- wlug - list.wlug.org.nz

WLUG Library
by Chris O'Halloran 20 Jul '16

20 Jul '16

Hello all, I'm the holder of the WLUG library but as you're aware I haven't brought it along the meeting much. Would anyone care to be the caretaker of it for a while? I can bring it along to next Monday's meeting. Cheers, Chris

1 1

Meeting next Monday
by Peter Reutemann 20 Jul '16

20 Jul '16

Hi everyone We have a meeting schedule for next Monday: "X11, the most common display server on Linux, is showing its age. Newcomers, like Wayland and Mir are trying to address shortcomings and provide a basis for the future. Let's have a look at what each of the display servers' strengths and weaknesses are." We still need volunteers for presenting the Wayland and Mir? Any takers? More details here: http://www.meetup.com/WaikatoLinuxUsersGroup/events/232209899/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fontconfig How-To
by Lawrence D'Oliveiro 18 Jul '16

18 Jul '16

Quite a handy collection of font configuration tips and tricks at the Arch Linux Wiki <https://wiki.archlinux.org/index.php/Font_configuration>. I regularly come across ArchWiki links in online forums these days...

1 0

Report On Open-Source Sustainability
by Lawrence D'Oliveiro 18 Jul '16

18 Jul '16

Fernando Perez, one of the key developers behind Project Jupyter, has posted a link to a long, detailed report on the workings of Open Source <https://groups.google.com/d/msg/jupyter/SnfWgQ1Hx0E/F5936L-CAgAJ>. If you don’t have time to read the whole thing, there is also an “executive summary” in the form of a series of Twitter postings. Summary summary: getting companies to fund Open-Source projects, even ones that they might depend crucially on, is often a matter of luck.

1 0

Ubuntu Linux Forums Hacked -- IP Address, Username, Email of 2M Accounts Compromised
by Peter Reutemann 16 Jul '16

16 Jul '16

'Canonical announced on Friday that Ubuntu forums have been hacked. The company adds that data such as IP address, username, and email address of over two million users have been compromised. BetaNews reports: Keep in mind, this does not mean that the operating system has experienced a vulnerability or weakness. The only thing affected are the online forums that people use to discuss the OS. Still, such a hack is embarrassing as it happened due to Canonical's failure to install a patch. In a blog post, Jane Silber, Chief Executive Officer, Canonical said, "after some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched."' -- source: https://it.slashdot.org/story/16/07/15/1533236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week?
by Lawrence D'Oliveiro 16 Jul '16

16 Jul '16

“People with older PCs upgraded to Windows 10 and held onto them. Microsoft didn’t expect that number to be so high.” <http://www.theregister.co.uk/2016/07/15/one_in_five_consumers_used_free_win…>

1 0

GNU Nano Fork
by rowan schischka 15 Jul '16

15 Jul '16

from the very end of the article posted: "It seems the argument came down to licensing rules, because an idea of moving Nano to Github was incompatible with the GNU license." Can someone please explain this statement to me? I am completely out of the loop in understanding this. -- Kind Regards Rowan Schischka

2 1

Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data
by Lawrence D'Oliveiro 15 Jul '16

15 Jul '16

You may have heard of the ongoing case where the US FBI is demanding Microsoft turn over data held on servers in Ireland. The US Government is claiming that, because the Irish operation is under the control of Microsoft’s headquarters in the US, that it falls under US jurisdiction and so the company can be compelled to turn over the data with nothing more than a warrant issued by a US court. The appeals court has disagreed <https://www.techdirt.com/articles/20160714/10134734971/huge-win-court-says-…>. The peculiar thing is, there are already international arrangements under which the US can ask the Irish Government to request one of their courts to order the surrender of the data. But they don’t seem to want to do that.

3 3

Microsoft Still “Supporting” Windows RT
by Lawrence D'Oliveiro 15 Jul '16

15 Jul '16

Microsoft blocks a “security hole” on Windows RT tablets that might have allowed users to run alternative operating systems <http://www.theregister.co.uk/2016/07/15/windows_fix_closes_rt_unlock_loopho…>.

