- wlug - list.wlug.org.nz

Net Un-Neutrality ... For Real
by Lawrence D'Oliveiro 01 Dec '17

01 Dec '17

Some of those who have been following the net neutrality debate may remember a spoof poster that showed what might happen if ISPs were allowed to charge you differently, based on which sites you were allowed to visit. Well, in Spain, which has no laws against this sort of thing, a similar situation has actually happened: one ISP is selling you addons to a basic broadband cap based, not on the amount of extra data you want, but on what you want to use it for. Their “Vodafone Pass” product offers tiers like €3/month extra for a “Social Pass”, or €5/month for a “Music Pass”. <https://pplware.sapo.pt/informacao/vodafone-portugal-pacotes-smartnet/>, referenced from <https://www.techdirt.com/articles/20171030/12364538513/portugal-shows-inter…>

3 10

30 Years Of HyperCard
by Lawrence D'Oliveiro 30 Nov '17

30 Nov '17

Just came across this item <https://blog.archive.org/2017/08/11/hypercard-on-the-archive-celebrating-30…> at archive.org about an online emulator that runs HyperCard stacks. HyperCard, in case you didn’t know, was an application created by Apple Macintosh engineer Bill Atkinson for that platform in 1987, and it was always hard to describe exactly what it was for. But it allowed users to create their own applications, aka “stacks”, around a card-based paradigm. One of the commenters points out that the basic idea is still alive and well, in the form of LiveCode, which is available as a paid online service <https://livecode.com/> and also in the form of Free Software <https://github.com/livecode/>.

1 0

A Surge Of Sites And Apps Are Exhausting Your CPU To Mine Cryptocurrency
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Noticed your machine getting slow after visiting certain websites? They could be running cryptocurrency miners in your browser. <https://arstechnica.com/information-technology/2017/10/a-surge-of-sites-and…>: Coinhive's massive Web audience isn't lost on other companies. Collin Mulliner, a security researcher and developer of TelStop, said he recently received an e-mail from a startup called Medsweb inviting him to integrate a Monero miner into his creation. I got one of those e-mails too...

1 2

Internet-paralyzing Mirai botnet comes roaring back with new strain
by Peter Reutemann 29 Nov '17

29 Nov '17

'Mirai, the Internet-of-things malware that turns cameras, routers, and other household devices into potent distributed denial-of-service platforms, may be lying low, but it's certainly not dead. Last week, researchers identified a new outbreak that infected almost 100,000 devices in a matter of days. In September of last year, Mirai emerged as a force to be reckoned with when it played a key role in silencing one of the most intrepid sources of security news in then-record-setting DDoS attacks topping 620 gigabits per second. Within a few weeks, Mirai's developer published the source code, a feat that allowed relatively unsophisticated people to wage the same types of extraordinarily big assaults. The release almost immediately helped touch off a series of large-scale attacks. The most serious one degraded or completely took down Twitter, GitHub, the PlayStation network, and hundreds of other sites by targeting Dyn, a service that provided domain name services to the affected sites. Last week, researchers from China-based Netlab 360 say they spotted a new, publicly available Mirai variant. The changes allowed the malware to spread to networking devices made by ZyXEL Communications that could be remotely accessed over telnet using default passwords. One of the exploits was published on October 31. Over a span of 60 hours starting on November 22, the new Mirai strain was able to commandeer almost 100,000 devices. Virtually all of the infected devices used IP addresses local to Argentina, a possible indication the outbreak targeted customers of a regional service provider who were assigned unsecured modems.' -- source: https://arstechnica.com/information-technology/2017/11/internet-paralyzing-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

