available timeslots to be 20 minutes or less, with possibly 1-2 slightly longer talks if there is space in the schedule. We have a general policy of accepting a high proportion of proposals but handing out relatively short timeslots. Please see previous years Miniconf schedules for examples of how the programme is organised. Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Presenting at the Miniconf does not entitle you to discounted or free registration at the main conference nor to priority with registration. Unfortunately the Miniconf has no budget for sponsorship of speakers. To submit a talk to the LCA2019 Sysadmin Miniconf, create an account on the LCA2019 website: https://linux.conf.au/dashboard create a speaker profile, and then select "SysAdmin Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2019 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Please pick a preferred length for your presentation from Short Presentation (15/20/25 minutes) or Lightning Talk (5/10 minutes) in the submission form; if you could do either (with more or less detail) use the Private Abstract field to describe the options and what you would prefer. In some cases we maybe able to add a few extra minutes to a few Short Presentations if there is any spare time left in the programme. Use the Private Abstract field to let us know a few more minutes would be useful for your presentation. Questions should be sent to: lca2019 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (any time zone) on 31st of October 2018. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. Please let us know directly if you need an early confirmation to assist you in arranging time off work or travel; we will do our best to help. 2018-10-31 - Deadline for early submissions 2018-11-18 - Deadline for submissions 2018-12-04 - LCA2019 Sysadmin Miniconf programme published 2019-01-21 - LCA2019 Sysadmin Miniconf held (Christchurch, NZ) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2019 at sysadmin.miniconf.org -=- cut here -=- ―― View topic http://groups.nzoss.org.nz/r/topic/1uwhAyhI0xwJwbMnlKgBTZ Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.14 Released
by Peter Reutemann 09 Oct '18

09 Oct '18

'KDE has released Plasma 5.14 desktop. Among many other things, Plasma 5.14 simplifies managing multiple displays thanks to its new Display Configuration widget; Global Menus a la macOS now work also with GTK applications like GIMP; a new safeguard feature warns you if other users are logged in when you log out; and Discover now lets you install Snaps from all available channels (not just the default), orders software by release date, and shows package dependencies.' -- source: https://tech.slashdot.org/story/18/10/09/2159259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 70's Upcoming Security Change Will Break Hundreds of Sites
by Peter Reutemann 09 Oct '18

09 Oct '18

'When Chrome 70 arrives on October 16th, it will drop trust for a major HTTPS certificate provider, putting hundreds of popular websites at risk of breaking. "Chrome 70 is expected to be released on or around October 16, when the browser will start blocking sites that run older Symantec certificates issued before June 2016, including legacy branded Thawte, VeriSign, Equifax, GeoTrust and RapidSSL certificates," reports TechCrunch. From the report: [D]espite more than a year to prepare, many popular sites are not ready. Security researcher Scott Helme found 1,139 sites in the top one million sites ranked by Alexa, including Citrus, SSRN, the Federal Bank of India, Pantone, the Tel-Aviv city government, Squatty Potty and Penn State Federal to name just a few. Ferrari, One Identity and Solidworks were named on the list but recently switched to new certificates, escaping any future outages. HTTPS certificates encrypt the data between your computer and the website or app you're using, making it near-impossible for anyone -- even on your public Wi-Fi hotspot -- to intercept your data. Not only that, HTTPS certificates prove the integrity of the the site you're visiting by ensuring the pages haven't been modified in some way by an attacker. Most websites obtain their HTTPS certificates from a certificate authority, which abide by certain rules and procedures that over time become trusted by web browsers. If you screw that up and lose their trust, the browsers can pull the plug on all of the certificates from that authority. For these reasons, Google stopped supporting Symantec certificates last year after it was found to be issuing misleading and wrong certificates, as well as allowing non-trusted organizations to issue certificates without the proper oversight.' -- source: https://it.slashdot.org/story/18/10/09/008210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Exposed Private Data of Hundreds of Thousands of Google+ Users and Then Opted Not To Disclose, Report Says
by Peter Reutemann 08 Oct '18