2 1

New Skype for Linux client released, built on Web technology
by Peter Reutemann 15 Jul '16

15 Jul '16

'A new Skype for Linux client is now available as an alpha. The Skype client for Linux had been long abandoned—it's stuck on version 4.3, compared to version 7 on Windows—but Microsoft has now belatedly recognized that Skype is at its most desirable when it's available on every platform. To that end, it has created an all-new Skype client. In fact, the new client has two versions. There's a Linux app for users of traditional Linux systems. There's also the Skype Web Client, which is supported in Chrome on Linux and Chromebooks running Chrome OS. Whether using the Web or the standalone app, the core code and capabilities are the same: it's using Chrome's WebRTC support to provide a plugin-free, Web-based Skype client.' -- source: http://arstechnica.com/information-technology/2016/07/skype-for-linux-is-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] puppy or qubes
by Michelle 14 Jul '16

14 Jul '16

After my last post, either that night or early next morning I realized I should have said a thank you to some folk. So to all those that shared information in an effort to help me.....Thank you. People at this LUG may indeed be right about puppy, I don't know. Here is an article about that policeman and puppy and banking: www.itnews.com.au/news/nsw-police-don't-use-windows-for-internet-banking-157767 So going off that article it would seem that any live distro that fits on RAM is safe for banking. Now as for Ian. It is intetesting to at least me. Many/most people don't move away from where they were born/bought up in. wwwpewsocialtrends.org/2008/12/17/who-moves-who-stays-put-wheres-home/ So a person could be getting sh*t from someine online that they babysitted. I find that ironic. No I'm not going off that article but rather family happenings bought me to that article. Anyway .....Ian. After Ian had a go at me last month for no reason: list.Waikato ac.nz/pipermail/wlug/2016-June/014171.html (I hope those two last addresses are correct after the effort it takes to type them on this finicky phone) If a person is bought to court, they never wear a shirt saying 'I am guilty'. Usually the jurry/judge has to go off circumstancial evidence. The most important point with Ian is that he had just had a YELLING RANT. Now when someone finishes a yellining rant, are they most likely to go: 1. Now who can I help or 2. Who will I have a go at next?. So anyway I'm having to type this out on my finicky little phone, because I Haven't had the privilege yet of buying a new computer yet that I know will work. So this isn't his entire post:wlug/2016-June/014171. But you can just go to last month if you're interested. So the next point of interest is that the very next thing that he "says to me' after his attack on me last month was this latest.....um stuff. "NOW WHAT ABOUT TRIMMING THOSE POSTS!!! OTHERWISE I MAY BE FORCED TO DIG OUT SOME ARCHAIC INTERNET ETIQUETTE FAQ AND POST IT IN FULL ALL IN CAPS. Just joshing people. But puhleeze???! A word for Michelle and the quest for perfection. Sometimes in this life there is a dichotomy between what we wish for and what we can actually accomplish. Maybe near enough is good enough. Is there actually such a thing as complete security on the internet? Possibly, but probably not for the average citizen. "You have zero privacy anyway. Get over it." Scott McNealy, formerly of Sun Microsystems. Sad but probably true" So about me and my quest for perfection: UN my post this month I said: "Well I give up. I have tried for months and invested dozens of hours to get a machine that runs qubes and it hasn't happened..... If nobody is prepared to do that it is more than fine . I will just buy a computer that runs a windows legacy os." Now I'm sorry, perhaps I missed the part there about "my quest for perfection ." Saying to to someone there "quest for perfection" well, whether that is taken taken as condescending or resemble depends on who said it, how they said it and when they said it.Vin this cade is was by a guy who had just insulted me and had just come of an angry rant! U think there were other things I wanted to mention about Ian but I can't remember. If I am amazingly wrong about Ian's intentions this time then so be it be he completely bought it upon his own head. On 2016-07-06 20:21, Peter Reutemann wrote: >> On Wed, Jul 6, 2016 at 4:46 PM, Michelle <michelle400(a)orcon.net.nz> >> wrote: >>> Puppy was recommended by a police officer. I think he was doing >>> banking for >>> the police maybe? >> >> Don't trust the filth. Surprised they even realize what Linux is. > > Please keep it civil! > > [...] > >>> So unless someone is willing to help in a hands on way, I don't want >>> anymore >>> help. Thanks anyway. >> >> Suggested it before, will suggest one last time. Show up to Te Ata on >> a Monday or Friday morning and someone from there will help. >> >> I'm sorry I couldn't be of more help but I really tried. Now to trim. > > If you read Michelle's emails again, you will see that she is not well > enough to travel. Therefore your offer is not an option. > > Cheers, Peter