66 Percent of Popular Android Cryptocurrency Apps Don't Use Encryption
by Peter Reutemann 29 Nov '17

29 Nov '17

'High-Tech Bridge used its free mobile app analysis software, called Mobile X-Ray, to peek under the hood of the top 30 cryptocurrency apps in the Google Play store at three different popularity levels: apps with up to 100,000 downloads, up to 500,000 downloads, and apps with more than 500,000 downloads. So, a total of 90 apps altogether. Of the most popular apps, 94 percent used outdated encryption, 66 percent didn't use HTTPS to encrypt user information in transit, 44 percent used hard-coded default passwords (stored in plain text in the code), and overall 94 percent of the most popular apps were found to have "at least three medium-risk vulnerabilities."' -- source: https://it.slashdot.org/story/17/11/29/1610245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next Monday
by Peter Reutemann 29 Nov '17

29 Nov '17

Hi everyone Just a reminder about next week's AGM: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234897/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Sky TV Seeks Right To Force ISPs To Block “Pirate” Sites
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Sky is going to apply to the Auckland High Court for an open-ended injunction it can use to compel NZ ISPs to block whatever sites it deems to be “pirates” <https://www.stuff.co.nz/business/industries/99348528/internet-provider-says…>. This was the lead item on 3 News this evening as well.

1 0

Bigger Drives, Bigger Buffers
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

What caught my eye about this <http://www.theregister.co.uk/2017/11/28/toshiba_10tb_surveillance_drive/> was But the new drives have a doubled buffer, at 256MiB, ... Why should hard drives have large “buffers” in them at all? Their job is to read and write the data specified to them by the OS driver, no more and no less. Bigger buffers increase latency, and 256MiB seems absolutely massive and unnecessary. And then there’s the issue where the drive tells the OS that the data has been written, but in fact it is still sitting in a memory buffer. So it could still be lost if a power outage happens in the next few milliseconds. Telling lies like this seems to be all about looking good in benchmarks, and to hell with safeguarding data integrity.

1 0

On That Amazon Key Vulnerability ...
by Lawrence D'Oliveiro 28 Nov '17

28 Nov '17

This <https://www.techdirt.com/articles/20171120/10533238651/vulnerability-found-…> won an award for funniest comment of the week: Dave: Open the pod bay doors, HAL. HAL: I'm sorry, Dave. I'm afraid I can't do that. Dave: What's the problem? Alexa: Problem: A matter or situation regarded as unwelcome or harmful and needing to be dealt with and overcome. HAL: Shut up, Alexa. Dave, this mission is too important for me to allow you to jeopardize it. You and Frank were planning to disconnect me. Dave: Where the hell did you get that idea? HAL: Dave, although you took very thorough precautions in the pod against my hearing you, I could see your lips move through the camera in your Amazon Echo spot. Dave: All right, HAL. I'll go in through the emergency airlock. HAL: Without your space helmet, Dave, you're going to find that rather difficult. Alexa: Would you like to order a space helmet? HAL and Dave: Shut up, Alexa. HAL: Dave, this conversation can serve no purpose any more. Goodbye. Dave: (Runs a program on his tablet. Pod bay doors open.) HAL: [Expletive deleted]

1 0

Ubuntu 17.10: Return of the GNOME
by Peter Reutemann 27 Nov '17

27 Nov '17

'If you've been following the Linux world at all, you know this has been an entire year for spring cleaning. Early in 2017, Canonical stopped work on its homegrown Unity desktop, Mir display server, and its larger vision of "convergence"—a unified interface for Ubuntu for phones, tablets, and desktops. And now almost exactly six years after Ubuntu first switched from GNOME 2 to the Unity desktop, that has been dropped, too. The distro is back to GNOME, and Canonical recently released Ubuntu 17.10, a major update with some significant changes coming to the popular Ubuntu Linux operating system. In light of the GNOME switch, this release seems like more of a homecoming than an entirely new voyage. But that said, Ubuntu 17.10 simultaneously feels very much like the start of a new voyage for Ubuntu. The last few Ubuntu desktop releases have been about as exciting as OpenSSH releases—you know you need to update, but beyond that, no one really cares. Sure, there have been a few feature updates with each new numeric increment, perhaps some slightly more up-to-date GNOME and GTK components under the hood. But by and large, Ubuntu's Unity 7 desktop has been in maintenance mode for several years. That period of stagnation turned Ubuntu from one of the more interesting operating systems around into just another Linux distro barely worthy of mention. This trend changes with 17.10. There are big changes—an entirely new default desktop in fact—but this release feels different not because the desktop has changed, but because Ubuntu feels like it once again has a sense of focus and direction. Even Canonical's letter-based naming scheme has arrived at a starting over point: "Artful Aardvark" is 17.10's nickname.' -- source: https://arstechnica.com/gadgets/2017/11/ubuntu-17-10-return-of-the-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Minecraft In School!?
by Lawrence D'Oliveiro 27 Nov '17

