- wlug - list.wlug.org.nz

The Future of Firefox is Chrome
by Peter Reutemann 13 Apr '16

13 Apr '16

"Mozilla seems to think a new future for Firefox [lies in Chrome]. While they claim that it is only about new ways of browser design, it is also an open secret that they are running into more and more problems lately with web compatibility. [Senior VP Mark Mayo caused a storm by revealing that the Firefox team is working on a next-generation browser that will run on the same technology as Google's Chrome browser. The project, named Tofino, will not use Firefox's core technology, Gecko, but will instead plumb for Electron, which is built on the technology behind Google's rival Chrome browser, called Chromium.] The benefit of Chromium/Electron would be that it is a solution they could pull much faster forward than their own Servo plans [Servo being Mozilla's Rust-based web engine]. What the real outcome of all this will be, only Mozilla knows so far. But inside Mozilla there is much resistance against such plans... Interesting times are ahead." -- source: https://news.slashdot.org/story/16/04/12/2025215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Yes, Badlock bug was shamelessly hyped, but the threat is real
by Peter Reutemann 13 Apr '16

13 Apr '16

"In a nutshell, Badlock refers to a defect in a security component contained in just about every version of the Windows and Linux operating systems. Known as the Distributed Computing Environment/Remote Procedure Call (DCE/RPC), it's used by administrators around the world to access the most valuable asset on any Windows network—the Active Directory, which acts as a network's digital security guard, allowing, for instance, an organization's CFO to log in to an accounting server, while locking out the janitor or the groundskeeper. Because Active Directories enforce security policies and contain password data and other crucial credentials, they are almost always the first asset hackers access once they gain a limited foothold into a targeted network." "An Active Directory infrastructure with a Samba server as a domain member is vulnerable to this flaw," an advisory published Tuesday by Linux distributor Red Hat warned. "A man-in-the-middle attacker could intercept DCE/RPC traffic between the domain member and the domain controller to impersonate the client and get the same privileges as the authenticated user account. The attacker could view or modify secrets within an AD database, including user password hashes, or shutdown critical services." -- source: http://arstechnica.com/security/2016/04/yes-badlock-bug-was-shamelessly-hyp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux-On-Windows Performance
by Lawrence D'Oliveiro 11 Apr '16

11 Apr '16

Some initial benchmarks on the Linux layer that Microsoft has added to Windows 10: <http://www.phoronix.com/scan.php?page=article&item=windows-10-lxcore&num=1>. Summary: CPU performance seems quite good, while I/O is terrible.

1 0

Popular Firefox Add-Ons Open Millions To New Attack
by Peter Reutemann 09 Apr '16

09 Apr '16

'Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary."' 'Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."' -- source: https://it.slashdot.org/story/16/04/09/1758255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Help Shut Down Spam Botnet That Enslaved 4, 000 Linux Machines
by Peter Reutemann 09 Apr '16

09 Apr '16

'A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down. Sophisticated Mumblehard spamming malware flew under the radar for five years. Known as Mumblehard, the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the delisting of any Mumblehard-based IP addresses that sneaked into the real-time composite blocking list, or CBL, maintained by the anti-spam service. "There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots," researchers from security firm Eset wrote in a blog post published Thursday. "If one was found to be blacklisted, this script requested the delisting of the IP address. Such requests are protected with a CAPTCHA to avoid automation, but OCR (or an external service if OCR didn't work) was used to break the protection."' -- source: https://linux.slashdot.org/story/16/04/09/1827238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Warns Of "Uncorrectable Freedom & Security Issues" For x86
by Lawrence D'Oliveiro 05 Apr '16

05 Apr '16

Modern Intel and AMD x86 chips cannot even boot up without various pieces of locked-down proprietary binary firmware. Effectively this is an OS-within-an-OS, that retains ultimate control of the processor, regardless of what the owner of the machine might want. <http://phoronix.com/scan.php?page=news_item&px=x86-Uncorrectable-Freedom>

1 0

Microsoft Windows Linux Take 2
by Lawrence D'Oliveiro 30 Mar '16

30 Mar '16

From <http://arstechnica.com/information-technology/2016/03/ubuntus-bash-and-linu…>: ...we've known for several months now is that the company has developed some Windows kernel components (lxcore.sys, lxss.sys, presumably standing for "Linux core" and "Linux subsystem," respectively) that support the major Linux kernel APIs. ... Microsoft is calling this the "Windows Subsystem for Linux" (WSL). ... Canonical has provided a system image containing the Ubuntu versions of the various command-line tools that are typically found in a Linux distribution. Our understanding is that these are not recompiled or ported versions of the programs (as are used in tools aiming to provide a Unix-like environment on Windows such as Cygwin) but instead unmodified programs. Microsoft is describing this in terms of providing a Linux-like command-line environment at the moment, but from what we can gather, there's little fundamental restriction to this, potentially opening the door to running a wide range of Linux programs natively on Windows. Absolutely nothing to do with the fact that tomorrow is April 1...

