- wlug - list.wlug.org.nz

NextGen: A Feature-Length Movie Done In Blender
by Lawrence D'Oliveiro 30 Sep '18

30 Sep '18

Some info here <https://www.youtube.com/watch?v=5TdmIpCAiKQ> about NextGen, an animated movie created by Canadian company Tangent Animation, and done almost entirely using the open-source Blender CG software. They recently sold the distribution rights for the rest of the world (outside China) to Netflix for USD30 million. There’s mention of some additional components (“Cryptomatte” and “Embree”) which are not (yet) part of the official Blender source code; I gather the plan is to merge them in at some point. The video description includes some useful links, including this one <https://www.youtube.com/watch?v=CqSEtTF8hPE> from the 2016 Blender conference, where the Tangent founders discuss why they moved away from Maya and decided to invest in Blender.

1 0

System76's Much-Anticipated Open Source 'Thelio' Linux Computer Will Be Available To Pre-Order Starting Next Month, But Shipping Date and Specs Remain Unclear
by Peter Reutemann 30 Sep '18

30 Sep '18

'Brian Fagioli, writing for BetaNews: When you buy a System76 computer today, you aren't buying a machine manufactured by the company. Instead, the company works with other makers to obtain laptops, which it then loads with a Linux-based operating system -- Ubuntu or its own Pop!_OS. There's nothing really wrong with this practice, but still, System76 wants to do better. The company is currently working to manufacture its own computers ("handcrafted") right here in the USA. By doing this, System76 controls the entire customer experience -- software, service, and hardware. This week, the company announces that the fruits of its labor -- an "open-source computer" -- will be available to pre-order in October. Now, keep in mind, this does not mean the desktop will be available next month. Hell, it may not even be sold in 2018. With that said, pre-ordering will essentially allow you to reserve your spot. To celebrate the upcoming computer, System76 is launching a clever animated video marketing campaign.' -- source: https://hardware.slashdot.org/story/18/09/30/1519240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MX Player, a Video App Used By More Than 175 Million Users, Debuts OTT Service. Android Enthusiasts Express Concern.
by Peter Reutemann 30 Sep '18

30 Sep '18

MX Player, a video app which has been downloaded more than 500 million times across the globe, kickstarted its OTT (online video streaming) service in India, one of its largest markets, this week. MX Player, which is popular worldwide, has earned a loyal user base over the years for being the app that can run any video file you throw at it, even if your smartphone, tablet, or Android TV box doesn't have high-end specs or updated software. It was acquired by Times Internet, an India-based conglomerate this June, and now the big giant is beginning to show what it intends to do with the app. From a report: [...] All of these titles, including those produced by Times Internet, are now available to MX Player users in India at no charge, Karan Bedi, CEO of MX Player, told VentureBeat in an interview. Like most of Times Internet's properties, which include several TV channels and newspapers, MX Player will count on ads to generate revenue. Betting on ad-driven business model, a popular path in developing markets, could help MX Player quickly convince its existing user base to give the streaming offerings a try as it begins to compete in the Indian market. Star India's ad-supported service Hotstar, which offers about 80 percent of its catalog to customers for free, currently leads the video streaming market in the country. Going forward, Bedi said, the company remains committed to making investments in what made MX Player so popular among customers: The ability to play a plethora of video files on low-end devices. The company won't be bringing its new streaming offerings to the paid version of the MX Player app, MX Pro, he said. Additionally, MX Player's streaming offerings are limited to India, one of its largest markets, for now, although Bedi said the company is working on the right content catalog for other regions. Over at Android sub-reddit, where this story has been discussed, dozens of users expressed their concerns on the direction MX Player appears to be headed. -- source: https://tech.slashdot.org/story/18/09/30/1543213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Finally Nearing Support For The Apple Magic Trackpad 2, Thanks To a Google Employee
by Peter Reutemann 30 Sep '18