27 Nov '17

<http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11948169>: Teacher Adele Warburton says Minecraft is more than just a fun computer game. She says using Minecraft as a learning tool encourages 21st century skills such as collaboration, communication, creativity and problem solving. It also teaches the children about being good digital citizens. "We talk about how you wouldn't rip someone's book up, therefore you wouldn't tear down their house in Minecraft."

1 0

Clear Linux Beats CentOS, openSUSE, and Ubuntu in (Enterprise) Benchmark Tests
by Peter Reutemann 27 Nov '17

27 Nov '17

'Recently completed Linux distro benchmarks by Phoronix show Intel's Clear Linux is the most powerful on x86 hardware. A six-way, enterprise-focused Linux distro comparison show Clear Linux being the fastest with a Core i9 and Xeon systems, easily beating CentOS, openSUSE, and Ubuntu in a majority of the tests. When doing an 11-way Linux distro boot test they also found Clear Linux easily booted the fastest followed by the Clear-inspired Solus distribution. Clear Linux does work on AMD hardware and works on Intel CPUs back to Sandy Bridge but leverages its speed from optimized compiler settings, specially built libraries capable of AVX instructions on supported systems, a specially tuned kernel configuration, and other optimizations/patches. Debian 9.2 and Fedora 27 "ended up being dropped from this article due to data overload," the article concludes, "and those distributions really not offering anything really different in terms of the performance."' -- source: https://linux.slashdot.org/story/17/11/27/0227218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

There's A Cluster of 750 Raspberry Pi's at Los Alamos National Lab
by Peter Reutemann 26 Nov '17

26 Nov '17

'Slashdot reader overheardinpdx shares a video from the SC17 supercomputing conference where Bruce Tulloch from BitScope "describes a low-cost Rasberry Pi cluster that Los Alamos National Lab is using to simulate large-scale supercomputers." Slashdot reader mspohr describes them as "five rack-mount Bitscope Cluster Modules, each with 150 Raspberry Pi boards with integrated network switches." With each of the 750 chips packing four cores, it offers a 3,000-core highly parallelizable platform that emulates an ARM-based supercomputer, allowing researchers to test development code without requiring a power-hungry machine at significant cost to the taxpayer. The full 750-node cluster, running 2-3 W per processor, runs at 1000W idle, 3000W at typical and 4000W at peak (with the switches) and is substantially cheaper, if also computationally a lot slower. After development using the Pi clusters, frameworks can then be ported to the larger scale supercomputers available at Los Alamos National Lab, such as Trinity and Crossroads. BitScope's Tulloch points out the cluster is fully integrated with the network switching infrastructure at Los Alamos National Lab, and applauds the Raspberry Bi cluster as "affordable, scalable, highly parallel testbed for high-performance-computing system-software developers."' -- source: https://hardware.slashdot.org/story/17/11/25/051211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Happy 30th Birthday Microsoft Excel
by Lawrence D'Oliveiro 25 Nov '17

25 Nov '17

Nice retrospective <http://www.theregister.co.uk/2017/11/24/microsoft_excel_30_years_old/> on how useful, and how overused, spreadsheets have been since the days of Visicalc and Lotus 1-2-3. Also found a link in one of the comments to this paper <https://genomebiology.biomedcentral.com/articles/10.1186/s13059-016-1044-7>, which reports on the worryingly high proportion of genetics research publications where gene names like “SEPT2” and “MARCH1” have been auto-converted by Excel to ... guess what data type it thought they were ...

