- wlug - list.wlug.org.nz

Nearly Half of American Households Will Own a Smart Speaker by 2019, Study Says
by Peter Reutemann 10 Sep '18

10 Sep '18

'Almost half of American households will have a smart speaker by next year, according to a new study from Adobe. From a report: The study, released Monday, finds that 32% of the country already owns a smart speaker and another 16% plan on getting one this holiday season. And just as importantly, people are using those speakers. "Technology trends come and go, but we think voice is here to stay," said Colin Morris, director of product management for Adobe Analytics, in a statement. "Consumers continue to embrace voice as a means to engage their devices and the Internet. It's a trend that has fundamentally changed the face of computing." A notable indicator of the growing popularity of the speakers is how comfortable people are talking to the device in front of others. And that number is on the rise: 72% of smart speaker owners say they use voice assistants in front of others. (Only 29% of people without a smart speaker are comfortable with doing so.)' -- source: https://tech.slashdot.org/story/18/09/10/1833235 I thought, that this would be of interest, due to our Alexa topic last month. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

9 Useful Examples of Touch Command in Linux
by Peter Reutemann 10 Sep '18

10 Sep '18

'Touch command in Linux is used for changing file timestamps however one of the most common usages of touch command includes creating a new empty file. With the touch command, you can change access, modify and change time of files and folders in Linux. You can update the timestamps or modify them to a date in the past.' -- source: https://linuxhandbook.com/touch-command/ To be honest, I only ever use it to create an empty file... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Hollywood goes open source
by Peter Reutemann 10 Sep '18

10 Sep '18

'Out of 200 of the most popular movies of all time, the top 137 were either visual-effects driven or animated. What did many of these blockbusters have in common? They were made with open-source software. That was the message David Morin, chairman of the Joint Technology Committee on Virtual Production, brought to The Linux Foundation's Open Source Summit in Vancouver, Canada. To help movie makers bring rhyme and reason to open-source film-making, The Linux Foundation had joined forces with The Academy of Motion Picture Arts and Sciences to form the Academy Software Foundation. The academy is meant to be a neutral forum for open-source developers both in the motion picture and broader media industries to share resources and collaborate on technologies for image creation, visual effects, animation, and sound. The founding members include Blue Sky Studios, Cisco, DreamWorks Animation, Epic Games, Google Cloud, Intel, Walt Disney Studios, and Weta Digital. It's a true marriage of technology and media-driven businesses.' -- source: https://www.zdnet.com/article/hollywood-goes-open-source/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Beta Release Nears For BeOS-inspired Open Source OS Haiku
by Peter Reutemann 09 Sep '18

09 Sep '18

'Just over 17 years since the project launched, and more than 18 years since the last release of the operating system that inspired it, the open source Haiku OS is nearing a beta release.' -- source: https://tech.slashdot.org/story/18/09/08/2032253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Despite 'Painful' Spectre Response, Linus Torvalds Says He Still Loves Speculative Execution
by Peter Reutemann 09 Sep '18