08 Oct '18

'Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, WSJ reported Monday, citing people briefed on the incident and documents. From the report: As part of its response to the incident, the Alphabet unit plans to announce a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+, the people said. The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures. A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.' -- source: https://yro.slashdot.org/story/18/10/08/1710208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: Outside Phone Vendors Aren't Updating Their Linux Kernels
by Peter Reutemann 06 Oct '18

06 Oct '18

'"Linux runs the world, right? So we want to make sure that things are secure," says Linux kernel maintainer Greg Kroah-Hartman. When asked in a new video interview which bug makes them most angry, he first replies "the whole Spectre/Meltdown problem. What made us so mad, in a way, is we were fixing a bug in somebody else's layer!" One also interesting thing about the whole Spectre/Meltdown is the complexity of that black box of a CPU is much much larger than it used to be. Right? Because they're doing -- in order to eke out all the performance and all the new things like that, you have to do extra-special tricks and things like that. And they have been, and sometimes those tricks come back to bite you in the butt. And they have, in this case. So we have to work around that. But a companion article on Linux.com notes that "Intel has changed its approach in light of these events. 'They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,' Kroah-Hartman said." (And the article adds that "for those who want to build a career in kernel space, security is a good place to get started...") Kroah-Hartman points out in the video interview that "we're doing more and more testing, more and more builds," noting "This infrastructure we have is catching things at an earlier stage -- because it's there -- which is awesome to see." But security issues can persist thanks to outside vendors beyond their control. Linux.com reports: Hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That's not happening. Kroah-Hartman releases a stable kernel every week, and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don't include the additional hardening features, meaning all those phones are vulnerable. "People need to enable this stuff," he said. "I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel," he said. "I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people." "The good news," according to Linux.com, "is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It's effortless to update and reboot with no downtime."' -- source: https://linux.slashdot.org/story/18/10/06/1736258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

California Bans Default Passwords on Any Internet-Connected Device
by Peter Reutemann 06 Oct '18

06 Oct '18

'In less than two years, anything that can connect to the internet will come with a unique password -- that is, if it's produced or sold in California. From a report: The "Information Privacy: Connected Devices" bill that comes into effect on January 1, 2020, effectively bans pre-installed and hard-coded default passwords. It only took the authorities about two weeks to approve the proposal made by the state senate. The new regulation mandates device manufacturers to either create a unique password for each device at the time of production or require the user to create one when they interact with the device for the first time. According to the bill, it applies to any connected device, which is defined as a "physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address."' -- source: https://it.slashdot.org/story/18/10/05/1814242 Good bye, "admin/admin"! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Support Google's WebP Image Format For a Faster Web
by Peter Reutemann 06 Oct '18

06 Oct '18

'Firefox has joined Google's WebP party, another endorsement for the internet giant's effort to speed up the web with a better image format. From a report: Google revealed WebP eight years ago and since then has built it into its Chrome web browser, Android phone software and many of its online properties in an effort to put websites on a diet and cut network data usage. But Google had trouble encouraging rival browser makers to embrace it. Mozilla initially rejected WebP as not offering enough of an improvement over more widely used image formats, JPEG and PNG. It seriously evaluated WebP but chose to try to squeeze more out of JPEG. But now Mozilla -- like Microsoft with its Edge browser earlier this week -- has had a change of heart. "Mozilla is moving forward with implementing support for WebP," the nonprofit organization said. WebP will work in versions of Firefox based on its Gecko browser engine, Firefox for personal computers and Android but not for iOS.' -- source: https://news.slashdot.org/story/18/10/05/1755247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Look at Facebook's Use of Systemd
by Peter Reutemann 06 Oct '18

