- wlug - list.wlug.org.nz

ubuntu.com down?
by Peter Reutemann 09 Nov '17

09 Nov '17

Tried to go to Ubuntu's homepage and was greeted with a 503 error message (see attachment)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Bruce Schneier On The Equifax Breach
by Lawrence D'Oliveiro 08 Nov '17

08 Nov '17

Security expert Bruce Schneier has published <https://www.schneier.com/blog/archives/2017/11/me_on_the_equif.html> the testimony he gave to the US House Energy and Commerce Committee on the breach of confidential personal information on close to half the entire population of the US. His main points are worth summarizing: 1. The Equifax breach was a serious security breach that puts millions of Americans at risk. 2. Equifax was solely at fault. 3. There are thousands of data brokers with similarly intimate information, similarly at risk. 4. These data brokers deliberately hide their actions, and make it difficult for consumers to learn about or control their data. 5. The existing regulatory structure is inadequate. 6. The market cannot fix this because we are not the customers of data brokers. 7. We need effective regulation of data brokers. 8. Resist complaints from the industry that this is "too hard." 9. This has foreign trade implications. 10. This has national security implications. 11. We need to do something about it. Read the article for more detail. I would say this is more than a US-specific problem, it is a worldwide problem. Other places may have stricter privacy regulations, but that might not be enough.

1 0

Linux Has a USB Driver Security Problem
by Peter Reutemann 08 Nov '17

08 Nov '17

'USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users' computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. "All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine," Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code.' -- source: https://linux.slashdot.org/story/17/11/08/1730210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Create & manage docker hosts with Docker Machine on VirtualBox
by Peter Reutemann 08 Nov '17

08 Nov '17

'Docker Machine is a tool that let us install Docker Engine on virtual hosts on various platforms, on local environment as well on cloud. With Docker Machine, we can easily install docker hosts a Windows machine, a MAC machine or on cloud platform like AWS, AZURE etc. As we know that Docker Engine runs natively on Linux machines, so its pretty easy to get Docker working on Linux machines but for other OS like MAC or Windows this was a problem. So Docker Machine was introduced, especially for older versions of MAC & Windows (there are new native Docker apps for latest OS). Not meant only for Windows or MAC, Docker machine also provides efficient way to provision multiple Docker hosts on local as well as cloud network. To manage the docker hosts, we use rather than using ‘docker’ command, which is used with docker engine. In this tutorial, we will discuss how we can create & manage docker hosts with Docker Machine on VirtualBox.' -- source: http://linuxtechlab.com/create-manage-docker-hosts-with-docker-machine/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache OpenOffice: We're OK With Not Being Super Cool
by Peter Reutemann 08 Nov '17

08 Nov '17

'Despite being the subject of a deathwatch -- perhaps mainly by fans of rival LibreOffice -- AOO appears to be rather popular, with the 4.1.4 update racking up at least 1.6 million downloads. [...] While AOO and the ASF formulate a formal statement of direction for the project, Jagielski said more or less that all's well. "AOO is not, and isn't designed to be, the 'super coolest open source office suite with all the latest bells and whistles,'" Jagielski continued. "Our research shows that a 'basic,' functional office suite, which is streamlined with a 'simple' and uncluttered, uncomplicated UI, serves an incredible under-represented community. "Other office suites are focusing on the 'power user' which is a valuable market, for sure, but the real power and range for an open-source office suite alternative is the vast majority which is the 'rest of us. Sometimes we all forget how empowering open source is to the entire world."' -- source: https://news.slashdot.org/story/17/11/07/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Improve your bash/sh shell script with ShellCheck lint script analysis tool
by Peter Reutemann 07 Nov '17

07 Nov '17

'ShellCheck is a static analysis tool for shell scripts. One can use it to finds bugs in your shell scripts. It is written in Haskell. You can find warnings and suggestions for bash/sh shell scripts with this tool. Let us see how to install and use ShellCheck on a Linux or Unix-like system to enhance your shell scripts, avoid errors and productivity.' -- source: https://www.cyberciti.biz/programming/improve-your-bashsh-shell-script-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maltese Law Enforcement Trying To Decrypt Slain Journalist’s Phone
by Lawrence D'Oliveiro 06 Nov '17

06 Nov '17

Daphne Caruana Galizia, the journalist recently killed by a car bomb in Malta, used WhatsApp to communicate securely with her sources. It appears part of her smartphone was salvaged from the wreck, and now the police are enlisting the help of the US FBI to see if they can decrypt whatever information can be found on it. Quoth Bruce: “It will be interesting to see if WhatsApp's security survives this.” <https://www.schneier.com/blog/archives/2017/11/daphne_caruana_.html>