09 Sep '18

'At this year's Open Source Summit, Linus Torvalds sat for a wide-ranging "keynote" interview with Dirk Hohndel, chief open source officer at VMWare, which has been partially transcribed below. And Linus explained, among other things, why the last merge window was harder than others: One of the issues we have is when we've had these hardware security issues, and they've kept happening now, the last year -- they're kept under wraps. So we knew about the issue for the last several months, but because it was secret and we weren't allowed to talk about it, we couldn't do our usual open development model. We do the best we can, and people really care deeply about getting a good product out, but when you have to do things in secret, and when you can't use all the nice infrastructure for development and for testing that we have for all the usual code, it just is way more painful than it should be. And then that just means that, especially when the information becomes public during what is otherwise a busy period anyway, it's just annoying... I still love speculative execution. Don't get me wrong. I used to work for a CPU company. We did it in software, back when I worked there. I think a CPU has to do speculative execution. It's somewhat sad that then people didn't always think about or didn't always heed the warnings about what can go wrong when you take a few shortcuts in the name of making it slightly simpler for everybody, because you're going to throw away all that work anyway, so why bother to do it right. And that's when the security -- every single security problem we've had has been basically of that kind, where people knew that "Hey, this is speculative work. If something goes wrong we'll throw all the data away, so we don't need to be as careful as we would otherwise." I think it was a good lesson for the industry, but it was certainly not a fun lesson for us on the OS side, where we had to do a lot of extra work for problems that weren't our problems. It feels somehow unfair. I mean, when we have a security bug that was our own fault, it's like, "Okay, it was us screwing up. It's fair that we have to do all the work to then fix our own bugs." But it feels slightly less fair when you have to fix somebody else's... "The good news -- I mean the really good news, and I'm serious about this -- is that the bugs have become clearly more and more esoteric," Linus adds. "So it impacts fewer and fewer cases, and clearly hardware people at Intel and other places are now so aware of it that I'm hoping we're really getting to the dregs of the hardware security bugs, and going forward we'll have much fewer of them. I think we're going to the better days, when A.) we got the bugs fixed, and B.) people were thinking about them beforehand."' -- source: https://linux.slashdot.org/story/18/09/09/0048248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Booting Debian Jessie On An SGI UV-1000 Supercomputer
by Lawrence D'Oliveiro 07 Sep '18

07 Sep '18

Just one of several YouTube vids showing a supercomputer run a stock-standard Linux kernel <https://www.youtube.com/watch?v=v8hKjPh5SVo>. Note the part where it says “System RAM: 2096630MB”.

1 0

Tor Browser Gets a Redesign, Switches To New Firefox Quantum Engine
by Peter Reutemann 06 Sep '18

06 Sep '18

'The Tor Browser has rolled out a new interface with the release of v8. From a report: The Tor Browser has always been based on the Firefox codebase, but it lagged behind a few releases. Mozilla rolled out a major overhaul of the Firefox codebase in November 2017, with the release of Firefox 57, the first release in the Firefox Quantum series. Firefox Quantum came with a new page rendering engine, a new add-ons API, and a new user interface called the Photon UI. Because these were major, code-breaking changes, it took the smaller Tor team some time to integrate all of them into the Tor Browser codebase and make sure everything worked as intended. The new Tor Browser 8, released yesterday, is now in sync with the most recent version of Firefox, the Quantum release, and also supports all of its features. This means the Tor Browser now uses the same modern Photon UI that current Firefox versions use, it supports the same speed-optimized page rendering engine and has also dropped support for the old XUL-based add-ons system for the new WebExtensions API system used by Chrome, Opera, Vivaldi, Brave, and the rest of the Chromium browsers.' -- source: https://yro.slashdot.org/story/18/09/06/1651255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

400, 000 Websites Vulnerable Through Exposed .git Directories
by Peter Reutemann 06 Sep '18

06 Sep '18

'Open .git directories are a bigger cybersecurity problem than many might imagine, at least according to a Czech security researcher who discovered almost 400,000 web pages with an open .git directory possibly exposing a wide variety of data. From a report: Vladimir Smitka began his .git directory odyssey in July when he began looking at Czech websites to find how many were improperly configured and allow access to their .git folders within the file versions repository. Open .git directories are a particularly dangerous issue, he said, because they can contain a great deal of sensitive information. "Information about the website's structure, and sometimes you can get very sensitive data such as database passwords, API keys, development IDE settings, and so on. However, this data shouldn't be stored in the repository, but in previous scans of various security issues, I have found many developers that do not follow these best practices," Smitka wrote. Smitka queried 230 million websites to discover the 390,000 allowing access to their .git directories. The vast majority of the websites with open directories had a .com TLD with .net, .de, .org and uk comprising most of the others.' -- source: https://tech.slashdot.org/story/18/09/06/1954253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Shutter screenshotting application - no edit button
by Peter Reutemann 06 Sep '18

