- wlug - list.wlug.org.nz

PB Tech Used Trade Me Data For Spam
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120816…>: PB Tech has signed an enforceable undertaking with the [Department of Internal Affairs] after it was found to have collected Trade Me customer details during trades and then sent them unsolicited messages. This was in breach of the Unsolicited Electronic Messages Act.

1 0

Massive New 'Salesforce Tower' Light Sculpture: AI, Ubuntu, Fog, and a MacBook
by Peter Reutemann 30 Jun '18

30 Jun '18

'The new tallest building on the San Francisco skyline -- and the tallest building in America west of the Mississippi -- includes a nine-story electronic sculpture that's been called the tallest piece of public art on Earth. It uses 11,000 LED bulbs reflected off the tower-topping aluminum panels -- each pixel created by a set of red, green, blue and white lights controlled by 8-bit PIC microcontrollers. "On a clear night, the show is visible for 30 miles," reports IEEE Spectrum. Slashdot reader Tekla Perry shares their article about "the technology involved in the light show at the top of Salesforce Tower. Electrical engineer and artist Jim Campbell explains it all -- and how the window-washer problem stumped him for nearly a year." "[O]n the 62nd floor, a central PC-based computer runs Ubuntu Linux, sending instructions to a communications control system that splits the data and sends it at 11 Mbit to the 32 enclosures using a custom communications protocol... We will capture images throughout the day, sending them to Amazon's cloud, and run some algorithms designed to identify visual interesting-ness. For example, at its simplest, when we look at the sky, if it's all blue, it's boring, if it's all white, it's boring, if it has white and blue it is likely to be interesting. We'll chose the best half hour of the day at each camera, based on movement and color, to display...." And finally, when the main display shuts down late at night, another system designed by Campbell will kick in. In this static display, a set of 36 white LEDs will create a three-dimensional constellation of lights that will look like stars. "It's quieter, it has a random aspect to it," he says. "Since construction started, the tower has emerged as an icon of the new San Francisco -- techie, ambitious, perhaps a little grandiose," writes the New Yorker, capturing the moment when Campbell finally unveiled his four-year project -- while fighting stomach flu and a chest cold, on a night which turned out to be prohibitively foggy. The executive vice-president of Boston Properties told him cheerily, "Jim! Look on the brighter side. We've got every night for the rest of our lives." "There was a long silence from the people on the terrace. The fog was thick. At last, someone exclaimed, 'Woo-hoo!,' and a volley of cheers followed." Although the colors they were seeing came from the celebratory fireworks and not from Jim's light sculpture. Are there any San Francisco-area Slashdotters who want to weigh in on the Salesforce Tower?' -- source: https://tech.slashdot.org/story/18/06/30/2031224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not A Bug, It’s A Feature!
by Lawrence D'Oliveiro 30 Jun '18

30 Jun '18

The IndexByDate.txt files available on the various Bitsavers directories (e.g. <http://bitsavers.trailing-edge.com/pdf/>) list the various items available in order of date. But if you want them ordered by name, so items in the same directory come together, the logical thing to do is use the sort(1) <https://linux.die.net/man/1/sort> command on this file. You specify the sort key by a “field definition”. The man page says that, by default, each field starts at a non-whitespace character after whitespace. The file has a very regular format: splitting by whitespace, you get the date, the time, and then the pathname. So a command like sort -k3 IndexByDate.txt should work. Except I was seeing a sequence like this: 2006-08-17 22:17:12 ge/MarkI_Timesharing/IPC-202646_FORTRAN_Aug66.pdf 2012-08-29 02:26:21 generalAutomation/18_30/88A00026A-A_GA1830_Industrial_Supervisory_System_Reference_Manual_May69.pdf ... 2018-05-16 00:33:35 georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf 2006-08-27 11:36:57 ge/PAC-4000/GET-3201B_PAC-4000_SysMan_Mar66.pdf As you can see, the “ge” section is interrupted by “generalAutomation” and others, and then resumes after them. What was going on? It took me a while to realize that the sorting is done by locale, and the locale setting is set to ignore the slashes. Thus, the above sequence is effectively “gem” followed by “gen”, then “geo” and “gep”. What I wanted was a straight ASCII sort on the full pathname, without regard to any locale settings. But there is no hint in the man page as to how to specify this. Then I realized: the locale is controlled by environment variables. If you want the “non-localized” locale, then specify the locale called “C”, thus: LC_ALL=C sort -k3 IndexByDate.txt and this gives the order I want.