1 0

No, the Linux Desktop Hasn't Jumped in Popularity
by Peter Reutemann 06 Nov '17

06 Nov '17

'Stories have been circulating that the Linux desktop had jumped in popularity and was used more than macOS. Alas, it's not so... These reports have been based on NetMarketShare's desktop operating system analysis, which showed Linux leaping from 2.5 percent in July, to almost 5 percent in September. But unfortunately for Linux fans, it's not true... It seems to be merely a mistake. Vince Vizzaccaro, NetMarketShare's executive marketing share of marketing told me, "The Linux share being reported is not correct. We are aware of the issue and are currently looking into it"... For the most accurate, albeit US-centric operating system and browser numbers, I prefer to use data from the federal government's Digital Analytics Program (DAP). Unlike the others, DAP's numbers come from billions of visits over the past 90 days to over 400 US executive branch government domains... DAP gets its raw data from a Google Analytics account. DAP has open-sourced the code, which displays the data on the web and its data-collection code... In the US Analytics site, which summarizes DAP's data, you will find desktop Linux, as usual, hanging out in "other" at 1.5 percent. Windows, as always, is on top with 45.9 percent, followed by Apple iOS, at 25.5 percent, Android at 18.6 percent, and macOS at 8.5 percent. The article does, however, acknowledge that Linux's real market share is probably a little higher simply because "no one, not even DAP, seems to do a good job of pulling out the Linux-based Chrome OS data' -- source: https://linux.slashdot.org/story/17/11/05/202232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Walkthrough Of The Windows Subsystem For Linux
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Here <https://www.youtube.com/watch?v=VSqAyOY5huQ> is a nice intro to the Linux compatibility layer that Microsoft has added to Windows 10. Their app store gives you a choice of Ubuntu or two flavours of SuSE. But while these omit any X server functionality, they do include all the GUI X clients. So it is perfectly possible to install a Windows-native X server, such as the open-source VcXsrv <https://sourceforge.net/projects/vcxsrv/>. And then he uses this to demonstrate running a full XFCE desktop side-by-side with the regular Windows desktop.

1 0

Mozilla Might Distrust Dutch Government Certs Over 'False Keys'
by Peter Reutemann 05 Nov '17

05 Nov '17

'Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)... This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates. "Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point' -- source: https://tech.slashdot.org/story/17/11/05/1845240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CyberSquirrel1: Tracking Infrastructure Damage Caused By Wildlife
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Interesting Twitter account <https://twitter.com/CyberSquirrel1> including the following item from a couple of days ago: Bird trips power supply to 4000 http://gisborneherald.co.nz/localnews/3069802-135/bird-trips-power-supply-t… … - Te Hapara, New Zealand

1 0

OnionShare – A Tool To Share Any Size Of Files Securely And Anonymously
by Peter Reutemann 05 Nov '17

05 Nov '17

'When we wrote an article about file sharing utilities such as Magic Womhole & transfer.sh most of the users asked is it secure? and where the files are stored. So, we decided to bring one of the best utility that stores and share files securely over the Internet. When we dig on that, we came to know about OnionShare which fulfill all this requirements. How are you saying, it falls under this category? Yes, it’s true because most of us know about Tor Browser which allows users to browse securely, privately and anonymously by implementing Onion routing in the application layer. Onion routing is a technique for anonymous communication over a computer network. OnionShare also developed in the same manner and allows you to use the Tor network to send files anywhere in the world.' -- source: https://www.2daygeek.com/onionshare-secure-way-to-share-files-sharing-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy guide to secure VNC server with TLS encryption
by Peter Reutemann 05 Nov '17

05 Nov '17

'In this tutorial, we will learn to install VNC server & secure VNC server sessions with TLS encryption. This method has been tested on CentOS 6 & 7 but should work on other versions/OS as well (RHEL, Scientific Linux etc).' -- source: http://linuxtechlab.com/secure-vnc-server-tls-encryption/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released
by Peter Reutemann 04 Nov '17

04 Nov '17

'The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.' -- source: https://it.slashdot.org/story/17/11/03/2127235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lots Of Digitally-Signed Malware Out There
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