06 Oct '18

'At an event this month (you can find the video of it here), Davide Cavalca, a production engineer at Facebook, spoke about the growing adoption of systemd at the data centers of the company. From a report: Facebook continues making use of systemd's many features inside their data centers. Some of their highlights for systemd use in 2018 includes: Facebook's servers have been relying on systemd for about the past two years. Facebook is using CentOS 7 everywhere from hosts to containers. While relying on CentOS 7, Facebook backports a lot of packages including new systemd releases, Meson, other dependencies, and of course new Linux kernel releases. Facebook is working on "pystemd" as a Python (Cython) wrapper on top of SD-BUS.' -- source: https://linux.slashdot.org/story/18/10/05/1717233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Embracing Android As the Mobile Version of Windows
by Peter Reutemann 03 Oct '18

03 Oct '18

'Microsoft unveiled a bunch of new hardware during a press event last night, but one of the most interesting announcements the company made was their new "Your Phone" app for Windows 10. Basically, the feature will let Android users mirror any app on their device to a Windows 10 desktop. The Verge's Tom Warren writes about how Microsoft is embracing Android as the mobile version of Windows: We've seen a variety of ways of bringing Android apps to Windows in recent years, including Bluestacks and even Dell's Mobile Connect software. This app mirroring is certainly easier to do with Android, as it's less restricted than iOS. Still, Microsoft's welcoming embrace of Android in Windows 10 with this app mirroring is just the latest in a number of steps the company has taken recently to really help align Android as the mobile equivalent of Windows. Microsoft Launcher is designed to replace the default Google experience on Android phones, and bring Microsoft's own services and Office connectivity to the home screen. It's a popular launcher that Microsoft keeps updating, and it's even getting support for the Windows 10 Timeline feature that lets you resume apps and sites across devices. All of this just reminds me of Windows Phone. It's only been three years since Microsoft launched its Lumia 950 Windows 10 Mobile device at a packed holiday hardware event. Windows Phone has vanished in the last couple of years, and Microsoft finally admitted Windows Phone was dead nearly a year ago. The software maker has now embraced the reality that people don't need Windows on a phone. Instead, it's embracing Android as the mobile version of Windows.' -- source: https://tech.slashdot.org/story/18/10/03/2051239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Intra App Encrypts DNS Queries To Help Users Bypass Online Censorship
by Peter Reutemann 03 Oct '18

03 Oct '18

'Catalin Cimpanu, writing for ZDNet: Jigsaw, a technology incubator created by Google and operated as a subsidiary under the Alphabet brand, has released today an Android app named Intra that can encrypt DNS queries as a protection against DNS manipulation at the ISP (internet service provider) level. DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more. Intra protects against DNS manipulation by keeping DNS traffic hidden from third-parties with state-level surveillance capabilities, such as internet service providers in countries with autocratic regimes. Reports suggest that Alphabet tested the app with a few dozen political activists in Venezuela before the global roll-out.' -- source: https://yro.slashdot.org/story/18/10/03/2042219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ungoogled-chromium
by Lawrence D'Oliveiro 03 Oct '18

03 Oct '18

Even though the Chromium browser is Open Source, it still does a whole lot of communication with Google’s servers, when it’s built and when it runs. This project <https://github.com/Eloston/ungoogled-chromium> tries to strip out all of that, while preserving the user-visible behaviour as much as possible.

1 0

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

Who Needs Special Hardware Random Number Generators?
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

The weak point in any encryption system has long been: how random are your random numbers? Providing special hardware for generating random numbers, special CPU instructions etc has always been open to the objection that their randomness could be subverted -- whether through some minor stupid mistake in implementation, or deliberately by certain powerful agencies -- and you would never know. Now, a new research paper <https://www.theregister.co.uk/2018/10/01/hardware_random_numbers/> proposes that normal CPU operation itself can be a source of random numbers. And the way these are obtained would in fact be very hard to subvert, since it is based on detecting subtle timing variations in the operations of various circuits. In other words, it is obtaining randomness from hardware that is not designed to be working randomly at all. And this should -- hopefully -- make the randomness very difficult to compromise.