1 0

Linux Mint 19 'Tara' Released
by Peter Reutemann 30 Jun '18

30 Jun '18

'Linux Mint, the maker of popular Linux distro, announced on Friday the general availability of a new version of their operating system. Called Linux Mint 19 "Tara", the new version offers a range of new features, improvements, and a promise that it would stick around for a while. Writing for BetaNews, Brian Fagioli: The most significant aspect of Linux Mint 19 is the new Ubuntu 18.04 LTS base. Tara will receive updates until 2023 -- very impressive. The kernel is at 4.15, and all three desktop environments are being updated too. Mate is now at version 1.2, Cinnamon gets bumped up to 3.8, and Xfce is updated to 4.12. In Linux Mint 19, the star of the show is Timeshift, said, Clement Lefebvre, Linux Mint Project Leader. Although it was introduced in Linux Mint 18.3 and backported to all Linux Mint releases, it is now at the center of Linux Mint's update strategy and communication, he added. Thanks to Timeshift you can go back in time and restore your computer to the last functional system snapshot. If anything breaks, you can go back to the previous snapshot and it's as if the problem never happened.' -- source: https://linux.slashdot.org/story/18/06/29/2041255 Cheers, Petre -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Invests $22 Million In Feature Phone Operating System KaiOS
by Peter Reutemann 30 Jun '18

30 Jun '18

'Google is turning startup investor to further its goal of putting Google services like search, maps, and its voice assistant front and center for the next billion internet users in emerging markets. It has invested $22 million into KaiOS, the company that has built an eponymous operating system for feature phones that packs a range of native apps and other smartphone-like services. As part of the investment, KaiOS will be working on integrating Google services like search, maps, YouTube and its voice assistant into more KaiOS devices, after initially announcing Google apps for KaiOS-powered Nokia phones earlier this year. KaiOS is a U.S.-based project that started in 2017, built on the ashes of Mozilla's failed Firefox OS experiment, as a fork of the Linux codebase. Firefox OS was intended to be the basis of a new wave of HTML-5, low-cost smartphones. And while those devices and the wider ecosystem never really took off, KaiOS has fared significantly better. KaiOS powers phones made by OEMs including Nokia (HMD), Micromax and Alcatel, and it works with carriers including Sprint and AT&T -- it counts offices in North America, Europe and Asia. But its most significant deployment to date has been with India's Reliance Jio, the challenger telco that disrupted the Indian market with affordable 4G data packages. "This funding will help us fast-track development and global deployment of KaiOS-enabled smart feature phones, allowing us to connect the vast population that still cannot access the internet, especially in emerging markets," said KaiOS CEO Sebastien Codeville in a statement.' -- source: https://mobile.slashdot.org/story/18/06/29/2118251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Google, and Microsoft Use Design To Trick You Into Handing Over Your Data, Report Warns
by Peter Reutemann 29 Jun '18

29 Jun '18

'A study from the Norwegian Consumer Council dug into the underhanded tactics used by Microsoft, Facebook, and Google to collect user data. "The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users," states the report, which includes images and examples of confusing design choices and strangely worded statements involving the collection and use of personal data. Google makes opting out of personalized ads more of a chore than it needs to be and uses multiple pages of text, unclear design language, and, as described by the report, "hidden defaults" to push users toward the company's desired action. "If the user tried to turn the setting off, a popup window appeared explaining what happens if Ads Personalization is turned off, and asked users to reaffirm their choice," the report explained. "There was no explanation about the possible benefits of turning off Ads Personalization, or negative sides of leaving it turned on." Those who wish to completely avoid personalized ads must traverse multiple menus, making that "I agree" option seem like the lesser of two evils. In Windows 10, if a user wants to opt out of "tailored experiences with diagnostic data," they have to click a dimmed lightbulb, while the symbol for opting in is a brightly shining bulb, says the report. Another example has to do with Facebook. The social media site makes the "Agree and continue" option much more appealing and less intimidating than the grey "Manage Data Settings" option. The report says the company-suggested option is the easiest to use. "This 'easy road' consisted of four clicks to get through the process, which entailed accepting personalized ads from third parties and the use of face recognition. In contrast, users who wanted to limit data collection and use had to go through 13 clicks."' -- source: https://tech.slashdot.org/story/18/06/27/2233234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