06 Sep '18

Hi everyone In case you're a Shutter user for capturing screenshots, you may have noticed that the "Edit" button in the main window is disabled. Apparently, shutter hasn't been updated for a while and it is missing some older libraries, like on my Linux Mint 18. However, this is easily fixed: https://itsfoss.com/shutter-edit-button-disabled/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 62 Arrives With Variable Fonts, Automatic Dark Theme on macOS, and Better Scrolling on Android
by Peter Reutemann 05 Sep '18

05 Sep '18

'Mozilla today released Firefox 62 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 62 brings variable fonts, automatic dark theme on macOS, and better scrolling on Android. Firefox 62 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play. The latest iOS version is available on Apple's App Store.' -- source: https://news.slashdot.org/story/18/09/05/1423259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Official Chrome Extension of Cloud Storage Service Mega Caught Stealing Passwords, Cryptocurrency Private Keys
by Peter Reutemann 05 Sep '18

05 Sep '18

'The official Chrome extension for the MEGA.nz file sharing service has been compromised with malicious code that steals usernames and passwords, but also private keys for cryptocurrency accounts, ZDNet reports. From the report: The malicious behavior was found in the source code of the MEGA.nz Chrome extension version 3.39.4, released as an update earlier today. Google engineers have already intervened and removed the extension from the official Chrome Web Store, and also disabled the extension for existing users. According to an analysis of the extension's source, the malicious code triggered on sites such as Amazon, Google, Microsoft, GitHub, the MyEtherWallet and MyMonero web wallet services, and the IDEX cryptocurrency trading platform. The malicious code would record usernames, passwords, and other session data that attackers would need to log in and impersonate users. If the website managed cryptocurrency, the attacker would also extract the private keys needed to access users' funds.' -- source: https://it.slashdot.org/story/18/09/05/1841240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records
by Peter Reutemann 05 Sep '18

05 Sep '18

'mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware. Krebs On Security reports: Less than a week ago, security researcher Nitish Shah directed KrebsOnSecurity to an open database on the Web that allowed anyone to query up-to-the-minute mSpy records for both customer transactions at mSpy's site and for mobile phone data collected by mSpy's software. The database required no authentication. Before it was taken offline sometime in the past 12 hours, the database contained millions of records, including the username, password and private encryption key of each mSpy customer who logged in to the mSpy site or purchased an mSpy license over the past six months. The private key would allow anyone to track and view details of a mobile device running the software, Shah said. In addition, the database included the Apple iCloud username and authentication token of mobile devices running mSpy, and what appear to be references to iCloud backup files. Anyone who stumbled upon this database also would have been able to browse the Whatsapp and Facebook messages uploaded from mobile devices equipped with mSpy. Other records exposed included the transaction details of all mSpy licenses purchased over the last six months, including customer name, email address, mailing address and amount paid. Also in the data set were mSpy user logs -- including the browser and Internet address information of people visiting the mSpy Web site. ' -- source: https://yro.slashdot.org/story/18/09/04/2236213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 69 Arrives With Revamped Design, More Powerful Omnibox, and Better Password Manager
by Peter Reutemann 04 Sep '18

04 Sep '18

'Google today launched Chrome 69 for Windows, Mac, and Linux, Android, and iOS, just a few days after the browser's 10-year anniversary. The release includes a new design, more powerful omnibox, updated password manager, more accurate autofill, plenty of developer-specific changes, and a slew of security improvements. You can update to the latest version now using Chrome's built-in updater, download it directly from google.com/chrome, or grab it from Google Play and Apple's App Store.' -- source: https://tech.slashdot.org/story/18/09/04/1711250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MikroTik Routers Are Forwarding Owners' Traffic To Unknown Attackers
by Peter Reutemann 04 Sep '18