1 0

NZ Customs Can Now Demand You Unlock Your Phone
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You can now face a $5,000 fine for not unlocking your phone if ordered to do so, when coming into NZ <https://www.theregister.co.uk/2018/10/01/nz_border_customs/>. Justice Minister Andrew Little says: “The bill provides for that power of search and examination, but in order to exercise that power, a customs officer, first of all, has to be satisfied, or at least to have a reasonable suspicion, that a person in possession of such a device—it would be a cellphone or a laptop or anything else that might be described as an 'e-device'—has been involved in criminal offending.” Howver, ... the Council of Civil Liberties criticised the “reasonable cause” protection as inadequate, because someone asked to unlock a device isn't told what that cause might be, and therefore has no way to challenge the request.

1 0

Five-Eyes Intelligence Services Choose Surveillance Over Security
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

The “Five Eyes” intelligence group (which includes New Zealand) have issued a statement where they claim that the increasing use of secure encryption is endangering law and order and national security. Here is one of many reactions <https://www.schneier.com/blog/archives/2018/09/five-eyes_intel.html>. This whole claim has been repeated so many times it is getting tedious. This group, of all people, with access to the most qualified pool of cryptographic talent in the world, should be able to get an opinion from their own experts on whether this is doable or not -- and if it was, they could show us all how it’s done and make Bruce Schneier and all the rest of the open community of security researchers look like fools. But they won’t do that, because they can’t. Instead, we see this ongoing harping on the issue, as though it can magically be fixed by passing a law or two. The UK (among other countries) has already criminalized the failure to disclose decryption keys <https://en.wikipedia.org/wiki/Key_disclosure_law>, and decreed that forgetting the key is no excuse.

1 1

Wellywood’s Digital Edge Has Dulled
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You may have seen an item in the news lately about a report into the large amount of subsidies that the Government puts into the local film industry. This latest report says that these subsidies pay off in jobs and revenue elsewhere, but independent reviewers question this, saying such conclusions are very sensitive to initial assumptions <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120795…>. This extract from one of the linked documents caught my eye: Weta Digital executives ... considered that 10 years ago they were at the forefront of technology and that studios were forced to use them to achieve particular effects, they said that this is no longer true: “the degrees of difference in technology are almost imperceptible”. It is no longer technical capability that wins work, it is price point; they consider themselves a price taker. “If the grant were to disappear tomorrow it would call into question the business itself…the subsidy allows us to compete.” There is “no scenario” where the US studios would pay 20% more for Weta Digital than its competitors. VFX have long been a commodity; it’s actually surprising that Weta Digital has managed to last this long, compared to, say, Rhythm & Hues, which went bust shortly after winning an Oscar for “Life Of Pi” <http://www.fresnobee.com/news/nation-world/national/article128729769.html>. I guess it’s all down to those Government subsidies...

1 1

PB Tech Pleads Guilty To Extended Warranty, Advertising Shenanigans
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

PB Tech has admitted not properly informing customers of their rights over extended warranties, and also promoting a special offer on Apple watches to 100,000 people when it only had 14 in stock at that price. <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120824…>

1 1

An Open Source Resistance Takes Shape as Tech Giants Race To Map the World
by Peter Reutemann 01 Oct '18