One of the security weaknesses exploited by the “Stuxnet” worm that sabotaged Iran’s nuclear enrichment program was that it had a valid digital signature from a recognized issuer of certificates for Windows software. Of course, the issuer would never knowingly have validated a piece of malware, but the certificate had been compromised so it could be used without their permission. Turns out this sort of thing is not only quite common, there is a further problem in that anti-malware software, which is supposed to pick up revoked certificates and reject signatures that use them, frequently has bugs in their implementation of the signature-checking protocol, so they can let these bad signatures through. <https://arstechnica.com/information-technology/2017/11/evasive-code-signed-…>

1 0

The Patent That Just Wouldn’t Die
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

A holding company called Personal Audio claims to have a patent covering the entire idea of podcasting. Over the years, it has succeeded in winning some lucrative payouts, including $8 million from Apple and $1.3 million from CBS. All without making a single item of product itself. In other words, Personal Audio is what lawyers politely refer to as a “Non-Practising Entity” (NPE), or, in more common parlance, a patent troll. However, the Electronic Frontier Foundation has succeeded, with the help of a crowdfunding campaign, in invalidating this patent, using a system introduced at the USPTO called “inter partes review” (IPR). Of course, Personal Audio has not taken this lying down. It has come up with a truly imaginative series of legal counterarguments: * IPR violates the 7th Amendment of the US Constitution (right to trial by jury in a lawsuit). * IPR encourages “collective efforts to invalidate patents” which “severely tilts the playing field in favor of the party or parties seeking invalidation”. * the EFF has been working together with defendants in their litigation. Fortunately, the Court of Appeals for the Federal Circuit (CAFC) -- the same appeals court that overruled Judge William Alsup in his verdict (in Oracle vs Google) that APIs were not copyrightable -- seems to be a bit less uncritically pro-“Intellectual Property” these days (something to do with being slapped down by the Supreme Court?), and has rejected these arguments. Imagine if all this creativity had gone into producing actual useful products, instead of legal arguments ... <https://arstechnica.com/tech-policy/2017/11/eff-destroys-the-podcasting-pat…>

1 0

Microsoft Quietly Announces End of Last Free Windows 10 Upgrade Offer
by Peter Reutemann 03 Nov '17

03 Nov '17

'If you've been waiting to claim your free Windows 10 upgrade using the "assistive technologies" exception, you need to act soon. In a quiet change to an obscure web page, Microsoft announced this week that those exceptions will end on December 31, 2017. On July 29, 2016, Microsoft officially ended the Get Windows 10 program, which offered free Windows 10 upgrades to anyone currently running a supported earlier version of Windows. But the company left a giant loophole in a separate announcement at the same time. Under the terms of that announcement, individuals who use "assistive technologies" received an automatic extension of the free upgrade offer. Sometime in the past week, Microsoft quietly edited that page, to add "The accessibility upgrade offer expires on December 31, 2017."' -- source: https://tech.slashdot.org/story/17/11/03/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Sends Thousands of Phones Into Infinite Boot Loops
by Peter Reutemann 02 Nov '17

02 Nov '17

'A bug in the new "Adaptive Icons" feature introduced in Android Oreo has sent thousands of phones into infinite boot loops, forcing some users to reset their devices to factory settings, causing users to lose data along the way. The bug was discovered by Jcbsera, the developer of the Swipe for Facebook Android app (energy-efficient Facebook wrapper app), and does not affect Android Oreo (8.0) in its default state. The bug occurs only with apps that use adaptive icons -- a new feature introduced in Android Oreo that allows icons to change shape and size based on the device they're viewed on, or the type of launcher the user is using on his Android device. For example, adaptive icons will appear in square, rounded, or circle containers depending on the theme or launcher the user is using. The style of adaptive icons is defined a local XML file. The bug first manifested itself when the developer of the Swipe for Facebook Android app accidentally renamed the foreground image of his adaptive icon with the same name as this XML file (ic_launcher_main.png and ic_launcher_main.xml). This naming scheme sends Android Oreo in an infinite loop that regularly crashes the device. At one point, Android detects something is wrong and prompts the user to reset the device to factory settings. Users don't have to open an app, and the crashes still happen just by having an app with malformed adaptive icons artifacts on your phone. Google said it will fix the issue in Android Oreo 8.1.' -- source: https://tech.slashdot.org/story/17/11/01/1550256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 Best Lightweight Linux Distributions For Older Computers In 2017
by Peter Reutemann 31 Oct '17