1 0

meeting on Monday
by Peter Reutemann 28 Mar '16

28 Mar '16

Hi everyone We have a WLUG meeting on Monday. Unfortunately, there won't be a demonstration of the Raspberry Pi 3 and I'm not sure about the Pine 64 either. http://www.meetup.com/WaikatoLinuxUsersGroup/events/229051656/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

Red Hat Achieves 2 Billion USD In Annual Revenue
by Lawrence D'Oliveiro 23 Mar '16

23 Mar '16

Red Hat has taken just 2 years to double its annual takings <http://phoronix.com/scan.php?page=news_item&px=Red-Hat-Two-Billion>. I remember a senior executive saying some years ago that for every dollar of revenue they get, they take $10 away from their proprietary rivals. So their overall effect on the market is massively deflationary.

1 0

Oracle Versus PostgresQL
by Lawrence D'Oliveiro 21 Mar '16

21 Mar '16

Looks like Russia’s Government departments are looking to move to PostgresQL instead of Oracle. In response, Oracle has released a document trying to point out all the problems with PostgresQL <http://www.theregister.co.uk/2016/03/21/oracle_fights_russian_software_poli…>. First they ignore you, then they laugh at you, then they fight you...

1 0

How to maintain my connection to squeeze
by Chris O'Halloran 12 Mar '16

12 Mar '16

Hi all, I have a server at work that is hacked and customized to bits to keep a wiki going using mediawiki [1] software including node.js [1a] binaries. It was a turneky [2] appliance based on Debian 6 or squeeze. It's work very well these past 6 or 7 years. It also runs a ruby on rails app clockingit.[3] I've installed the anaconda python distribution [4] on it and that is running fine. It was the only way to get python 3.4 running nicely with notebooks. A thing I've been tinkering with lately is the latex circuit package circuitikz [5] for my making nice circuit diagrams and another bit of ipython magics [6] allows you to insert these into your ipython notebooks. I know this keeps putting off the inevitable but I'd rather procrastinate further than rebuild the server. It seems squeeze has experienced some sort of migration to an LTS release even though officially it's not longer supported. The point is, I'd like to sudo apt-get install texlive-science but say it will have problems chris(a)wiki apt/sources.list.d$ sudo apt-get install texlive-science Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: texlive-science : Depends: python2.7 but it is not going to be installed Depends: texlive-base (>= 2015) but it is not going to be installed Depends: texlive-latex-base (>= 2015) but it is not going to be installed Depends: tex-common (>= 6) but 2.08.1 is to be installed Depends: texlive-latex-recommended (>= 2015) but it is not going to be installed Depends: texlive-binaries (>= 2015.20160222.37495-1) but 2009-8 is to be installed E: Broken packages when I do sudo apt-get update Err http://cdn.debian.net squeeze/main amd64 Packages 404 Not Found [IP: 180.214.94.18 80] Err http://cdn.debian.net squeeze/contrib amd64 Packages 404 Not Found [IP: 180.214.94.18 80] Err http://cdn.debian.net squeeze/non-free amd64 Packages 404 Not Found [IP: 128.61.240.89 80] Fetched 39.3 kB in 7s (5257 B/s) W: There is no public key available for the following key IDs: 7638D0442B90D010 W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/main/binary-amd64/Packages.gz 404 Not Found [IP: 180.214.94.18 80] W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/contrib/binary-amd64/Packages.gz 404 Not Found [IP: 180.214.94.18 80] W: Failed to fetch http://cdn.debian.net/debian/dists/squeeze/non-free/binary-amd64/Packages.gz 404 Not Found [IP: 128.61.240.89 80] So is seems I need to update the squeeze sources to still access the old repos. I'm nervous about upgrading because of all the customisations and don't wish to break things. Any clues on how I have have my server still able to download old packages. Cheers Chris [1] http://mediawiki.org/ [1a] https://nodejs.org/en/download/ [2] http://www.turnkeylinux.org/ [3] http://www.clockingit.com/ [4] https://www.continuum.io/downloads [5] http://www.texample.net/tikz/examples/circuitikz/ [6] https://github.com/mkrphys/ipython-tikzmagic