GitHub Gentoo Organization Hacked
by Peter Reutemann 29 Jun '18

29 Jun '18

'June 28 at approximately 20:20 UTC unknown individuals have gained control of the Github Gentoo organization, and modified the content of repositories as well as pages there. We are still working to determine the exact extent and to regain control of the organization and its repositories. All Gentoo code hosted on GitHub should for the moment be considered compromised. This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Details are sparse, but we will update this story once we learn more.' -- source: https://it.slashdot.org/story/18/06/28/2240254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's Up With ProtonMail Outages?
by Peter Reutemann 28 Jun '18

28 Jun '18

Since we talked about ProtonMail in the past... 'ProtonMail, a secure email service provider used by more than two million users and references of which has been made in shows like Mr. Robot, has been facing outages for the last two days as it fights numerous DDoS attacks. "The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes," a ProtonMail spokesperson told BleepingComputer, adding that it has tracked the attack to a group that claims to have ties to Russia. But things are more complicated than that, and it appears ProtonMail users, who are already annoyed at the frequent outages over the last few days, are up for more such downtimes in the coming days. BleepingComputer: But in reality, the DDoS attacks have no ties to Russia, weren't even planned to in the first place, and the group behind the attacks denounced being Russian, to begin with. Responsible for the attacks is a hacker group named Apophis Squad. In a private conversation with Bleeping Computer today, one of the group's members detailed yesterday's chain of events. The Apophis member says they targeted ProtonMail at random while testing a beta version of a DDoS booter service the group is developing and preparing to launch. The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns." This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.' -- source: https://it.slashdot.org/story/18/06/28/159252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Every Android Device Launched Since 2012 Impacted By RAMpage Vulnerability
by Peter Reutemann 28 Jun '18

28 Jun '18

'Almost all Android devices released since 2012 are vulnerable to RAMpage bug, an international team of academics has revealed today. >From a report: The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack. Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory. In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.' -- source: https://it.slashdot.org/story/18/06/28/160220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Doubles Down on Linux and Open Source
by Peter Reutemann 28 Jun '18

28 Jun '18

'Google couldn't exist without Linux and open-source software. While you may not think of Google as a Linux company in the same way as you do Canonical, Red Hat, or SUSE, it wouldn't be the search and advertising giant it is today without Linux. So, it makes sense that Google is moving up from its Silver membership in The Linux Foundation, to the Platinum level. With this jump in status, Google gets a seat on the Foundation's board of directors. This position will be filled by Sarah Novotny, the head of open source strategy for Google Cloud Platform. Earlier this week, Chinese tech giant Tencent joined the Linux Foundation as a platinum member.' -- source: https://news.slashdot.org/story/18/06/27/1926211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

BBC Releases Computer History Archive
by Peter Reutemann 28 Jun '18

28 Jun '18

'A slice of computing history has been made public, giving people the opportunity to delve into an archive that inspired a generation of coders. The Computer Literacy Project led to the introduction of the BBC Micro alongside programs which introduced viewers to the principles of computing. It included interviews with innovators such as Bill Gates and Steve Wozniak. The BBC hopes the 1980s archive will encourage today's youngsters to become involved in computing. With the release of the archive, viewers can now search and browse all of the programmes from the project. The archive includes 267 programs, and 166 BBC Micro programs that were used on-screen.' -- source: https://news.slashdot.org/story/18/06/27/2037216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Finally, It's the Year of the Linux... Supercomputer
by Peter Reutemann 27 Jun '18

27 Jun '18

'From ZDNet: "The latest TOP500 Supercomputer list is out. What's not surprising is that Linux runs on every last one of the world's fastest supercomputers. Linux has dominated supercomputing for years. But, Linux only took over supercomputing lock, stock, and barrel in November 2017. That was the first time all of the TOP500 machines were running Linux. Before that IBM AIX, a Unix variant, was hanging on for dear life low on the list." An interesting architectural note: "GPUs, not CPUs, now power most of supercomputers' speed."' -- source: https://linux.slashdot.org/story/18/06/27/152216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anonymizing Printed Documents
by Lawrence D'Oliveiro 27 Jun '18

27 Jun '18

It’s been known for a while that many printer vendors add extra hard-to-detect dots to their printouts to make a pattern that can be used to identify the source of the document later. Now a research group <http://www.theregister.co.uk/2018/06/27/german_researchers_defeat_printer_t…> has found a way to stymie this process by adding extra dots that fit the patterns, but confuse the identification system. They even have source code on GitHub.