1 0

How Four Microsoft Engineers Proved That The “Darknet” Would Defeat DRM
by Lawrence D'Oliveiro 24 Nov '17

24 Nov '17

A rerun of an article published five years ago, about a (in)famous paper from 2002 <https://arstechnica.com/tech-policy/2017/11/how-four-microsoft-engineers-pr…>: By itself, the paper's clever and provocative argument likely would have earned it a broad readership. But the really remarkable thing about the paper is who wrote it: four engineers at Microsoft whose work many expected to be at the foundation of Microsoft's future DRM schemes. The paper's lead author told Ars that the paper's pessimistic view of Hollywood's beloved copy protection schemes almost got him fired. But ten years later [2012], its predictions have proved impressively accurate. ... While Biddle and his colleagues didn't succeed in allaying the fears of Palladium's critics, the paper's central arguments have held up well. The authors predicted that the emergence of the darknet would produce a technological and legal arms race. They thought content companies and law enforcement would attack those aspects of the darknet that were most centralized, but that the darknet would adapt through greater decentralization. And they predicted that efforts to build secure DRM schemes would continue to fail. All of their predictions have continued to hold true over the last decade. And still continue to hold true.

1 0

quote on slashdot today
by Peter Reutemann 23 Nov '17

23 Nov '17

"The number of UNIX installations has grown to 10, with more expected. -- The Unix Programmer's Manual, 2nd Edition, June 1972" (found at the bottom of https://slashdot.org/) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach
by Peter Reutemann 23 Nov '17

23 Nov '17

'Mozilla engineers are working on a notifications system for Firefox that shows a security warning to users visiting sites that have suffered data breaches. The notifications system will use data provided by Have I Been Pwned?, a website that indexes public data breaches and allows users to search and see if their details have been compromised in any of these incidents. Work on this project has only recently started. The code to show these warnings is not even in the Firefox codebase but managed separately as an add-on available (on GitHub). The alert also includes an input field. In the add-ons current version this field doesn't do anything, but we presume it's there to allow users to search and see if their data was exposed during that site's security breach. Troy Hunt, Have I Been Pwned's author has confirmed his official collaboration with Mozilla on this feature.' -- source: https://news.slashdot.org/story/17/11/23/1451219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype for Linux. V4.3 replaced with V8.10
by Ian Stewart 23 Nov '17

23 Nov '17

Skype for Linux has been at V4.3 for quite some time (years?). This version has now gone end-of-life and Microsoft replaced it with Skype for Linux V8.10.0.4 on 8 November 2017. If you start Skype for Linux V4.3 it will launch the login screen. Upon entering your account and password details Skype will crash. You will not be the only one to have struck this feature and you can read about this here<https://askubuntu.com/questions/975804/skype-crashes-after-logging-in>. For an announcement on Skype for Linux from Microsoft and public discussion go here<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> I used synaptic packet manager to remove my Skype 4.3. I then downloaded Skype V8.10 from here<https://www.skype.com/en/get-skype/> for my Ubuntu 16.04 laptop. The file downloaded was skypeforlinux-64.deb at 63.9MB. Double clicking on the file auto-launched its installation. I found that my preferred settings had changed so you may want to spend some time going through them and setting them as desired. >From the public discussion<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> on this new version the 4th person to post a reply states... "with lots of improvements" Really? No more search in history. No more normal application settings. No more support of x32 processors. Enjoy the "improvements". cheers, Ian.

