- wlug - list.wlug.org.nz

Old Ubuntu Bug Lets Malicious Users Gain Sudo Access
by Peter Reutemann 30 Apr '15

30 Apr '15

"Users can change the system clock without authenticating It appears that there's a bug in Ubuntu distributions which lets malicious users locally exploit sudo and gain access to the user's account without knowing their password. The bug was submitted to Canonical's Launchpad back in September 2013 by user Mark Smith." -- source: http://news.softpedia.com/news/An-Old-Ubuntu-Bug-Lets-Malicious-Users-Gain-… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Hard Drive Failure Rates
by Lawrence D'Oliveiro 28 Apr '15

28 Apr '15

BackBlaze have been frequently posting notes on their experience with running large numbers of hard drives in their storage service. Some salient points: * “Enterprise” drives, while more expensive than “consumer” ones, are not significantly more reliable. (This has been borne out by other studies.) * Keep your drives running all the time, or switch them off when not in use? “Our vote is to keep them running.” * They do use SMART to keep an eye on their drives. Other studies I read reported that these only picked up a minority (around 30%) of failures, from which I concluded that SMART was not worth using. I suppose it’s different for these guys if it saves on costs to replace a drive *before* it actually starts reporting uncorrectable errors... <https://www.backblaze.com/blog/hard-drive-stats-faq/>

3 7

meeting tomorrow
by Peter Reutemann 27 Apr '15

27 Apr '15

Hi everyone We have a meeting tomorrow: "Due to the positive feedback on Baden Delamore's demonstration of Kali back in February, there will be a follow up to, delving deeper into the world of (in-)security." http://www.meetup.com/WaikatoLinuxUsersGroup/events/221426689/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Debian 8 Jessie Released
by Peter Reutemann 26 Apr '15

26 Apr '15

"After almost 24 months of constant development, the Debian project is proud to present its new stable version 8 (code name Jessie), which will be supported for the next five years thanks to the combined work of the Debian Security team and the Debian Long Term Support team. (Release notes.) Jessie ships with a new default init system, systemd. The systemd suite provides features such as faster boot times, cgroups for services, and the possibility of isolating part of the services. The sysvinit init system is still available in Jessie. Screenshots and ascreencast are available." -- source: http://linux.slashdot.org/story/15/04/26/0322241 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

The March Of (In)Security
by Lawrence D'Oliveiro 25 Apr '15

25 Apr '15

Bruce Schneier has said “Today's top-secret programs become tomorrow's PhD theses and the next day's hacker tools”. And not long after that, a graduate homework assignment. The NSA was desperate to prevent any exposure of its top-secret “QUANTUM” packet-injection technology. But all this effort was futile, because others had already invented the same thing, including China’s “Great Cannon”, which was used to attack GitHub recently. The only protection is end-to-end encryption. <https://www.schneier.com/blog/archives/2015/04/the_further_dem.html>

1 0

X2Go: An Open Source Remote Desktop Solution For Linux
by Peter Reutemann 23 Apr '15

23 Apr '15

"X2Go is an Open Source remote desktop application for GNU/Linux that uses NX technology protocol. The main difference between X2Go and other remote desktop applications is it provides secure standalone remote desktop sessions via SSH. So, each session connected using X2Go is strongly encrypted and safe. X2Go allows you mainly to connect to Linux systems from Linux, Windows, or Mac OS systems. Also, many clients can simultaneously connect and use single X2Go server. It comes with two components, namely X2Go server and X2Go client. X2Go server is a system that is being accessed from a client system. And, the X2Go is a system which can be used to access the X2Go server. This Client will be able to connect to X2Go server(s) and start, stop, resume and terminate (running) desktop sessions. X2Go Client stores different server connections and may automatically request authentication data from LDAP directories. Furthermore it can be used as fullscreen loginscreen (replacement for loginmanager like xdm)." -- source: http://www.unixmen.com/x2go-an-open-source-remote-desktop-solution-for-linu… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Lubuntu 15.04 released
by Peter Reutemann 23 Apr '15

23 Apr '15

'The developers of the Lubuntu distribution have announced the availability of Lubuntu15.04. Lubuntu is built using packages from the Ubuntu repositories and features the LXDE desktop. This release of Lubuntu offers nine months of support and focuses on minor bug fixes as the development team prepares the distribution for a switch to the newer LXQt desktop environment. "New Features in Lubuntu 15.04: General bug fix release as we prepare for LXQt; Many LXDE components have been updated with bug fix releases; An update of the artwork (more icons, theme update, more compatibilities." Lubuntu is available in two editions, one edition for most desktop computers and an "Alternative" edition for computers featuring less than 400MB of RAM.' -- source: http://distrowatch.com/?newsid=08906 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