3 4

Still life in Puppy take two
by Ian Young 13 Jul '16

13 Jul '16

Oh dear, what an aberrant keystroke will do. Moving on .... While it is probably mandatory to scorn Puppy, and indeed Puppy is but a pale shadow of its former self post the retirement of Barry Kauler, a few steadfast souls continue to produce useful variants Including one called Slacko. http://slacko.eezy.xyz/notes.php http://blog.puppylinux.com/ I am excited to announce the release of Puppy Linux Slacko 6.3.2. It is available in 32 bit and 64 bit versions. This might be called a bugfix release to Slacko 6.3.0 but it is so much more than that! This is the first ever official puppy to support UEFI booting for both for 32 and 64 bit versions and the same ISO image will boot legacy BIOS PCs as well. And there is so much more that is improved, such as the theming, sound detection, firewall, default application management plus our home grown apps such as pMusic. It is still based on upstream 14.1 but has all the latest security and bugfix updates. There is much more going on here than a point release can convey that is why we have given it 2 points! The official release announcement is available for 32 bit and 64 bit. For more information you can visit the release notes page and the download page. I Hope you enjoy using Slacko! Posted on 22 Jun 2016, 21:22 by 01micko

1 0

Still life in Puppy
by Ian Young 13 Jul '16

13 Jul '16

1 0

Firefox Bringing Rust Code Into Production
by Lawrence D'Oliveiro 13 Jul '16

13 Jul '16

<http://phoronix.com/scan.php?page=news_item&px=Firefox-48-First-Rust-Code> Rust is a programming language that is designed to make it harder to commit the kinds of stuffups that lead to crashes and security bugs. So the proof of the pudding will be whether future versions of Firefox will turn out to be more reliable and secure.

1 0

When man-db goes thug ... help?
by Eric Light 12 Jul '16

12 Jul '16

Hi guys Never seen this before, need a hand. Fairly fresh Debian 8 install, fully updated, running as root. root(a)ROOTCA:~/ca# man opensslroot(a)ROOTCA:~/ca# man -kroot(a)ROOTCA:~/ca# which man/usr/bin/manroot(a)ROOTCA:~/ca# man --helproot(a)ROOTCA:~/ca# ... When I execute man, it doesn't give me anything, and just returns me to the command prompt. Not even man --help will return a response. I've purged and reinstalled man-db, ensured that ncurses-base is installed, even checked the size of man (106912 bytes), and checked dmesg for any segfaults... there's just nothing I can find anywhere. Any ideas? Thanks in advance. E-- Securely sent with Tutanota. It's good, you should try it: https://tutanota.com

2 3

Bye-Bye 32 Bits
by Lawrence D'Oliveiro 12 Jul '16

12 Jul '16

Seems like nobody wants to offer 32-bit Linux builds any more... <http://www.theregister.co.uk/2016/07/05/linux_letting_go_32bit_builds_on_th…>

4 4

MIT Says Their Anonymity Network Is More Secure Than Tor
by Peter Reutemann 12 Jul '16

12 Jul '16

'Following the recent vulnerabilities in Tor, researchers at MIT's Computer Science and Artificial Intelligence Laboratory and the Ecole Polytechnique Federale de Lausanne have been working on a new anonymity network that they say is more secure than Tor. While the researchers are planning to present their new system, dubbed Riffle, at the Privacy Enhancing Technologies Symposium later this month, they did say the system uses existing cryptographic techniques, but in new ways. A series of servers are what make up Riffle, each of which "permutes the order in which it receives messages before passing them on to the next," according to a news release. "For instance, messages from senders Alice, Bob, and Carol reach the first server in the order A, B, C, that server would send them to the second server in a different order -- say C, B, A. The second server would permute them before sending them to the third, and so on." Nobody would know which was which by the time they exited the last server. Both Tor and MIT's anonymity network use onion encryption. Riffle uses a technique called verifiable shuffle in addition to onion encryption to thwart tampering and prevent adversaries from infiltrating servers with their own code. Last but not least, it uses authentication encryption to verify the authenticity of an encrypted message. The researchers say their system provides strong security while using bandwidth much more efficiently than similar solutions.' -- source: https://news.slashdot.org/story/16/07/11/2041203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ODF Versus OOXML
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

A summary of links comparing ODF (the file format native to LibreOffice and OpenOffice) with OOXML (as used in Microsoft’s Office suite): <http://courseweb.ischool.illinois.edu/~stanley8/LIS590DPL/standards/docform…>. Another reason why saving LibreOffice documents in MS Office format may cause formatting trouble (besides the usual inconsistencies that happen with MS Office formatting anyway) is that OOXML cannot actually represent all ODF information correctly.