1 0

OpenBSD Chief De Raadt Says No Easy Fix For New Intel CPU Bug 'TLBleed'
by Peter Reutemann 26 Jun '18

26 Jun '18

'Recompiling is unlikely to be a catch-all solution for a recently unveiled Intel CPU vulnerability known as TLBleed, the details of which were leaked on Friday, the head of the OpenBSD project Theo de Raadt says. iTWire reports: The details of TLBleed, which gets its name from the fact that the flaw targets the translation lookaside buffer, a CPU cache, were leaked to the British tech site, The Register; the side-channel vulnerability can be theoretically exploited to extract encryption keys and private information from programs. Former NSA hacker Jake Williams said on Twitter that a fix would probably need changes to the core operating system and were likely to involve "a ton of work to mitigate (mostly app recompile)." But de Raadt was not so sanguine. "There are people saying you can change the kernel's process scheduler," he told iTWire on Monday. "(It's) not so easy." He said that Williams was lacking all the details and not thinking it through. "They actually have sufficient detail to think it through: the article says the TLB is shared between hyperthreading CPUs, and it is unsafe to share between two different contexts. Basically you can measure evictions against your own mappings, which indicates the other process is touching memory (you can determine the aliasing factors)." De Raadt said he was still not prepared to say more, saying: "Please wait for the paper [which is due in August]."' -- source: https://it.slashdot.org/story/18/06/25/2219217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Likely NSA Data-Collection Facilities
by Lawrence D'Oliveiro 26 Jun '18

26 Jun '18

Further to the mention last night of secret facilities operated by AT&T in the US where the NSA has access, this article <https://arstechnica.com/tech-policy/2018/06/meet-the-8-spooky-att-buildings…> reports on a list of eight likely places as detailed by The Intercept <https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/>. While the NSA is not technically allowed to spy on wholly “domestic” communications, there seem to be no limits on any “incidental collection” as a result of targetting some foreign communication. That means they can grab the contents of entire mailboxes just for the sake of one message. Then keep the lot for whatever use they like.

1 0

How Should Open Source Development Be Subsidized?
by Peter Reutemann 24 Jun '18

24 Jun '18

'"Open source maintainers are exhausted and rarely paid," writes TechCrunch's editorial manager. "A new generation wants to change the economics." An anonymous reader quotes their report: [Patreon] is increasingly being used by notable open source contributors as a way to connect with fans and sustain their work... For those who hit it big, the revenues can be outsized. Evan You, who created the popular JavaScript frontend library Vue.js, has reached $15,206 in monthly earnings ($182,472 a year) from 231 patrons... While Patreon is one direct approach for generating revenues from users, another one is to offer dual licenses, one free and one commercial... Companies care about proper licensing, and that becomes the leverage to gain revenue while still maintaining the openness and spirit of open source software... Tidelift is designed to offer assurances "around areas like security, licensing, and maintenance of software," CEO Donald Fischer explained... In addition, Tidelift handles the mundane tasks of setting up open source for commercialization such as handling licensing issues... Open Collective wants to open source the monetization of open source itself. Open Collective is a non-profit platform that provides tools to "collectives" to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way. TechCrunch warns that "It's not just that people are free riding, it's often that they don't even realize it. Software engineers can easily forget just how much craftsmanship has gone into the open source code that powers the most basic of applications... "If you work at a for-profit company, take the lead in finding a way to support the code that allows you to do your job so efficiently. The decentralization and volunteer spirit of the open source community needs exactly the same kind of decentralized spirit in every financial contributor. Sustainability is each of our jobs, every day."' -- source: https://news.slashdot.org/story/18/06/23/2113222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Birth Of PDF
by Lawrence D'Oliveiro 21 Jun '18

21 Jun '18

<http://www.theregister.co.uk/2018/06/21/how_a_tax_form_kludge_gave_us_25_ye…>: [In 1985] ... both Apple and Adobe wanted to show off the LaserWriter's abilities with some sample files. Warnock thought it would be great to have the printer producing something complex but familiar so he personally hand-programmed an IRS tax form in PostScript. ... all those boxes and form fields required Warnock to code in lots of subroutines and utilities. The page took 2 minutes 45 seconds to print. Jobs was horrified at how slow that was. ... His new version of the IRS tax form printed on the LaserWriter in 22 seconds. In other words, by abandoning all the programming-language constructs (subroutines, conditionals, looping etc) in PostScript and just writing out a straight sequence of imaging commands, the code ran a lot faster, even if it was bigger. The article mentions the release of PDF 2.0, which is now being managed by ISO. Unfortunately, unlike Adobe, ISO do not make their specs available for free.

