- wlug - list.wlug.org.nz

Linux Abandoning DocBook For Its Documentation?
by Lawrence D'Oliveiro 08 Aug '16

08 Aug '16

Just came across this <http://www.theregister.co.uk/2016/08/08/linux_48_rc1_lands_with_surface_3_s…>: Torvalds has also pointed out that while progress on v 4.8 is “fairly normal … the patch itself looks somewhat unusual: over 20% of the patch is documentation updates, due to conversion of the drm and media documentation from docbook to the Sphinx doc format. There are other doc updates, but that's the big bulk of it.” DocBook is an open-source implementation of SGML, which is a pretty heavyweight, official-international-standard, 1980s, big-company way of writing documentation. Sphinx, on the other hand, is commonly used for Python documentation, including on python.org itself <https://docs.python.org/3/index.html>. If you were putting together the documentation set for a passenger liner or a chemical factory, you’ll probably use SGML (in fact, there is very likely a legal requirement to do so). But for the rest of us, more lightweight markup systems like Sphinx/ReST and Markdown are much more convenient.

1 0

The Murky (Under)World Of Pay-Per-Install
by Lawrence D'Oliveiro 07 Aug '16

07 Aug '16

A research group has released a paper <http://www.theregister.co.uk/2016/08/05/payperinstall_study/> studying those “free” software installs that bring along a host of uninvited guests with them. While not actually illegal (yet), they resort to sneaky tactics, like lying low for a few weeks before taking over your browser search bar or injecting ads, to try to obscure their origin. They even actively defeat blocking attempts, by jumping between domain names as often as in a matter of hours.

1 0

Old server hardware
by Daniel Lawson 04 Aug '16

04 Aug '16

Hi all Endace is getting rid of a lot of old server hardware. Some of it is still in reasonable condition, and I can make it available to WLUG members if they are interested. It's all offered as-is, on a first-come-first-serve basis, and if you say you want it you have to take it away ( we are sending it to an e-waste recycler very soon) There's two types of system, multiple units of each: 1U, non-redundant PSU (SMC 6015X-TB system), Supermicro X7DBX-i motherboard, dual Xeon X5440 (quad-core, 2.5GHz), 16 or 32 GB (depending on unit) DDR2 667MHz FB DIMMs, IPMI controller, dual gige LAN, 3x SATA disk in hotswap drive bays 3U, 2+1 redundant PSU (Chenbro Chassis), Supermicro X7DBE Motherboard, dual Xeon X5540 (quad-core, 2.5GHz), 16 or 32 GB (dependint on unit) DDR2 667MHz FB DIMMs, IPMI controller, dual gige LAN, 2x 3Ware 9650SE-8LPML RAID controllers, 16 x SATA disk in hotswap drive bays In both cases, any disks inside them will need to be scrubbed. If anyone is interested, based on a firm commitment to pick up, please let me know by Friday 5pm. Email to daniel.lawson(a)endace.com or daniel(a)meta.net.nz please Thanks

3 3

FTC Stops Requiring Regular Password Changes
by Lawrence D'Oliveiro 04 Aug '16

04 Aug '16

Lorrie Cranor, new chief technologist at the US Federal Trade Commission, has managed to persuade them to drop their policy of requiring regular password changes <http://arstechnica.com/security/2016/08/frequent-password-changes-are-the-e…>: Frequent password changes do little to improve security and very possibly make security worse by encouraging the use of passwords that are more susceptible to cracking.

1 0

Beware Of User-Interface Experts
by Lawrence D'Oliveiro 04 Aug '16

04 Aug '16

The nice thing about GUIs is that there are so many to choose from. And everybody has an opinion about them. Particularly UI experts, who are always ready to point to things that any particular GUI does wrong. Even the platform developers themselves are prone to keep redesigning things from time to time. And then not even following their own rules. There was a famous map of the New York subway, released in 1972 <http://www.nytimes.com/2012/08/06/arts/design/the-subway-map-that-rattled-n…>, that represented the network in such a stylized fashion that the city’s residents got mightily confused. Was it the people’s fault? Was the designer’s brilliance simply misunderstood? Sometimes I think UI designers themselves lose track of how users actually do things outside their labs...