30 Sep '18

'Michael Larabel, writing for Phoronix: Apple announced the Magic Trackpad 2 almost three years ago to the day while the mainline Linux kernel will finally be supporting this multi-touch device soon. The Magic Trackpad 2 is a wired/wireless touchpad with haptic feedback support and is a much larger touchpad compared to the original Magic Trackpad. There unfortunately hasn't been any mainline Linux kernel support for the Magic Trackpad 2, but some out-of-tree options. [...] However, as seen by this bug report there have been plenty of people since 2015 interested in using the Magic Trackpad 2 on Linux. Fortunately, Sean O'Brien of Google's Chrome OS team has been working on Magic Trackpad 2 support with a focus on getting it mainlined. The patch, which was also reviewed by other Google/ChromeOS developers, is now up to its third and perhaps final revision.' -- source: https://linux.slashdot.org/story/18/09/30/1722239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Says Linux Code Contributions Can't Be Rescinded
by Peter Reutemann 30 Sep '18

30 Sep '18

'Linux developers who contribute code to the kernel cannot rescind those contributions, according to the software programmer who devised the GNU General Public Licence version 2.0, the licence under which the kernel is released. Richard Stallman, the head of the Free Software Foundation and founder of the GNU Project, told iTWire in response to queries that contributors to a GPLv2-covered program could not ask for their code to be removed. "That's because they are bound by the GPLv2 themselves. I checked this with a lawyer," said Stallman, who started the free software movement in 1984. There have been claims made by many people, including journalists, that if any kernel developers are penalised under the new code of conduct for the kernel project -- which was put in place when Linux creator Linus Torvalds decided to take a break to fix his behavioural issues -- then they would ask for their code to be removed from the kernel... Stallman asked: "But what if they could? What would they achieve by doing so? They would cause harm to the whole free software community. The anonymous person who suggests that Linux contributors do this is urging them to [use a] set of nuclear weapons in pique over an internal matter of the development team for Linux. What a shame that would be." Slashdot reader dmoberhaus shared an article from Motherboard with more perspetives from Eric S. Raymond and LWN.net founder Jonathan Corbet, which also traces the origins of the suggestion. "[A]n anonymous user going by the handle 'unconditionedwitness' called for developers who end up getting banned through the Code of Conduct in the future to rescind their contributions to the Linux kernel 'in a bloc' to produce the greatest effect. "It is worth noting that the email address for unconditionedwitness pointed to redchan.it, a now defunct message board on 8chan that mostly hosted misogynistic memes, many of which were associated with gamergate."' -- source: https://news.slashdot.org/story/18/09/29/055210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Now Dominates Azure
by Peter Reutemann 28 Sep '18

28 Sep '18

'Three years ago, Mark Russinovich, CTO of Azure, Microsoft's cloud program, said, "One in four [Azure] instances are Linux." Then, in 2017, it was 40 percent Azure virtual machines (VM) were Linux. Today, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, said in an interview, "Slightly over half of Azure VMs are Linux. That's right. Microsoft's prize cloud, Linux, not Windows Server, is now the most popular operating system. Windows Server isn't going to be making a come back. Every month, Linux goes up," Guthrie said. And it's not just Azure users who are turning to Linux. "Native Azure services are often running on Linux," Guthrie added. "Microsoft is building more of these services. For example, Azure's Software Defined Network (SDN) is based on Linux." It's not just on Azure that Microsoft is embracing Linux. "Look at our simultaneous release of SQL Server on Linux. All of our projects now run on Linux," Guthrie said.' -- source: https://linux.slashdot.org/story/18/09/27/209211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Secretly Logs Users Into Chrome Whenever They Log Into a Google Site
by Peter Reutemann 27 Sep '18

27 Sep '18

'Catalin Cimpanu, writing for ZDNet: Starting with Chrome 69, whenever a Chrome user would access a Google-owned site, the browser would take that user's Google identity and log the user into the Chrome in-browser account system -- also known as Sync. This system, Sync, allows users to log in with their Google accounts inside Chrome and optionally upload and synchronize local browser data (history, passwords, bookmarks, and other) to Google's servers. Sync has been present in Chrome for years, but until now, the system worked independently from the logged-in state of Google accounts. This allowed users to surf the web while logged into a Google account but not upload any Chrome browsing data to Google's servers, data that may be tied to their accounts. Now, with the revelations of this new auto-login mechanism, a large number of users are angry that this sneaky modification would allow Google to link that person's traffic to a specific browser and device with a higher degree of accuracy. That criticism proved to be wrong, as Google engineers have clarified on Twitter that this auto-login operation does not start the process of synchronizing local data to Google's servers, which will require a user click. Furthermore, they also revealed that the reason why this mechanism was added was for privacy reasons in the first place. Chrome engineers said the auto-login mechanism was added in the browser because of shared computers/browsers. Well-respected cryptographer Matthew Green was disappointed by the move. In a post, he wrote: [...] In the rest of this post, I'm going to talk about why this matters. From my perspective, this comes down to basically four points: 1. Nobody on the Chrome development team can provide a clear rationale for why this change was necessary, and the explanations they've given don't make any sense. 2. This change has enormous implications for user privacy and trust, and Google seems unable to grapple with this. 3. The change makes a hash out of Google's own privacy policies for Chrome. 4. Google needs to stop treating customer trust like it's a renewable resource, because they're screwing up badly.' -- source: https://tech.slashdot.org/story/18/09/24/1351251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate
by Peter Reutemann 26 Sep '18