2 2

Former Microsoft CEO No Longer Negatively Attacks Linux
by Lawrence D'Oliveiro 11 Mar '16

11 Mar '16

Interview with Steve Ballmer linked from <http://phoronix.com/scan.php?page=news_item&px=Ballmer-Linux-Cancer-Free>: Fifteen years after calling the open-source operating system Linux a "cancer," former Microsoft Corp (MSFT.O) Chief Executive Steve Ballmer has softened his position. Speaking on Wednesday night at a dinner hosted by Fortune magazine, Ballmer said the position was right for the time, but the threat from Linux was now "in the rearview mirror." Which is why Microsoft is spending more effort than ever on Linux, no doubt...

1 0

Microsoft SQL Server For Linux?
by Lawrence D'Oliveiro 07 Mar '16

07 Mar '16

From <http://arstechnica.com/information-technology/2016/03/sql-server-for-linux-…>: The announcement implies [one of] two things. Either there is a large number of Linux-using corporations out there that are desperate for SQL Server's feature set (as opposed to open source databases such as PostgreSQL, MySQL, or MaxDB, or the proprietary ones such as IBM's DB2 and, of course, Oracle's Oracle), or there is a large number of SQL Server-using organizations out there that are keen to ditch the cost of their Windows licenses but happy to continue to pay for their SQL Server licenses. Neither seems obvious to us. Nor to me...

1 0

Raspberry Pi 3
by William Mckee 02 Mar '16

02 Mar '16

Hello, Raspberry Pi 3 was just released. The highlights of the model: Raspberry Pi 3 - Model B Technical Specification Broadcom BCM2387 chipset 1.2GHz Quad-Core ARM Cortex-A53 802.11 bgn Wireless LAN and Bluetooth 4.1 (Bluetooth Classic and LE) 1GB RAM 64 Bit CPU I think I am most excited about the 64 Bit CPU. What's also amazing is they have kept the same price as the Raspberry Pi 2 - 35 pounds. I'm happy with my Raspberry Pi 2 setup but keen to pick one of these up (still can't get a zero). Blog post: https://www.raspberrypi.org/blog/raspberry-pi-3-on-sale/ cheers, William.

3 7

LibreSSL Unaffected By DROWN
by Peter Reutemann 02 Mar '16

02 Mar '16

"The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL." -- source: http://it.slashdot.org/story/16/03/02/1620221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SCO Is Undeniably, Reliably Dead
by Peter Reutemann 01 Mar '16

01 Mar '16

"On Friday, IBM and SCO filed an agreement with the US district court in Utah to accept a ruling of dismissal of the last remaining claims by SCO against IBM." -- source: http://yro.slashdot.org/story/16/03/01/154214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A Third of All HTTPS Websites Vulnerable To DROWN Attack
by Peter Reutemann 01 Mar '16

01 Mar '16

"The OpenSSL project has released versions 1.0.2g and 1.0.1s to address a high severity security issue known as the DROWN attack (CVE-2016-0800) which allows attackers to break HTTPS and steal encrypted information. In layman terms, the attack uses an improperly patched issue (from 1998) in SSL to attack websites using the more modern TLS protocol. Servers where admins use SSL and TLS are in danger. Additionally, servers where only TLS is used, but the admins are sharing the same certificate for other servers where they have SSL, are also vulnerable, since the attack targets RSA, employed in both SSL and TLS. The entire attack is also easy to carry out, costing only $440 on Amazon EC2." -- source: http://it.slashdot.org/story/16/03/01/1743237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pi used in FM radio transmitters in Syria
by Ian Young 01 Mar '16

01 Mar '16

Hope this is of some interest - not a Pi application I have heard about hitherto. http://www.bbc.com/news/technology-35690688

1 0

OpenShot 2.0 Beta Is Out
by Lawrence D'Oliveiro 29 Feb '16

29 Feb '16

Initial verdict on the results of the crowd-funded development: “The real winners here are Linux users who now have an editor that's on par with Apple's iMovie (even more powerful than recent versions of iMovie) and bears considerable resemblance to the industry-standard Final Cut Pro.” <http://www.theregister.co.uk/2016/02/29/openshot_2_review/>

2 1

Skype On Linux Is Broken
by Lawrence D'Oliveiro 26 Feb '16

26 Feb '16

Seems like the Linux version of Skype has lost the ability to connect with Skype on other platforms. <http://www.theregister.co.uk/2016/02/25/linux_skype_outage_outrage/>

1 0

Linux On Windows?
by Lawrence D'Oliveiro 25 Feb '16

25 Feb '16

Microsoft has abandoned its “Astoria” project to allow Android apps to run essentially unmodified on Windows. <http://arstechnica.com/information-technology/2016/02/microsoft-confirms-an…> Nevertheless, one interesting by-product of this effort remains: Tucked away inside the Windows 10 Insider Preview is a Linux-like operating system. The big question is what Microsoft is actually going to do with it.