2 2

Project Hosting Service Fosshub Compromised, Embedding Malware Inside Hosted Files
by Peter Reutemann 04 Aug '16

04 Aug '16

'At least some applications on Fosshub, a free project hosting service appear to have been compromised, according to several reports. (Update: Fosshub has acknowledged the hack.) The software portal, furthermore, is serving malware payloads, reports add. Catalin Cimpanu of Softpedia says that a hacking group which goes by the name of PeggleCrew is responsible for the hack. "In short, a network service with no authentication was exposed to the internet," the hacker told Softpedia in an email. "We were able to grab data from this network service to obtain source code and passwords that led us further into the infrastructure of FOSSHub and eventually gain control of their production machines, backup and mirror locations, and FTP credentials for the caching service they use, as well as the Google Apps-hosted email." The hacker group told the publication that they have compromised the entire website, "including the administrator's email. He also revealed he didn't dump the site's database but claimed that "passwords weren't salted." A user on Reddit, who has since received lots of upvotes, adds: Some popular apps that have links to FossHub that may be infected include: Audacity, WinDirStat, qBittorrent, MKVToolNix, Spybot Search&Destroy, Calibre, SMPlayer, HWiNFO, MyPhoneExplorer, and IrfanView. Another application which has reportedly been compromised is Classic Shell. It is ostensibly overwriting the MBR on users' computers. Many users are upset with the timing of hack, noting that plenty of people were looking for Classic Shell amid the release of Windows 10 Anniversary Update. Update: 08/03 17:30 GMT by M :In a blog post, Audacity said that Fosshub was serving a hacked copy of its audio editing software for three hours. It adds that "no Audacity Team infrastructure was compromised." Fosshub team writes: Last night we had a security incident caused by a group of hackers that allowed them to log-in to FossHub developer *through* an user that was compromised. Shortly after, we noticed two users that were compromised. They simply logged-in using their passwords and this allowed them to escalate. [...] Several hours later, we noticed the attackers were able to gain access through an FTP account and we decided to shut down the main server immediately to prevent any further infection/damage. FossHub.com is down on purpose until we are able to identify the way hackers were able to escalate. Fosshub insists that the hacked copy of Classic Shell was only downloaded 300 times. In the meantime, if you know someone who may have downloaded the compromised copy of Classic Shell, here's what they need to do next.' -- source: https://tech.slashdot.org/story/16/08/03/1635240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows 10 Anniversary Update Borks Dual-Boot Partitions
by Peter Reutemann 04 Aug '16

04 Aug '16

'Windows 10 Anniversary Update may affect and even delete other partitions on the same disk, OMGUbuntu is reporting, citing several complaints by users. "Broken boot loaders on an update are one thing but losing data, even entire partitions?" asks the author. Microsoft-centric news blog WindowsReport is corroborating on the report, adding that in some cases, the new OS was not able to detect some partitions. It says (edited): Many users are reporting that some of their partitions disappeared after installing the Anniversary Update. Usually, it's the smallest partition that disappears, although we couldn't say for sure whether the partition is deleted or if Windows simply doesn't detect it. Some users are saying that the partition is not allocated, while others can detect it once they install third-party partition management applications. We have reached out to Microsoft for clarification, and will update the post when we hear back from them.' -- source: https://linux.slashdot.org/story/16/08/03/1614223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice 5.2 Officially Released
by Peter Reutemann 04 Aug '16

04 Aug '16

'LibreOffice 5.2 is finally here, after it has been in development for the past four months, during which the development team behind one of the best free office suites have managed to implement dozens of new features and improvements to most of the application's components. Key features include more UI refinements to make it flexible for anyone, standards-based document classification, forecasting functions in Calc, the spreadsheet editor, as well as lots of Writer and Impress enhancements. A series of videos are provided to see what landed in the LibreOffice 5.2 office suite, which is now available for download for GNU/Linux, Mac OS X, and Microsoft Windows operating systems.' -- source: https://news.slashdot.org/story/16/08/03/2022226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Vulnerabilities In Wireless Keyboards
by Lawrence D'Oliveiro 03 Aug '16

03 Aug '16

You’d think they’d be encrypted, but apparently most of them are not <https://www.schneier.com/blog/archives/2016/08/security_vulner_7.html>.

1 0

FCC Demands TP-Link Support Open Source Third-Party Firmware On Its Routers
by Lawrence D'Oliveiro 03 Aug '16

03 Aug '16

You may have heard that the US Federal Communications Commission has been updating its regulations concerning wi-fi routers. Some interpreted the new rules as meaning that companies should lock down their routers to prevent them running third-party open-source firmware. The FCC tried to make it clear that was not its intent, but nevertheless some companies did start to interpret things that way. Now, here is a case where, as part of a settlement against TP-Link for violating the regulations, the FCC has made it an explicit requirement that the company allow the running of third-party firmware <https://www.techdirt.com/articles/20160802/06073235135/fcc-demands-tp-link-…>.