26 Sep '18

'A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. What the research team found was that password managers, initially developed for desktop browsers, aren't as secure as their desktop versions. The problem comes from the fact that mobile password managers have a hard time associating a user's stored website credentials with a mobile application and then creating a link between that website and an official app. [...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.' -- source: https://it.slashdot.org/story/18/09/26/1534203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi 2.0 Desktop Browser Featuring Expanded Customization, Sync Across Devices and Privacy Tools Released [Q&A With Founder]
by Peter Reutemann 26 Sep '18

26 Sep '18

'Vivaldi announced Wednesday it has released a major update to its namesake desktop web browser, remaining as one of the rare companies that is still attempting to fight Google's monopoly in the space. Major features in Vivaldi 2.0 include: - Syncing browsers across computers:Version 2.0 allows users to sync data, including bookmarks, passwords, autofill information, and history. Vivaldi uses its own servers to store the data, which is all encrypted end-to-end. - Panels: These are expandable, multi-tasking dashboards that can be opened in the sidebar. - Tab management: Additional features are included that allow for better searching through tabs, stacking them, and even renaming them. - History: Offers new ways to track your usage, including generating statistics and a visual history feature. Vivaldi was founded by Jon von Tetzchner, who also co-founded Opera and served as its chief executive for a number of years. Jon has been vocal about what many find unfair tactics employed by Google and Microsoft to aggressively expand the user bases of their respective browsers.' -- source: https://tech.slashdot.org/story/18/09/26/0713254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 29 Beta Now Available For Download With Improved Raspberry Pi Support
by Peter Reutemann 25 Sep '18

25 Sep '18

'The Fedora Project announced Tuesday the beta availability of Fedora 29 -- the latest version of the free and open-source Fedora OS. From a report: It features updated packages, improved support for Raspberry Pi, and more. "Highlighting Fedora 29 Beta is the addition of modularity across all Fedora editions. First delivered in Fedora 28 Server, modularity enables multiple versions of the same software (like Node.js) to be selected on a per-system basis, with parallel installation done through containers. This can provide some users the ability to use tried-and-true versions of software while enabling other users to work with just-released innovation without impacting the overall stability of the Fedora operating system," says Matthew Miller, Fedora Project Leader. Miller further says, "The importance of ARM to IoT has not been lost on Fedora, and Fedora 29 Beta aims to make the Fedora operating system a home for both ARM and IoT. These features start with enhanced ZRAM support for swap on ARMv7 and aarch64, which can improve the performance and reliability of Fedora 29 Beta on ARM Single Board Computers, like the Raspberry Pi. These devices are used by 'makers' and in developmental IoT solutions."' -- source: https://linux.slashdot.org/story/18/09/25/1939240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Monitor Will Inform You of Data Breaches
by Peter Reutemann 25 Sep '18

25 Sep '18

'Earlier this year, Mozilla announced Firefox Monitor, a service that will inform you if your online accounts were hacked in a recent data breach. It's now available to general public. A report adds: For the new security-focused tool, Mozilla partnered with Troy Hunt, the renowned security expert behind Have I Been Pwned? (HIBP), which is a database of data breaches that allows anyone to discover whether one of their online accounts has been compromised. The first iteration of Firefox Monitor is, for all intents and purposes, a clone of HIBP. After you enter your email address and hit the scan button, you're told which online services have leaked your personal details (if any). You can also sign up to be notified of any future data breaches involving one or more of your email addresses.' -- source: https://tech.slashdot.org/story/18/09/25/1928234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Buys and Shuts Down Intelligent Email App Astro
by Peter Reutemann 25 Sep '18