1 0

Software Freedom Conservancy: Distributing Linux With ZFS Is Illegal
by Peter Reutemann 25 Feb '16

25 Feb '16

'Phoronix reports that Bradley M. Kuhn and Karen M. Sandler at the Software Freedom Conservancy (SFS) have posted a blog post today arguing that Canonical's plan to distribute Ubuntu 16.04 LTS "Xenial Xerus" with support for the ZFS file system violates the Linux kernel's GPLv2 license. On February 18, Dustin Kirkland at Canonical wrote on his blog: "We at Canonical have conducted a legal review, including discussion with the industry's leading software freedom legal counsel, of the licenses that apply to the Linux kernel and to ZFS. And in doing so, we have concluded that we are acting within the rights granted and in compliance with their terms of both of those licenses...The CDDL cannot apply to the Linux kernel because zfs.ko is a self-contained file system module — the kernel itself is quite obviously not a derivative work of this new file system. And zfs.ko, as a self-contained file system module, is clearly not a derivative work of the Linux kernel but rather quite obviously a derivative work of OpenZFS and OpenSolaris. Equivalent exceptions have existed for many years, for various other stand alone, self-contained, non-GPL kernel modules. Our conclusion is good for Ubuntu users, good for Linux, and good for all of free and open source software." The SFS's blog post of today states: "We are sympathetic to Canonical's frustration in this desire to easily support more features for their users. However, as set out below, we have concluded that their distribution of zfs.ko violates the GPL."' -- source: http://linux.slashdot.org/story/16/02/25/1846230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carnegie Mellon University Attacked Tor, Was Subpoenaed By Feds
by Peter Reutemann 25 Feb '16

25 Feb '16

'Back in November 2015 it was speculated that Carnegie Mellon University (CMU) helped the FBI attack the TOR network. Now, both the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases: "The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU") [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense ("DOD")," an order filed on Tuesday in the case of Brian Farrell reads. Between January and July 2014, a large number of malicious nodes operated on the Tor network, with the purpose, according to the Tor Project, of deanonymising dark web sites and their users. The attack relied on a set of vulnerabilities in the Tor software—which have since been patched—and according to one source, the technique could unmask new hidden services within two weeks.' -- source: http://yro.slashdot.org/story/16/02/25/172245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint Hack Is an Indicator of a Larger Problem
by Peter Reutemann 25 Feb '16

25 Feb '16

"On February 20th, a hacker working under the handle 'Peace' took control of the website of Linux Mint, a popular Linux distribution derived from Ubuntu (and Debian) targeted toward non-technical users and power users unhappy with modern desktop environments. While these attacks are regrettable, and part of an infrastructure problem rather than a problem with the distribution itself, it increasingly appears that the Linux Mint team is spread too thin when it comes to security. The distribution itself blacklists updates that work perfectly in Ubuntu and Debian, and the graphical utilities don't update the kernel. Because the value added by Linux Mint is in Cinnamon, why do the developers need to distribute a broken version of Ubuntu when the Cinnamon DE could be distributed as an Ubuntu spin?" -- source: http://linux.slashdot.org/story/16/02/24/1924229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Virtual Ethernet Bug Delivers Corrupt TCP/IP Data
by Peter Reutemann 22 Feb '16

22 Feb '16

"Vijay Pandurangan from Twitter warns about a Linux kernel bug that causes containers using Virtual Ethernet devices for network routing to not check TCP checksums. Examples of software stacks that use Virtual Ethernet devices are Docker on IPv6, Kubernetes, Google Container Engine and Mesos. The kernel flaw results in applications incorrectly receiving corrupt data in a number of situations, such as with bad networking hardware. The bug dates back at least 3 years or more – it is present in kernels as far back as the Twitter engineering team has tested. Their patch has been reviewed and accepted into the kernel, and is currently being backported to -stable releases back to 3.14 in various distributions. If you use containers in your setup, Pandurangan recommends that you deploy a kernel with this patch." -- source: http://linux.slashdot.org/story/16/02/22/1715202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0