1 0

Linux Grabs More Than 2% of Desktop Market Share
by rowan schischka 03 Aug '16

03 Aug '16

>is another example of the kind of dubious stats I was referring to. >You?ll notice it has Android well behind IOS, at 17% versus 23%. This >simply does not make sense. i often get access to a customers web analytics or i get employed to set up on behalf. the way this information is presented makes it useless. web analytics is really fun and interesting because you get to see the country of origin, time of day, page click through etc. for example im still seeing large numbers of visits from ie6 on windows xp from china. there are so many variables all i can really add is that The Register is reporting on the number of perceived unique visitors to their web site, not the rise or fall of desktop software brands as they claim. -- Kind Regards Rowan Schischka

2 1

Chrome 52 for Android Arrives With Smoother Video Playback, Faster Load Times, and Better Battery Life
by Peter Reutemann 02 Aug '16

02 Aug '16

'Following the release of Chrome 52 for desktop two weeks ago, Google last week also launched Chrome 52 for Android. For whatever reason, the company didn't share what's new until today. You can download the new version from Google Play. Chrome 52 for Android makes video playback feel smoother, load faster, and consume less battery. More specifically, video playback has been improved for speed and power efficiency, meaning you should expect smoother playback and faster load times (so videos will start playing sooner, instead of pausing briefly before starting). Your Android device's battery should also last longer if you consume a lot of videos online. Last but not least, video in Chrome for Android also now works with Data Saver Mode. This means a lightweight version of the video will be downloaded and played if you have Data Saver Mode on, saving you as much as 50 percent in data downloads, by Google's estimation.' -- source: https://tech.slashdot.org/story/16/08/02/1713202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 48 Released With Multi-Process Support, Mandatory Add-On Signing
by Peter Reutemann 02 Aug '16

02 Aug '16

'Mozilla on Tuesday released Firefox v48, touted as one of the most important updates the browser has ever received. With the new version, Firefox starts migrating users to using mullti-process threads (e10s, Electrolysis), and it is also the first version to ship with Rust component. In addition, Firefox is now also making add-on signing mandatory. >From a Softpedia article: Announced last year, Electrolysis, e10s, or multi-process support is Firefox's ability to process core browser operations separately from the content viewed on a Web page. Multi-process support allows a page to crash without bringing the entire browser down with it and improves the browser's overall performance. e10s rollout will take place in two phases, first in Firefox 48, and it will finish in Firefox 49, set for release on September 13, 2016. Mandatory add-on signing refers to Firefox preventing users from installing any add-ons that have not been approved by Mozilla's testers. This is something similar to what Chrome employs, but Firefox users have been spoiled all these years, always having the capability of installing any add-on they've desired. Rust is a programming language that's a revamped and improved version of C++ but that protects developers from accidentally including dangerous memory bugs in their code. It achieves this by how the language was constructed and by how developers write the code.' -- source: https://news.slashdot.org/story/16/08/02/1646255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Grabs More Than 2% of Desktop Market Share
by Peter Reutemann 02 Aug '16

02 Aug '16

'W3Counter's stats for June 2016 are in, and Linux desktop accounts for 2.48% of all web visits from tracked websites... (Android is counted separately from "Linux desktop.") Meanwhile, NetMarketShare shows Linux with a 2.02% share of the desktop market. And StatCounter shows a more detailed breakdown of the top 7 operating systems, with Windows 7 at 42.02%, Windows 10 at 21.88%, OSX at 9.94%, Windows 8.1 at 8.66%, Windows XP at 6.5%, and another 4.06% for "Unknown" (which is roughly tied with "Other") -- beating Windows 8.0 at 3.52%. In May they also reported another thought-provoking statistic: that Firefox's browser usage had surpassed that of IE and Edge combined for the first time.' -- source: https://linux.slashdot.org/story/16/07/02/184229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

There Is A Saying In Computer Science ...
by Lawrence D'Oliveiro 01 Aug '16

01 Aug '16

... that any problem can be solved by adding yet another level of indirection. (Might have been Butler Lampson who said that.) What brought that to mind was this report <http://phoronix.com/scan.php?page=news_item&px=Ubuntu-Netplan-YAML-Network> of a new Ubuntu project to add a common front end for generating network confgurations for all the different network-control backends. What, you mean there are setups that don’t use NetworkManager? Or even networkd?

1 0

Seymour Papert Has Died
by Lawrence D'Oliveiro 01 Aug '16

01 Aug '16

I remember I first heard of Seymour Papert when I picked up a copy of his book “Mindstorms” at the University library. This was based around the radical idea that young children could not only learn advanced concepts about mathematics and programming, but they could have fun doing so. For example, to draw a circle, you repeat the following some x number of times: * turn a little bit to one side * move a little bit forward (The larger the “x”, and the correspondingly smaller the “little bit” becomes, the better the approximation to a circle.) This comes straight out of a child’s intuitive idea of how they would walk in a circle (i.e. turtle graphics). But it is also a differential-geometric formulation of a circle! And today I discovered that Papert had suffered a serious traffic injury in Hanoi a decade ago. No word on whether he ever recovered, and now he has passed away, with no mention of the cause. <http://arstechnica.com/business/2016/08/seymour-papert-theorist-behind-one-…>