8 Linux file managers to try
by Peter Reutemann 23 Apr '15

23 Apr '15

"One of the most common administrative tasks that end users and administrators alike need to perform is file management. Managing files can consume a major portion of your time. Locating files, determining which files and folders (directories) are taking the most disk space, deleting files, moving files, and simply opening files for use in an application are some of the most basic—yet frequent—tasks we do as computer users. File management programs are tools that are intended to streamline and simplify those necessary chores." -- source: http://opensource.com/business/15/4/eight-linux-file-managers My gripes with Caja (MATE's equivalent of Nautilus) is that it cannot handle lots of files in a directory. A directory containing 10s of thousands of files will bring the file browser to a stand still for several minutes. Midnight commander takes less than a second for the same directory. Krusader is pretty good as well, with 1-2 seconds. Nice thing about Krusader: both panels can have multiple tabs, making it quite versatile. Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

3 3

Fedora 23 to Use Wayland and Python 3 by Default, Will Be Released in Fall 2015
by Peter Reutemann 23 Apr '15

23 Apr '15

"The Beta version of the forthcoming Fedora 22 Linux computer operating system was released on April 21, as reported by Softpedia, but it is time now to look at some of the features to be implemented in the next major release of the Red Hat-sponsored distribution, Fedora 23. Therefore, among the highlights announced for Fedora 23, we can mention that the next-generation Wayland display server will be used by default for the Workstation edition, which will most probably be built around the GNOME 3.18 desktop environment. Python 3 will also be used by default in the Workstation edition, and a Vagrant image will be provided for Fedora 23 Atomic Host and Cloud spins. The Vagrant boxes have been designed to be compatible with the Oracle VirtualBox and KVM (Kernel-based Virtual Machine) virtualization software." -- source: http://news.softpedia.com/news/Fedora-23-to-Use-Wayland-and-Python-3-by-Def… Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

2 1

Debian 8.0 “Jessie” To Be Released This Weekend
by Lawrence D'Oliveiro 23 Apr '15

23 Apr '15

Looks like the new version of Debian Stable is in imminent release... <http://www.phoronix.com/scan.php?page=news_item&px=Debian-Jessie-CD-Ready>

1 0

Wi-Fi software security bug could leave Android, Windows, Linux open to attack
by Peter Reutemann 22 Apr '15

22 Apr '15

"In an e-mail today to the Open Source Software Security (oss-security) mailing list, the maintainer of wireless network client code used by Android, the Linux and BSD Unix operating systems, and Windows Wi-Fi device drivers sent an urgent fix to a flaw that could allow attackers to crash devices or even potentially inject malicious software into their memory. The flaw could allow these sorts of attacks via a malicious wireless peer-to-peer network name." -- source: http://bit.ly/1bjWGtn Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174 http://www.data-mining.co.nz/

1 0

Development Activity In LibreOffice Versus OpenOffice
by Lawrence D'Oliveiro 22 Apr '15

22 Apr '15

LWN has a comparison <http://lwn.net/Articles/637735/> of the relative health of the two main OpenOffice forks. Summary: in the last 4½ years, one project has done precisely two releases, while the other has managed over a dozen. In the last year, one has received contributions from just 16 developers, while the other has benefited from the work of around 16 times that number.

2 1

meeting next Monday
by Peter Reutemann 21 Apr '15

21 Apr '15

Hi everyone We have a meeting coming up next Monday: "Due to the positive feedback on Baden Delamore's demonstration of Kali back in February, there will be a follow up to, delving deeper into the world of (in-)security." http://www.meetup.com/WaikatoLinuxUsersGroup/events/221426689/ Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

NCR Unveils Android For ATMs
by Lawrence D'Oliveiro 16 Apr '15

16 Apr '15

NCR is offering an Android-based platform for operating cash machines, called “Kalpana”. Unlike the multiple gigabytes of RAM needed to run Windows, this one only needs a fraction of a gigabyte. The company is also claiming significantly lower maintenance costs. <http://www.theregister.co.uk/2015/04/15/ncr_android_atm/> However, open-source or not, I’m still not convinced the question has been fully answered: what happens to devices running older versions once the vendor drops support?

1 0

NVIDIA’s New Hardware Becoming “Open-Source-Unfriendly”
by Lawrence D'Oliveiro 16 Apr '15

16 Apr '15

NVIDIA, in its desire to stop third parties making hacks to its firmware to enable higher-end features on lower-end hardware, is moving to requiring signed firmware on its newer cards. Some promises made to the Nouveau project (which is developing open-source drivers for NVIDIA cards) have yet to eventuate, leaving them unable to take advantage of features of these cards. <http://www.phoronix.com/scan.php?page=news_item&px=NVIDIA-Unfriendly-OSS-Ha…>

2 1

Controversy Over KDBUS
by Lawrence D'Oliveiro 16 Apr '15

16 Apr '15

KDBUS is the in-kernel implementation of D-BUS, which is a core interprocess communication architecture used to build the GUI in every desktop Linux system today. Putting this code in the kernel provides performance improvements, as well as fixing many limitations that cannot be overcome by userspace-only code. After quite a few years of development, it looked like KDBUS was finally ready for merging into the Linux 4.1 kernel. However, controversy has now erupted. It seems from a look at few of the comments that they are objecting, not to the implementation, but to the protocol, which cannot be changed, otherwise it is no longer a drop-in replacement for D-BUS. <http://www.phoronix.com/scan.php?page=news_item&px=KDBUS-Taking-Heat>