01 Oct '18

'Shadma Shaikh, reporting for FactorDaily: Chetan Gowda, 27, was speaking to a room full of students in IIIT Hyderabad for a workshop on OpenStreetMap for beginners organized by Swecha, a non-profit organization to support free software movement last month. There were close to 40 students in the room. Beginners often ask him: Why use open source maps when we already have Google Maps? For Gowda, it was the fact that Google Maps is a global, commercial product and did not capture local detail. Like the old banyan tree that was a major landmark in his hometown Hassan or public benches just outside the town where pedestrians could stop to catch a break or fire catchment areas in Bellandur lake in Bengaluru, India. "It was fascinating to add little but important details of my town to open maps," says Gowda who was introduced in 2013 to OSM or OpenStreetMap, a global community of mappers formed as a collaborative project to create a free editable map of the world in 2004. Since then he has been an active contributor to OpenStreetMap and has conducted many workshops in colleges and institutes to induct more people in the community. Gowda has made 8500 edits in the OpenStreetMap, mainly covering areas in Bengaluru, Hassan and Hyderabad. Gowda and a few other contributors from India are part of a tiny yet growing resistance movement which doesn't want giant corporations to own all the mapping data. For the average consumer, this may not seem like a big deal. But mapping is big business. The market opportunity for suppliers of mapping to the autonomous car industry is going to be worth over $24 billion by 2050, according to one estimate [PDF]. And that's just one industry. A study commissioned by Google in 2015 estimated that industries that run on top of the Global Positioning Satellite Systems and mapping generate nearly $73 billion in annual revenue. Worldwide, that industry is was estimated to generate $150- $270 billion in revenues. Although new research isn't available, with growing smartphone usage and the birth of companies such as Uber and many others it is safe to assume that the industry has only grown bigger. All the more reason why map data can't be held by only a few companies. With Google Maps beginning to charge small and medium-sized businesses and indie developers more for access to its platform, many have started to explore and switch to open source alternatives of Maps, and commercial services such as Here Maps. ' -- source: https://news.slashdot.org/story/18/10/01/1140259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VideoLAN Announces Dav1d, a New Libre and Open Source AV1 Decoder
by Peter Reutemann 01 Oct '18

01 Oct '18

'Jean-Baptiste Kempf, president of VideoLan and developer of VLC media player, made the following announced Monday: AV1 is a new video codec by the Alliance for Open Media, composed of most of the important Web companies (Google, Facebook, Netflix, Amazon, Microsoft,...). AV1 has the potential to be up to 20% better than the HEVC codec, but the patents license is totally free, while HEVC patents licenses are insanely high and very confusing. The reference decoder for AV1 is great, but it's a research codebase, so it has a lot to improve. Therefore, the VideoLAN, VLC and FFmpeg communities have started to work on a new decoder, sponsored by the Alliance of Open Media. The goal of this new decoder is: be small, be as fast as possible, be very cross-platform, correctly threaded, libre and (actually) Open Source. Without further due, the code: https://code.videolan.org/videolan/dav1d ' -- source: https://news.slashdot.org/story/18/10/01/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Diagnosing The Orion Health Buyout Deal
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

This Herald article <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121336…> reports that healthcare software maker Orion Health is selling off its only profitable division in a bid to get more capital to plough into its remaining businesses. What I found of note was in the answer to the last question in that article, “What went wrong?”: ... the company had faced a perfect storm as many of its Obamacare customers in the US (home to half Orion's revenue) ran out of money and started to cancel orders just as the company needed to invest heavily to move its software to the cloud. It didn't help that the health software Orion bought from Microsoft (which powers its Hospitals solution) turned out to be in much worse shape than it thought ...

1 0

Ubuntu Linux 18.10 Cosmic Cuttlefish Beta Now Available For Desktop, Cloud and Server Versions
by Peter Reutemann 01 Oct '18

01 Oct '18

'Roughly three weeks ahead of the scheduled release of Ubuntu Linux 18.10 "Cosmic Cuttlefish", the latest major update for the popular Linux distro, beta of all of its flavors -- desktop, cloud and server -- is now available for download. From a report: Codenamed 'Cosmic Cuttlefish,' 18.10 continues Ubuntu's proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution. The team has been hard at work through this cycle, introducing new features and fixing bugs," says Adam Conrad, Software Engineer, Canonical. Conrad further says, "This beta release includes images from not only the Ubuntu Desktop, Server, and Cloud products, but also the Kubuntu, Lubuntu, Ubuntu Budgie, UbuntuKylin, Ubuntu MATE, Ubuntu Studio, and Xubuntu flavours. The beta images are known to be reasonably free of showstopper CD build or installer bugs, while representing a very recent snapshot of 18.10 that should be representative of the features intended to ship with the final release expected on October 18th, 2018."' -- source: https://linux.slashdot.org/story/18/09/30/1758245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tim Berners-Lee Announces Solid, an Open Source Project Which Would Aim To Decentralize the Web
by Peter Reutemann 30 Sep '18