1 0

Microsoft Brings ChakraCore to Linux and OS X
by Peter Reutemann 01 Aug '16

01 Aug '16

'A few days ago I wrote about Microsoft's revival of Skype for Linux. I called it "a big deal" -- less because of Skype itself and more because it signified Microsoft's recognition that Linux is a platform worth supporting... Now the company has done it again. At Node Summit this week, Microsoft announced the availability of ChakraCore for Linux. ChakraCore is the core part of the Chakra JavaScript engine that powers Microsoft Edge and Universal Windows Platform. With this move, Microsoft is putting one of its core technologies on a competing platform. This, more than any other Linux-friendly move the company has made, is a clear departure from the Microsoft of Gates and Ballmer that used its technologies to lock users into Windows... While Ubuntu is the primary Linux distribution that Microsoft is using to showcase its ChakraCore technologies, the company said that the support should easily translate to other modern Linux distributions. ' -- source: https://apple.slashdot.org/story/16/07/31/151240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Site Checks Your Browser's Fingerprint
by Peter Reutemann 01 Aug '16

01 Aug '16

'"Does your web browser have a unique fingerprint? If so your web browser could be tracked across websites without techniques such as tracking cookies..." warns a new site created by the University of Adelaide and ACEMS, adding "the anonymization aspects of services such as Tor or VPNs could be negated if sites you visit track you using your browser fingerprint."' -- source: https://yro.slashdot.org/story/16/07/31/1357234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Onion Debian Services Are Now Available
by Peter Reutemann 01 Aug '16

01 Aug '16

'"I just set up a lot of Onion Services for many of Debian's static websites," announced Debian sys-admin Peter "weasel" Palfrader on Friday. "You can find the entire list of services on onion.debian.org. More might come in the future.' -- source: https://linux.slashdot.org/story/16/07/31/0017225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Earth-friendly EOMA68 Computing Devices
by Peter Reutemann 01 Aug '16

01 Aug '16

Interesting concept: 'A new crowdfunding campaign by Rhombus Tech "introduces the world's first devices built around the EOMA68 standard," which separates a "modular" CPU board from the rest of the system so that it can be easily used in multiple devices and upgraded more simply. Rhombus Tech is now offering a 15.6-inch laptop, a laser-cut wooden Micro-Desktop housing, and two types of computer cards, both using A20 dual-core ARM Cortex A7 processors. The cards are available with four flavors of the GNU/Linux operating system, and they're hoping to receive RYF certification from the Free Software Foundation. "No proprietary software," explains their campaign's video. "No backdoors. No spyware. No NDAs." They envision a world where users upgrade their computers by simply popping in a new card -- reducing electronic waste -- or print new laptop casings to repair defects or swap in different colors. (And they also hope to eventually see the cards also working with cameras, phones, tablets, and gaming consoles.' -- source: https://news.slashdot.org/story/16/07/31/0323255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting suggestion
by Peter Reutemann 30 Jul '16

30 Jul '16

Hi everyone William suggested a topic for our next meeting in August: "An introduction to Linux - features, history, examples of popular flavors (Debian, Ubuntu, Red Hat etc). Advantages and disadvantages to Windows." Meetup link: http://www.meetup.com/WaikatoLinuxUsersGroup/events/232676239/ He volunteered to cover a bit of the history (if I remember correctly), but we need others as well to fill in the rest! What do you think? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 10

meeting suggestion
by rowan schischka 29 Jul '16

29 Jul '16

When are these meetings and how can i help? -- Kind Regards Rowan Schischka

2 1

Dark Patterns: User Interfaces Designed To Confuse
by Lawrence D'Oliveiro 28 Jul '16

28 Jul '16

Ever come across websites that seem designed to trick you into paying for things you might not want? <http://arstechnica.com/security/2016/07/dark-patterns-are-designed-to-trick…>

1 0

NIST Says Two-Factor Auth Via SMS Is Not A Good Idea
by rowan schischka 26 Jul '16

26 Jul '16

Regarding two factor sms authentication; I wonder if new Zealands mobile providers are able to be tricked into sending out replacement Sim cards

1 0

NIST Says Two-Factor Auth Via SMS Is Not A Good Idea
by Lawrence D'Oliveiro 25 Jul '16

25 Jul '16

The US National Institute for Standards and Technology is updating its Digital Authentication Guideline <http://www.theregister.co.uk/2016/07/24/nist_says_sms_no_good_for_authentic…>. Responding to recent cases where SMS-based two-factor authentication systems were hijacked to rack up charges on premium-rate phone numbers, it is now saying that sending a text message is no longer good enough. At least the service sending the messages needs to be sure they are going to a real mobile phone. Interestingly, it is posting review documents on GitHub, as an addition to the usual publication channels.

1 0