04 Sep '18

'Attackers have been exploiting vulnerabilities in MikroTik routers to forward network traffic to a handful of IP addresses under their control. "The bug is in Winbox management component and allows a remote attacker to bypass authentication and read arbitrary files," reports Bleeping Computer. "Exploit code is freely available from at least three sources from at least three sources." From the report: 360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses. According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations. "37.1.207.114 is the top player among all the attackers. A significant number of devices have their traffic going to this destination," Qihoo experts inform. The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs. ' -- source: https://it.slashdot.org/story/18/09/04/2116202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Do Spectre/Meltdown Fixes Affect The Linux Kernel?
by Peter Reutemann 01 Sep '18

01 Sep '18

'"Using the newly minted Linux 4.19 feature code, fresh benchmarks were carried out looking at the performance cost of Spectre/Meltdown/Foreshadow mitigations on Intel Xeon v. AMD EPYC CPUs," writes an anonymous Slashdot reader: Workloads affected by these CPU vulnerabilities mainly deal with I/O and frequent kernel calls while CPU bound tests are still found to be minimally impacted. When toggling these mitigations on Linux 4.19, Intel Xeon CPUs were found to be 10~15% slower with the default kernel while AMD EPYC CPUs dropped to about 5% slower.' -- source: https://linux.slashdot.org/story/18/09/01/1727238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Blocked Collaboration On Spectre/Meltdown Fixes, Says Linux Kernel Developer
by Peter Reutemann 01 Sep '18

01 Sep '18

'This week in Vancouver, Linux kernel developer Greg Kroah-Hartman criticized Intel's slow initial response to the Spectre and Meltdown bugs in a talk at the Open Source Summit North America. An anonymous reader quotes eWeek: Kroah-Hartman said that when Intel finally decided to tell Linux developers, the disclosure was siloed.... "Intel siloed SUSE, they siloed Red Hat, they siloed Canonical. They never told Oracle, and they wouldn't let us talk to each other." For an initial set of vulnerabilities, Kroah-Hartman said the different Linux vendors typically work together. However, in this case they ended up working on their own, and each came up with different solutions. "It really wasn't working, and a number of us kernel developers yelled at [Intel] and pleaded, and we finally got them to allow us to talk to each other the last week of December [2017]," he said. "All of our Christmas vacations were ruined. This was not good. Intel really messed up on this," Kroah-Hartman said... "The majority of the world runs Debian or they run their own kernel," Kroah-Hartman said. "Debian was not allowed to be part of the disclosure, so the majority of the world was caught with their pants down, and that's not good." To Intel's credit, Kroah-Hartman said that after Linux kernel developers complained loudly to the company in December 2017 and into January 2018, it fixed its disclosure process for future Meltdown- and Spectre-related vulnerabilities... "Intel has gotten better at this," he said. An interesting side effect of the Meltdown and Spectre vulnerabilities is that Linux and Windows developers are now working together, since both operating systems face similar risks from the CPU vulnerabilities. "Windows and Linux kernel developers now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," Kroah-Hartman said. "We are working well together. We have always wanted that."' -- source: https://it.slashdot.org/story/18/09/01/1736228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Bug Allows Geolocation Tracking of Users
by Peter Reutemann 30 Aug '18

30 Aug '18

'Researchers have discovered a weakness in all version of Android except 9, the most recent release, that can allow an attacker to gather sensitive information such as the MAC address and BSSID name and pinpoint the location of an affected device. The vulnerability is a result of the way that Android broadcasts device information to apps installed on a device. The operating system uses a mechanism known as an intent to send out information between processes or applications, and some of the information about the device's WiFi network interface sent via a pair of intents can be used by an attacker to track a device closely. A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.' -- source: https://yro.slashdot.org/story/18/08/30/1725225 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Dropbox Dropping Linux Support Says
by Peter Reutemann 29 Aug '18