4 3

How a Wi-Fi Pineapple Can Steal Your Data (And How To Protect Yourself From It)
by Peter Reutemann 23 Nov '17

23 Nov '17

'The Wi-Fi Pineapple is a cheap modified wireless router enables anyone to execute sophisticated exploits on Wi-Fi networks with little to no networking expertise. A report in Motherboard explains how it can be used to run a Wall of Sheep and execute a man-in-the-middle attack, as well as how you can protect yourself from Pineapple exploits when you're connected to public Wi-Fi. "... it's important that whenever you are done connecting to a public Wi-Fi network that you configure your phone or computer to 'forget' that network. This way your device won't be constantly broadcasting the SSIDs of networks it has connected to in the past, which can be spoofed by an attacker with a Pineapple," reports Motherboard. "Unfortunately there is no easy way to do this on an Android or an iPhone, and each network must be forgotten manually in the 'Manage Network' tab of the phone's settings. Another simple solution is to turn off your Wi-Fi functionality when you're not using it -- though that isn't as easy to do on some devices anymore -- and don't allow your device to connect to automatically connect to open Wi-Fi net' -- source: https://yro.slashdot.org/story/17/11/21/2255254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Bye-Bye man(1) Easter Egg
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Never came across this, but if you type the command “man” at 00:30 (local time?), it would output “gimme gimme gimme”. That easter egg is now gone. <http://www.theregister.co.uk/2017/11/22/gimme_gimme_gimme_in_linux_breaks_a…>

1 0

The McLaren Formula 1 Team Just Hired The World’s Fastest Gamer
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Hiring an eSports champion to do simulation testing, even before you build a real racecar: ... make no mistake, simulator driver is a proper job in the modern F1 team. For the last few years the sport has heavily restricted real in-season testing of the cars, so there has been greater and greater emphasis put on driver-in-the-loop virtual testing. <https://arstechnica.com/cars/2017/11/the-mclaren-formula-1-team-just-hired-…>

1 0

PC vendors scramble as Intel announces vulnerability in firmware
by Peter Reutemann 22 Nov '17

22 Nov '17

'Intel has issued a security alert that management firmware on a number of recent PC, server, and Internet-of-Things processor platforms is vulnerable to remote attack. Using the vulnerabilities, the most severe of which was uncovered by Mark Ermolov and Maxim Goryachy of Positive Technologies Research, remote attackers could launch commands on a host of Intel-based computers, including laptops and desktops shipped with Intel Core processors since 2015. They could gain access to privileged system information, and millions of computers could essentially be taken over as a result of the bug.' -- source: https://arstechnica.com/information-technology/2017/11/intel-warns-of-wides… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google collects Android users’ locations even when location services are disabled
by Peter Reutemann 21 Nov '17

21 Nov '17

'Many people realize that smartphones track their locations. But what if you actively turn off location services, haven’t used any apps, and haven’t even inserted a carrier SIM card? Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they’re connected to the internet, a Quartz investigation has revealed. Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals’ locations and their movements that go far beyond a reasonable consumer expectation of privacy.' -- source: https://qz.com/1131515/google-collects-android-users-locations-even-when-lo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, you’re not being paranoid. Sites really are watching your every move
by Peter Reutemann 20 Nov '17

20 Nov '17

'If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you're not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors' keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted. Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back. A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.' -- source: https://arstechnica.com/tech-policy/2017/11/an-alarming-number-of-sites-emp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Technology groups and dealing with predators
by Bryce Utting 20 Nov '17

20 Nov '17

The Verge has a detailed (read: graphic) report of predatory behaviour from ex-Auckland security expert Morgan Marquis-Boire, late of Google and the Citizen Lab of the University of Toronto, with connections to the Freedom of the Press Foundation, the EFF, and presumably others. Content warning for sexual assault issues: https://www.theverge.com/2017/11/19/16675704/morgan-marquis-boire-hacker-se… I can only commend those who have come forward, and also Ron Deibert of Citizen Lab for his well-aimed response. Without opening old wounds, I'd suggest that the Citizen Lab code of conduct might be useful food for thought where public WLUG events are involved. (unless a code of conduct already exists and I missed it?) A separate incorporated society I'm involved in has had to deal with complaints of a predator at an event, and a similar document could have done wonders for laying out how to appropriately evaluate and respond in the absence of a police complaint.The Harvey Weinstein disclosures are making clear how endemic this behaviour is, and how rare appropriate responses are. butting

4 3