25 Sep '18

Since we discussed matrix.org at last night's meeting, this might be of interest: 'Slack has acquired email app company Astro to incorporate it into Slack channels. As a result, Astro is shutting down its Mac, iOS, Android, Alexa and Slack apps. They're no longer taking new users and existing ones will lose access on October 10th. Engadget reports: The company said that with over 50 million channels created to date, they're increasingly becoming the platform through which teams collaborate. "But we all know that email is still a very important tool in business communication," said Slack. "We've taken some steps to make it possible to integrate email into Slack, but now we're in a position to make that interoperability much simpler and much, much more powerful." Last year, Astro launched its Astrobot Slack app, which let users manage their emails and check their Office 365 or Google calendars from within Slack. It also allowed them to do one search to pull up results from both Slack and email. "As we explored with Slack how to bring together messaging, email and calendar, it became evident that we would have the biggest impact on workplace communications and realize our original vision by joining Slack," the company said. ' -- source: https://tech.slashdot.org/story/18/09/24/2051256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky TV Wants ISPs To Block Pirate Sites
by Lawrence D'Oliveiro 25 Sep '18

25 Sep '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121313…>: Sky says ISPs should introduce blocking, because other countries do it. But it doesn’t mention how effective such blocks actually are(n’t). Also, it appears 5% of NZers have discovered the usefulness of Kodi boxes. The article nicely points out one problem with trying to block some of these “pirate” sites: Sky has also taken at least a dozen cases against individuals who accessed illegal Facebook streams of Joseph Parker fights - although it only sought token costs, not damages. However, while Sky's action over illegal Parker fight streaming has been successful, it also illustrates the complications of Sky's website blocking request. It is unlikely any ISP would want to block Facebook.

1 0

topic(s) for this month's meeting?
by Peter Reutemann 23 Sep '18

23 Sep '18

Hi everyone In all that Alexa excitement at the last meeting, I completely forgot to figure out topic/speaker for this month's meeting. Anybody keen on presenting or an interesting topic to discuss? Is actually anybody running the latest 4.19 kernel and noticed significant performance drops (thanks to specter/meltdown)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

Cloudflare Promotes The InterPlanetary File System
by Lawrence D'Oliveiro 19 Sep '18

19 Sep '18

Content-distribution company Cloudflare is trying to encourage use of the InterPlanetary File System (IPFS) as a way to do distributed hosting of static content <https://blog.cloudflare.com/distributed-web-gateway/>. Instead of using host-specific URLs to find what you want, you specify hashes for the items, and it finds them wherever they are, across all the available IPFS nodes. What Cloudflare is doing is offering an IPFS “gateway”, which means you put the hash into a URL pointing at a Cloudflare server to specify the item. That way you don’t have to set up an IPFS node yourself. Found from this news item <https://www.theregister.co.uk/2018/09/18/cloudflare_backs_interplanetary_fi…>.

1 0

Ampere’s ARM Server Shipping At Last
by Lawrence D'Oliveiro 18 Sep '18

18 Sep '18

A 32-core, 64-bit ARMv8 machine running at up to 3.3GHz in turbo mode is apparently now available <https://www.theregister.co.uk/2018/09/18/ampere_shipping/>. 125W sounds a pretty modest draw for such a grunty machine. And only a 3-figure price tag, too (OK, maybe 4 figures in NZD).

1 0

A Property Owner Can Be Forced To Trim Trees That Block Wi-Fi
by Lawrence D'Oliveiro 18 Sep '18

18 Sep '18

A recent High Court judgement <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121272…> has ruled that a neighbour can force you to trim the trees on your property if they block their wireless Internet access. The article notes that this was more of an issue with the 2.6GHz frequency being used for this connection than it might have been for the 700MHz band employed by other providers.