29 Aug '18

'Jack Wallen, writing for TechRepublic: For a company to support Linux, they have to consider supporting: Multiple file systems, multiple distributions, multiple desktops, multiple init systems, multiple kernels. If you're an open source developer, focusing on a single distribution, that's not a problem. If you're a company that produces a product (and you stake your living on that product), those multiple points of entry do become a problem. Let's consider Adobe (and Photoshop). If Adobe wanted to port their industry-leading product to Linux, how do they do that? Do they spend the time developing support for ext4, btrfs, Ubuntu, Fedora, GNOME, Mate, KDE, systemd? You see how that might look from the eyes of any given company? It becomes even more complicated when companies consider how accustomed to the idea of "free" (as in beer) Linux users are. Although I am very willing to pay for software on Linux, it's a rare occasion that I do (mostly because I haven't found a piece of must-have software that has an associated cost). Few companies will support the Linux desktop when the act of supporting means putting that much time and effort into a product that a large cross-section of users might wind up unwilling to pay the price of admission. That's not to say every Linux user is unwilling to shell out the cost for a piece of software. But many won't.' -- source: https://linux.slashdot.org/story/18/08/29/0949228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Linux Foundation Is Changing The Fabric Of Networking
by Peter Reutemann 29 Aug '18

29 Aug '18

'Will Townsend, a senior analyst at Moor Insights & Strategy research firm, writes: As it relates to networking, the Linux Foundation is currently focused on a number of projects that are bringing top networking vendors, operators, service providers, and users together. Among the top initiatives are the Open Network Automation Platform (ONAP) and Data Plane Development Kit (DPDK). In this article, I would like to dive into both of these initiatives and share my perspective on how each is transforming the nature of networking [Editor's note: the website may have auto-playing videos; an alternative link was not available]. It makes sense that ONAP's releases are named after global cities, considering the platform's growing global footprint. ONAP is aimed at bringing real-time automation and orchestration to both physical and virtualized network functions. The first release in the fall of 2017, named Amsterdam, delivered a unified architecture for providing closed-loop networking automation. The underlying framework ensured a level of modularity to facilitate future functionality as well as standards harmonization and critical upstream partner collaboration. Initial use cases centered on Voice Over LTE (VoLTE) services as well as Virtualized Consumer Premise Equipment (vCPE). Both are extremely cost disruptive from a deployment and management perspective and deliver enhanced service provider agility. What I find extremely compelling is that Amsterdam was only an eight-month development cycle from start to release. That's an amazing feat even in the fast-paced technology industry. [...] DPDK was an effort initially led by Intel at its inception nearly eight years ago, but became a part of the Linux Foundation back in 2017. At a high level, the technology accelerates packet processing workloads running on a variety of CPU architectures. DPDK is aimed at improving overall network performance, delivering enhanced encryption for improved security and optimizing lower latency applications that require lightning-fast response time. The transformative power of 5G networks lies in their potential to deliver low latency for applications such as augmented/virtual reality and self-driving cars -- DPDK will further extend that performance for next-generation wireless wide area networks. I had the opportunity recently to speak to project chair Jim St. Leger after the fifth DPDK release, and I was impressed with the depth and breadth of the open source project. Over 25 companies and 160 technologists are involved in advancing the effort. With the proliferation of data, cord cutting at home, and growing consumption of video over wired and wireless networks, high-quality compression techniques will dramatically improve performance and reliability. DPDK appears to be poised to contribute significantly to that effort.' -- source: https://linux.slashdot.org/story/18/08/29/1646231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard VPN review: A new type of VPN offers serious advantages
by Peter Reutemann 29 Aug '18

29 Aug '18

'WireGuard is a new type of VPN that aims to be simpler to set up and maintain than current VPNs and to offer a higher degree of security. The software is free and open source—it's licensed GPLv2, the same license as the Linux kernel—which is always a big plus in my book. It's also designed to be easily portable between operating systems. All of that might lead you to ask: in a world that already has IPSEC, PPTP, L2TP, OpenVPN, and a bewildering array of proprietary SSL VPNs, do we need yet another type of VPN?' -- source: https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connectio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Apple and Microsoft Are Contributing To OpenStreetMap
by Peter Reutemann 28 Aug '18