1 0

GNU Nano Fork
by Lawrence D'Oliveiro 11 Jul '16

11 Jul '16

Some ructions over GNU Nano have led to the creation of yet another tiny text editor <http://www.theregister.co.uk/2016/07/11/in_mourning_for_nano_chap_crafts_1k…>. With regard to this: “Benno also did not want to assign copyright to the FSF for his contributions.” it’s not clear why outfits like the FSF and Ubuntu want you to assign your copyrights to them. The Linux kernel project, for example, doesn’t require it <https://lwn.net/Articles/592503/>.

1 0

HTTPS crypto’s days are numbered. Here’s how Google wants to save it
by Peter Reutemann 09 Jul '16

09 Jul '16

'Like many forms of encryption in use today, HTTPS protections are on the brink of a collapse that could bring down the world as we know it. Hanging in the balance are most encrypted communications sent over the last several decades. On Thursday, Google unveiled an experiment designed to head off, or at least lessen, the catastrophe. In the coming months, Google servers will add a new, experimental cryptographic algorithm to the more established elliptic curve algorithm it has been using for the past few years to help encrypt HTTPS communications. The algorithm—which goes by the wonky name "Ring Learning With Errors"—is a method of exchanging cryptographic keys that's currently considered one of the great new hopes in the age of quantum computing. Like other forms of public key encryption, it allows two parties who have never met to encrypt their communications, making it ideal for Internet usage.' -- source: http://arstechnica.com/security/2016/07/https-crypto-is-on-the-brink-of-col… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mesa 12.0 Released With OpenGL 4.3 Support, Intel Vulkan and More
by Peter Reutemann 09 Jul '16

09 Jul '16

'Mesa3D developers have announced the release of Mesa 12.0. Mesa 12 notably adds open-source OpenGL 4.3 drivers for Intel, Radeon, and NVIDIA on Linux, and it also integrates the previously open-sourced Intel Vulkan graphics API driver. From the Phoronix analysis, "Mesa 12.0 is easily one of the biggest updates to this important open-source user-space OpenGL driver stack in quite some time and will offer much better support and features especially for Intel, Radeon, and NVIDIA open-source Linux desktop users/gamers."' -- source: https://linux.slashdot.org/story/16/07/08/2135213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services
by Peter Reutemann 08 Jul '16

08 Jul '16

'Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: "These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used 'honeypot' .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of 'infowar' weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered)." The Tor project is aware of the attack and is working to redesign its system to try and block it.' -- source: https://yro.slashdot.org/story/16/07/08/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe
by Peter Reutemann 08 Jul '16

08 Jul '16

'Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."' -- source: https://it.slashdot.org/story/16/07/08/145245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android KeyStore Encryption Scheme Broken
by Peter Reutemann 08 Jul '16

08 Jul '16

'The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say.>In an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integrity of keys and could be exploited to allow an attacker to modify stored keys through a forgery attack. KeyStore, which performs key-specific actions through the OpenSSL library, allows Android apps to store and generate their own cryptographic keys. By storing keys in a container, KeyStore makes it more difficult to remove them from the device. Mohamed Sabt and Jacques Traore, two researchers with the French telecom Orange Labs, claim the scheme associated with the system is "non-provably secure," and could have "severe consequences." The two point out in their paper "Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore," that it's the hash-then-encrypt (HtE) authenticated encryption (AE) scheme in cipher block chaining mode (CBC) in KeyStore that fails to guarantee the integrity of keys.' -- source: https://tech.slashdot.org/story/16/07/07/1819233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 million Android phones infected by all-powerful auto-rooting apps
by Peter Reutemann 07 Jul '16

07 Jul '16

"Security experts have documented a disturbing spike in a particularly virulent family of Android malware, with more than 10 million handsets infected and more than 286,000 of them in the US. Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day, displays 20 million malicious advertisements, and generates more than $300,000 per month in revenue. The success is largely the result of the malware's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android. The Check Point researchers have dubbed the malware family "HummingBad," but researchers from mobile security company Lookout say HummingBad is in fact Shedun, a family of auto-rooting malware that came to light last November and had already infected a large number of devices." -- source: http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0