31 Oct '17

Quick overview: 10. Peppermint 9. Lubuntu 8. Linux Lite 7. LXLE 6. CrunchBang++ 5. Bodhi Linux 4. antiX Linux 3. SparkyLinux 2. Puppy Linux 1. Tiny Core See here for full details: https://itsfoss.com/lightweight-linux-beginners/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Googler A Command Line Tool To Search Google
by Peter Reutemann 31 Oct '17

31 Oct '17

'Looking for information on the web has become something that we do day in and day out. Whether it is support you are looking for, looking for a product or news about a particular topic, all you have to do is search on the web. As a result, search engines have been designed so they can help us sift through or the garbage in order to get the information we seek. There are Google, Bing, and DuckDuckGo just to mention a few. But what do all these have in common, well, to use these you need a browser such as Firefox or Chromium first. Well does no problem at all; except when all you have is a terminal and no GUI and browser. Also, you may have a GUI and a browser but you wish you did not have to leave the terminal just for that quick search, and thus comes Googler. ' -- source: http://www.linuxandubuntu.com/home/googler-a-command-line-tool-to-search-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Appeals Court Keeps Alive The Never-Ending Linux Case, SCO v. IBM
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

“Jarndyce v. Jarndyce” for the 21st century, anybody? <https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive-the-n…>

1 0

How Kodi Took Over Piracy
by Peter Reutemann 30 Oct '17

30 Oct '17

'For years, piracy persisted mainly in the realm of torrents, with sites like The Pirate Bay and Demonoid connecting internet denizens to premium content gratis. But a confluence of factors have sent torrent usage plummeting from 23 percent of all North American daily internet traffic in 2011 to under 5 percent last year. Legal crackdowns shuttered prominent torrent sites. Paid alternatives like Netflix and Hulu made it easier just to pay up. And then there were the "fully loaded" Kodi boxes -- otherwise vanilla streaming devices that come with, or make easily accessible, so-called addons that seek out unlicensed content -- that deliver pirated movies and TV shows with push-button ease. "Kodi and the plugin system and the people who made these plugins have just dumbed down the process," says Dan Deeth, spokesperson for network-equipment company Sandvine. "It's easy for anyone to use. It's kind of set it and forget it. Like the Ron Popeil turkey roaster." Kodi itself is just a media player; the majority of addons aren't piracy focused, and lots of Kodi devices without illicit software plug-ins are utterly uncontroversial. Still, that Kodi has swallowed piracy may not surprise some of you; a full six percent of North American households have a Kodi device configured to access unlicensed content, according to a recent Sandvine study. But the story of how a popular, open-source media player called XBMC became a pirate's paradise might. And with a legal crackdown looming, the Kodi ecosystem's present may matter less than its uncertain future.' -- source: https://yro.slashdot.org/story/17/10/30/1931208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Get a Better Password Manager
by Peter Reutemann 30 Oct '17

30 Oct '17

'Mozilla engineers have started work on a project named Lockbox that they describe as "a work-in-progress extension [...] to improve upon Firefox's built-in password management." Mozilla released the new extension for employee-use only at first, but users can install it by going to this or this links. Lockbox revamps Firefox's antiquated password management utility with a new user interface (UI). A new Firefox UI button is also included, in case users want to add a shortcut in their browser's main interface to open Lockbox without going through all the menu options. Support for a master password is included, helping users secure their passwords from unauthorized access by co-workers, family members, or others.' -- source: https://news.slashdot.org/story/17/10/30/1245202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If We Can’t Trust Kaspersky, Should We Trust Microsoft?
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

An opinion piece at Al Jazeera <http://www.aljazeera.com/indepth/opinion/trust-kaspersky-trust-microsoft-17…> considers: A single malicious update pushed from Microsoft could cripple almost every government worldwide. ... That a small number of vendors have the capacity to remotely shut down government infrastructure, or vacuum up secret documents, is almost too scary to wrap your head around. And that's without pondering how likely they are to be pressured by their governments. In the face of future conflict, is the first step going to be disabling auto-updates for software from that country?

1 0

Early HP Archives Destroyed
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

Bill Hewlett and Dave Packard were the archetypal “two guys who started a business in a garage” from 1938. When the company they founded moved on to other things (computers, printers etc), the original test-equipment business they created was spun off as part of a company called Agilent, which in turn divested it as an outfit now known as Keysight. Now we hear that important historical paper archives from those early days, which were in the care of Keysight Technologies, have been lost in the recent deadly Santa Rosa wildfires. <http://www.theregister.co.uk/2017/10/29/hewlett_packard_history_lost_to_san…>

1 0