1 0

Amazon Plans To Release At Least 8 New Alexa-Powered Devices, Including A Microwave, Amplifier, and In-Car Gadget
by Peter Reutemann 18 Sep '18

18 Sep '18

'Amazon is planning to release at least 8 new voice-controlled hardware devices before the end of the year, according to CNBC. "The devices include, among others, a microwave oven, an amplifier, a receiver, a subwoofer, and an in-car gadget, people familiar with the matter said," reports CNBC. "All of the devices will be Alexa-enabled, meaning they can easily connect to the voice assistant. Some of the devices will also have Alexa built in." From the report: Amazon is expected to reveal some of these devices at an event later this month, according to an internal document describing the plans. The new devices reflect Amazon's ambition to make its Alexa voice technology ubiquitous by focusing on areas where people spend most of their time -- at home and in the car. Alexa was initially considered a geeky experiment at Amazon. Now it is now one of the most popular voice assistants, leading the growth of the burgeoning smart speaker market, which is expected to be worth $30 billion by 2024, according to Global Market Insights. ' -- source: https://tech.slashdot.org/story/18/09/17/2149214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerability in WebKit Crashes and Restarts iPhones and iPads
by Peter Reutemann 16 Sep '18

16 Sep '18

'Catalin Cimpanu, writing for ZDNet: A security researcher has discovered a vulnerability in the WebKit rendering engine used by Safari that crashes and restarts the iOS devices -- iPhones and iPads. The vulnerability can be exploited by loading an HTML page that uses specially crafted CSS code. The CSS code isn't very complex and tries to apply a CSS effect known as backdrop-filter to a series of nested page segments (DIVs). Backdrop-filter is a relative new CSS property and works by blurring or color shifting to the area behind an element. This is a heavy processing task, and some software engineers and web developers have speculated that the rendering of this effect takes a toll on iOS' graphics processing library, eventually leading to a crash of the mobile OS altogether. ' -- source: https://apple.slashdot.org/story/18/09/16/239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Kernel Has Grown By 225, 000 Lines of Code This Year, With Contributions From About 3, 300 Developers
by Peter Reutemann 16 Sep '18

16 Sep '18

'Here's an analysis of the Linux kernel repository that attempts to find some fresh numbers on the current kernel development trends. He writes: The kernel repository is at 782,487 commits in total from around 19.009 different authors. The repository is made up of 61,725 files and from there around 25,584,633 lines -- keep in mind there is also documentation, Kconfig build files, various helpers/utilities, etc. So far this year there has been 49,647 commits that added 2,229,836 lines of code while dropping 2,004,759 lines of code. Or a net gain of just 225,077 lines. Keep in mind there was the removal of some old CPU architectures and other code removed in kernels this year so while a lot of new functionality was added, thanks to some cleaning, the kernel didn't bloat up as much as one might have otherwise expected. In 2017 there were 80,603 commits with 3,911,061 additions and 1,385,507 deletions. Given just over one quarter to go, on a commit and line count 2018 might come in lower than the two previous years. Linus Torvalds remains the most frequent committer at just over 3% while the other top contributions to the kernel this year are the usual suspects: David S. Miller, Arnd Bergmann, Colin Ian King, Chris Wilson, and Christoph Hellwig. So far in 2018 there were commits from 3,320 different email addresses. This is actually significantly lower than in previous years.' -- source: https://linux.slashdot.org/story/18/09/16/172217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Elive Emerges Alive After 8-Year Hibernation
by Peter Reutemann 11 Sep '18

11 Sep '18

'Designed to run on minimal hardware, Elive is very much a passion project of its leader, Samuel F Baggen. Based on Debian, the first version took a bow in 2005. The second stable version made an appearance in 2010 and it has been a long eight years for the third stable version to become available. The Register: Elive has an impressively low bar to entry, with hardware requirements for the distribution coming in at 256 MB RAM and a 500 MHz CPU, meaning that some very elderly silicon is theoretically going to be able to enjoy the highly polished Enlightenment desktop. "Theoretically" because after The Register took Elive 3.0.0 out for a spin on a relatively low-powered laptop, we'd frankly baulk at running it on anything much slower than a 533MHz Core 2 with at least 512 MB RAM. However, the Enlightenment UI is undeniably an attractive desktop, particularly if a macOS-alike dock is your thing, and runs at an impressive lick even on hardware that lacks graphics acceleration. At its core, Elive is based on the Debian 8 distribution (aka Jessie), using the 3.16 kernel and version 0.17.6 of the Enlightenment X11 Window Manager. It comes replete with a full set of applications, including the ubiquitous LibreOffice and Gimp, along with a variety of productivity and entertainment tools, some of which are Elive's own. Unlike the previous version of Elive, 3.0.0 removes the requirement of donating to the project in order to install the thing locally (although Baggen was quick to tell The Reg that cost-free alternatives existed, but often with annoying processes).' -- source: https://linux.slashdot.org/story/18/09/11/1121223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploit Vendor Drops Tor Browser Zero-Day on Twitter
by Peter Reutemann 11 Sep '18