1 0

Elementary OS Freya: A Complete List of Changes and New Features
by Peter Reutemann 15 Apr '15

15 Apr '15

"Based on Ubuntu 14.04 LTS and uses pantheon as the main desktop environment, Elementary OS freya delivers great new features, dozen of improvements, bugfixes, better documentation, updated applications from upstream, and many other goodies that will make your desktop a delight to use every day. Here’s everything you’ll find in the stable version of Elementary OS Freya." -- source: http://ubuntuportal.com/2015/04/elementary-os-freya.html Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

reading files from old applications
by Ian Young 15 Apr '15

15 Apr '15

When all else fails try strings :-) Man strings. The resulting output if any could need a bit of tidying up.I have tried this on the odd older MS Word file when there was no alternative, at least gives an idea of text content. Hmmm. Having said that, I see the fine manual says ' strings is mainly useful for determining the contents of non-text files.'

1 0

The Document Liberation, one year after
by Lawrence D'Oliveiro 14 Apr '15

14 Apr '15

The Document Liberation is an offshoot of The Document Foundation (responsible for LibreOffice) to manage all the handling of proprietary/legacy document formats in a form that can be reused by other projects, not just LibreOffice. I like the name of the framework library they created: “librevenge”--the aim, of course, being to strike a blow against all the companies locking up users’ data in undocumented, proprietary formats which they then abandoned. For example, look at the support for Microsoft Works--anybody else even remember what that was? (Puts hand up.) It’s probably true to say that Open Source software now has better handling of many of these ancient formats than any current product from the companies that originally created those formats. <http://lwn.net/Articles/640198/>

2 2

Linux 4.0 released
by Peter Reutemann 13 Apr '15

13 Apr '15

"So I decided to release 4.0 as per the normal schedule, because there really weren't any known issues, and while I'll be traveling during the end of the upcoming week due to a college visit, I'm hoping that won't affect the merge window very much. We'll see. Linux 4.0 was a pretty small release both in linux-next and in final size, although obviously "small" is all relative. It's still over 10k non-merge commits. But we've definitely had bigger releases (and judging by linux-next v4.1 is going to be one of the bigger ones)." -- source: http://www.linuxtoday.com/developer/linux-4.0-released.html Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

3 2

First Alpha of Public Sector Linux Deployment System
by Peter Reutemann 12 Apr '15

12 Apr '15

"SverigeLinux (SwedenLinux in Swedish) is a project financed by the Swedish Internet Fund that is developing a Linux deployment system for the public sector. It is based on DebianLAN and has just released its first public early alpha version. This 7 minute video shows how you can deploy up to 100 workstations with minimal Linux knowledge in under an hour, complete with DHCP, DNS and user data in LDAP, logins using Kerberos and centralized storage. The project has a home on GitHub and is looking for testers and developers. Don't worry, no Björgen Kjörgen; it's all in English." -- source: http://linux.slashdot.org/story/15/04/12/0354205 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Firefox disables “opportunistic encryption” to fix HTTPS-crippling bug
by Peter Reutemann 08 Apr '15

08 Apr '15

'The "opportunistic encryption" feature added to Firefox last week has been disabled to fix a critical security bug that allowed malicious websites to bypass HTTPS protections, Mozilla officials said.' -- source: http://goo.gl/qP5EJj Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Git This: World's Favorite Software Development Tool Turns 10
by Peter Reutemann 07 Apr '15

07 Apr '15

'Linux today is built faster than ever before. The latest data proves it. This is due to the distributed, global community of developers, IT managers and companies contributing to it every minute of every day. This massive collaboration is made possible with similarly distributed tools, tools like Git. Linus Torvalds 10 years ago today released Git after it was clear BitKeeper was no longer an option for the Linux community. He assessed other existing revision control systems and decided none would do. Ultimately, he decided he would just write a new one, so he went away for a weekend and came back with another hole in one. Most people know Linus created Linux, but many don’t know he is the mastermind behind what has become the most popular revision control system in software development today. If you ask him which is his crowning achievement, he’ll say “do I have to have just one?”' -- source: http://www.linux.com/news/featured-blogs/158-jim-zemlin/821847 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

New Firefox version says “might as well” to encrypting all Web traffic
by Peter Reutemann 01 Apr '15

01 Apr '15

"Developers of the Firefox browser have moved one step closer to an Internet that encrypts all the world's traffic with a new feature that can cryptographically protect connections even when servers don't support the HTTPS protocol." -- source: http://goo.gl/w7hwbR Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

VMware Being Sued For Infringing GPL
by Lawrence D'Oliveiro 28 Mar '15

28 Mar '15

As I understand it, an important part of VMware’s closed-source hypervisor depends on Linux device drivers to communicate with hardware. VMware implemented their own interface, compatible with the Linux one, in order to allow these drivers to work. However, in doing so, they appear to have copied a lot of GPL-licensed code from the actual Linux kernel. There are probably more subtleties to the lawsuit than that, but more details here: <http://lwn.net/Articles/635290/>.

1 0