28 Aug '18

'At the recently concluded State of the Map conference in Milan, teams from Microsoft, Apple and Facebook presented their projects, describing how they are working with communities. From a report: The Microsoft Open Maps team has recently released open data on building footprints in the US. Microsoft was among the first to release satellite imagery for use by OpenStreetMap and the images are now integrated into the default editor. It also has a community of mappers directly contributing to OpenStreetMap in Australia. Apple has an internal volunteer programme that has around 5,000 staff contributing to Missing Maps, they've released building data for France and Denmark, and are engaged with data improvement projects around the world. Facebook is exploring how artificial intelligence-assisted tracing can help to improve the quality of OpenStreetMap data in Thailand. DigitalGlobe has made its satellite imagery available under a licence that will allow it to be used by the OpenStreetMap community to improve their mapping efforts. Telenav launched OpenStreetCam to help collect openly-licensed street imagery and has now released open data and code to explore how machine learning can enable the images to be used to improve OpenStreetMap with stop signs and turn directions.' -- source: https://news.slashdot.org/story/18/08/27/2258229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi's PoE HAT Ships For $20, Tosses in a Free Fan
by Peter Reutemann 27 Aug '18

27 Aug '18

'Raspberry Pi is offering a Power-over-Ethernet HAT board for the RPi 3 Model B+ for $20 that ships with a small fan. Per blog LinuxGizmo, the "802.3af-compliant 'Raspberry Pi PoE HAT' allows delivery of up to 15W over the RPi 3 B+'s USB-based GbE port without reducing the port's up to 300Mbps bandwidth." From the report: The Raspberry Pi PoE HAT features a fully isolated switched-mode power supply with 37-57V DC, Class 2 input and 5V/2.5A DC output. The HAT connects to both the 40-pin header and a new PoE-specific 4-pin header introduced with the B+ located near the USB ports. To enable PoE, you need power sourcing equipment, which is either "provided by your network switch or with power injectors on an Ethernet cable," writes the foundation in a blog post.' -- source: https://hardware.slashdot.org/story/18/08/27/1916207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu and CentOS Are Undoing a GNOME Security Feature
by Peter Reutemann 27 Aug '18

27 Aug '18

'Current versions of Ubuntu and CentOS are disabling a security feature that was added to the GNOME desktop environment last year. The feature's name is Bubblewrap, which is a sandbox environment that the GNOME Project added to secure GNOME's thumbnail parsers in July 2017, with the release of GNOME 3.26. In recent years, security researchers have proven that thumbnail parses can be an attack vector [1, 2, 3]. Ubuntu Security Tech Lead Alex Murray said the Ubuntu team chose to disable Bubblewrap inside Ubuntu because they did not have the time to perform a security audit. Murray blamed the many CPU bugs (Spectre, Meltdown, etc.), which kept the team busy and prevented them to audit the feature.' -- source: https://news.slashdot.org/story/18/08/27/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.19 Preparing Better CPU Security Mitigations, New EROFS File-System
by Peter Reutemann 27 Aug '18

27 Aug '18

'Linus Torvalds released on Sunday Linux 4.19-rc1 that he describes as a "fairly frustrating merge window" following the new features landing over the past two weeks. What does this "pretty big release" offer? Phoronix's Linux 4.19 feature overview sheds light on more Spectre CPU mitigations for x86/POWER/s390, the new EROFS read-only Android file-system, a Raspberry Pi voltage driver, ThinkPad calculator key support, an in-kernel GPS subsystem, the Google GASKET driver framework, virtual kernel mode-setting, Qualcomm Adreno 600 series support, and many other improvements.' -- source: https://linux.slashdot.org/story/18/08/26/2342240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smartphones From 11 OEMs, Including Google, Samsung, HTC, Lenovo and Sony, Vulnerable To Attacks Via Hidden AT Commands
by Peter Reutemann 26 Aug '18

26 Aug '18

'In massive and groundbreaking research, a team of eleven scientists from the University of Florida, Stony Brook University, and Samsung Research America, have looked into what types of AT commands, or the Hayes command set, are currently supported on modern Android devices. The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.' -- source: https://mobile.slashdot.org/story/18/08/26/1910246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0