30 Sep '18

'Tim Berners-Lee, the founder of the World Wide Web, thinks it's broken and he has a plan to fix it. The British computer scientist has announced a new project that he hopes will radically change his creation by giving people full control over their data. Tim Berners-Lee: This is why I have, over recent years, been working with a few people at MIT and elsewhere to develop Solid, an open-source project to restore the power and agency of individuals on the web. Solid changes the current model where users have to hand over personal data to digital giants in exchange for perceived value. As we've all discovered, this hasn't been in our best interests. Solid is how we evolve the web in order to restore balance -- by giving every one of us complete control over data, personal or not, in a revolutionary way. Solid is a platform, built using the existing web. It gives every user a choice about where data is stored, which specific people and groups can access select elements, and which apps you use. It allows you, your family and colleagues, to link and share data with anyone. It allows people to look at the same data with different apps at the same time. Solid unleashes incredible opportunities for creativity, problem-solving and commerce. It will empower individuals, developers and businesses with entirely new ways to conceive, build and find innovative, trusted and beneficial applications and services. I see multiple market possibilities, including Solid apps and Solid data storage. Solid is guided by the principle of "personal empowerment through data" which we believe is fundamental to the success of the next era of the web. We believe data should empower each of us. Imagine if all your current apps talked to each other, collaborating and conceiving ways to enrich and streamline your personal life and business objectives? That's the kind of innovation, intelligence and creativity Solid apps will generate. With Solid, you will have far more personal agency over data -- you decide which apps can access it. In an interview with Fast Company, he shared more on Solid and its creation: "I have been imagining this for a very long time," says Berners-Lee. He opens up his laptop and starts tapping at his keyboard. Watching the inventor of the web work at his computer feels like what it might have been like to watch Beethoven compose a symphony: It's riveting but hard to fully grasp. "We are in the Solid world now," he says, his eyes lit up with excitement. He pushes the laptop toward me so I too can see. On his screen, there is a simple-looking web page with tabs across the top: Tim's to-do list, his calendar, chats, address book. He built this app -- one of the first on Solid -- for his personal use. It is simple, spare. In fact, it's so plain that, at first glance, it's hard to see its significance. But to Berners-Lee, this is where the revolution begins. The app, using Solid's decentralized technology, allows Berners-Lee to access all of his data seamlessly -- his calendar, his music library, videos, chat, research. It's like a mashup of Google Drive, Microsoft Outlook, Slack, Spotify, and WhatsApp. The difference here is that, on Solid, all the information is under his control. Every bit of data he creates or adds on Solid exists within a Solid pod -- which is an acronym for personal online data store. These pods are what give Solid users control over their applications and information on the web. Anyone using the platform will get a Solid identity and Solid pod. This is how people, Berners-Lee says, will take back the power of the web from corporations. Starting this week, developers around the world will be able to start building their own decentralized apps with tools through the Inrupt site. Berners-Lee will spend this fall crisscrossing the globe, giving tutorials and presentations to developers about Solid and Inrupt. "What's great about having a startup versus a research group is things get done," he says. These days, instead of heading into his lab at MIT, Berners-Lee comes to the Inrupt offices, which are currently based out of Janeiro Digital, a company he has contracted to help work on Inrupt. For now, the company consists of Berners-Lee; his partner John Bruce, who built Resilient, a security platform bought by IBM; a handful of on-staff developers contracted to work on the project; and a community of volunteer coders. Later this fall, Berners-Lee plans to start looking for more venture funding and grow his team. The aim, for now, is not to make billions of dollars. The man who gave the web away for free has never been motivated by money. Still, his plans could impact billion-dollar business models that profit off of control over data. It's not likely that the big powers of the web will give up control without a fight.' -- source: https://tech.slashdot.org/story/18/09/30/1122238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2