11 Sep '18

'Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. The vulnerability is a bypass of the NoScript extension that's included by default with all Tor Browser distributions. Once bypassed, an attacker can run malicious code inside the Tor Browser, code that under certain circumstances would have been stopped by NoScript. "This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.' -- source: https://tech.slashdot.org/story/18/09/10/216238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Working On Google Translate Integration In Firefox
by Peter Reutemann 10 Sep '18

10 Sep '18

' Back in 2014, Mozilla partnered with Bing to translate webpages via Firefox in a similar fashion to Chrome's implementation of Google Translate. The company also added support for Yandex Translate in Firefox 41 in mid-2015, but it went all dark soon after and very few updates were issued. Now, Mozilla is finally starting to add support for Google Translate to the translation engine built into Firefox. gHacks reports: While the feature is not fully functional yet, it is an indicator that Mozilla has not forgotten the translate feature completely. Users who enable the translate functionality in Firefox on about:config will notice that Google is the selected translation engine. Google Translate cannot be used currently in Firefox; the browser throws an error message when you hit the translate button in the UI. Bing and Yandex don't seem to work either at this point in time even though Firefox seems to try and translate the page. The "there has been an error translating this page" error is thrown eventually as well. Google Translate requires API access keys and that is usually only available if companies or users pay for the key. It is unclear if Mozilla plans to make a deal with Google or if users will be required to use their own API keys for the functionality. The latter would surely be very limiting. ' -- source: https://tech.slashdot.org/story/18/09/10/0238218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Worries Arise About Security of New WebAuthn Protocol
by Peter Reutemann 10 Sep '18

10 Sep '18

'"A team of security researchers has raised the alarm about some cryptography-related issues with the newly released WebAuthn passwordless authentication protocol," reports ZDNet. "The new WebAuthn protocol will allow users of a device -- such as a computer or a smartphone -- to authenticate on a website using a USB security key, a biometric solution, or his computer or smartphone's password." But researchers say that because WebAuthn uses weak algorithms for the operations of registering a new device, they can pull off some attacks against it. "If converted into a practical exploit, the ECDAA attacks discussed in the article would allow attackers to steal the key from a [server's] TPM, which would allow attackers to effectively clone the user's hardware security token remotely," Arciszewski, one of the researchers, told ZDNet. "The scenarios that follow depend on how much trust was placed into the hardware security token," he added. "At minimum, I imagine it would enable 2FA bypasses and re-enable phishing attacks. However, if companies elected to use hardware security tokens to obviate passwords, it would allow direct user impersonation by attackers." Attacks aren't practical, and experts say the root cause relies in badly written documentation that may fool some implementers into supporting the old algorithms instead of newer and more solid ones. The FIDO Alliance was notified and has started work on updating its docs so it won't look like it's recommending ECDAA or RSASSA-PKCS1-v1_5. "PKCS1v1.5 is bad. The exploits are almost old enough to legally drink alcohol in the United States," Arciszewski said.' -- source: https://it.slashdot.org/story/18/09/10/0227233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPNs Contained Code Execution Security Flaws, Despite Patches
by Peter Reutemann 10 Sep '18

10 Sep '18

'Researchers have uncovered vulnerabilities in popular virtual private network (VPN) software, ProtonVPN and NordVPN, which can lead to the execution of arbitrary code by attackers. From a report: Last week, Cisco Talos security researchers said the security flaws, CVE-2018-3952 and CVE-2018-4010, permit code execution by attackers on Microsoft Windows machines. The vulnerabilities are similar to a Windows privilege escalation security flaw uncovered by VerSprite, which is tracked as CVE-2018-10169. Security patches were applied in April by both clients to resolve the original security hole, but according to Talos, "despite the fix, it is still possible to execute code as an administrator on the system." The initial vulnerability was caused by similar design issues in both clients. The interface for both NordVPN and ProtonVPN execute binaries with the permission of a logged-in user, and this includes the selection of a VPN configuration option, such as a desired VPN server location. This information is sent to a service when "connect" is clicked by way of an OpenVPN configuration file. However, VerSprite was able to create a crafted OpenVPN file which could be sent to the service, loaded, and executed.' -- source: https://yro.slashdot.org/story/18/09/10/118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0