1 0

OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns
by Peter Reutemann 21 Jun '18

21 Jun '18

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Peter Reutemann 21 Jun '18

21 Jun '18

'Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said. Since making its debut late last year, Satori has proven to be a particularly versatile and sophisticated botnet. It made a name for itself in December when it infected more than 100,000 Internet-connected devices in just 12 hours by exploiting remote code-execution vulnerabilities in Huawei and RealTek routers. A month later, Satori operators released a new version that infected devices used to mine digital coins, proving that the IoT botnet could also take control of more traditional computing devices. In February, Satori resurfaced when it infected tens of thousands of routers manufactured by Dasan Networks.' -- source: https://arstechnica.com/information-technology/2018/06/widely-used-d-link-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPP Versus Free-Software Licensing
by Lawrence D'Oliveiro 20 Jun '18

20 Jun '18

Seems like the “CPTPP” aka “TPP-11” (TPP minus the USA) may not be entirely free of objectionable provisions. A submission to the Australian ratification process <https://www.techdirt.com/articles/20180615/09090440050/open-source-industry…> has pointed out the following problematic clause: No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. As you may know, such an access requirement is an integral part of copyleft licences like the GPL. What this clause seems to be saying is that such a requirement is unenforceable under the TPP.

2 4

meeting next Monday?
by Peter Reutemann 19 Jun '18

19 Jun '18

Hi everyone Any suggestions for next week's meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
by Peter Reutemann 18 Jun '18

18 Jun '18

'Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.' -- source: https://apple.slashdot.org/story/18/06/18/1336248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.18 Preparing Many New Features While Dropping 100k+ Lines of Code
by Peter Reutemann 18 Jun '18

18 Jun '18

'Linux 4.18 development is going strong with recent 4.18-rc1 release. This kernel cycle has dropped 107,210 lines of code so far but Linux 4.18 is adding many new features. The kernel is coming in lighter as a result of the LustreFS code being removed and other code cleanups. On the feature front, Phoronix reports, "ew AMDGPU support improvements, mainlining of the V3D DRM driver, initial open-source work on NVIDIA Volta GV100 hardware, merging of the Valve Steam Controller kernel driver, merging of the BPFILTER framework, ARM Spectre mitigation work, Speck file-system encryption support, removal of the Lustre file-system, the exciting restartable sequences system call was merged, the new DM writecache target, and much more."' -- source: https://linux.slashdot.org/story/18/06/18/1334205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Reason To Move To GPLv3?
by Lawrence D'Oliveiro 18 Jun '18

18 Jun '18

Red Hat has decided <http://www.theregister.co.uk/2018/06/18/red_hat_gpl_violation/> that it prefers the more lenient remediation provisions in GPLv3 for licence violators. So as a matter of policy, it is going to adhere to them even for products it has licensed GPL/LGPLv2.x. [Licensing export Paul] Berg said the GPL and LGPL version 3 have more lenient termination clauses for good reason: Most people have no idea they've violated the terms and would comply if made aware of the problem. The article mentions the case of a Linux kernel developer who has been exploiting--some say abusing--his contributions to extract money from various firms. This has been a great annoyance to the kernel community--the same community that made it clear some years ago that they were against moving to GPLv3.

1 0

Another Day, Another Intel CPU Security Hole: Lazy State
by Peter Reutemann 15 Jun '18

15 Jun '18

'The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system. Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: "It affects Intel designs similar to variant 3-a of the previous stuff, but it's NOT Meltdown." Still, "it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc." Lazy State does not affect AMD processors. This vulnerability exists because modern CPUs include many registers (internal memory) that represent the state of each running application. Saving and restoring this state when switching from one application to another takes time. As a performance optimization, this may be done "lazily" (i.e., when needed) and that is where the problem hides. This vulnerability exploits "lazy state restore" by allowing an attacker to obtain information about the activity of other applications, including encryption operations' -- source: https://it.slashdot.org/story/18/06/14/1553255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1