- wlug - list.wlug.org.nz

Systemd Supremo Proposes Tightening up Linux Boot Process
by Peter Reutemann 27 Oct '22

27 Oct '22

'Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images. From a report: Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix. ' -- source: https://it.slashdot.org/story/22/10/26/1743234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Passkeys Are Finally Here
by Peter Reutemann 26 Oct '22

26 Oct '22

'Ars Technica: Generically, passkeys refer to various schemes for storing authenticating information in hardware, a concept that has existed for more than a decade. What's different now is that Microsoft, Apple, Google, and a consortium of other companies have unified around a single passkey standard shepherded by the FIDO Alliance. Not only are passkeys easier for most people to use than passwords; they are also completely resistant to credential phishing, credential stuffing, and similar account takeover attacks. On Monday, PayPal said US-based users would soon have the option of logging in using FIDO-based passkeys, joining Kayak, eBay, Best Buy, CardPointers, and WordPress as online services that will offer the password alternative. In recent months, Microsoft, Apple, and Google have all updated their operating systems and apps to enable passkeys. Passkey support is still spotty. Passkeys stored on iOS or macOS will work on Windows, for instance, but the reverse isn't yet available. In the coming months, all of that should be ironed out, though. Passkeys work almost identically to the FIDO authenticators that allow us to use our phones, laptops, computers, and Yubico or Feitian security keys for multi-factor authentication. Just like the FIDO authenticators stored on these MFA devices, passkeys are invisible and integrate with Face ID, Windows Hello, or other biometric readers offered by device makers. There's no way to retrieve the cryptographic secrets stored in the authenticators short of physically dismantling the device or subjecting it to a jailbreak or rooting attack. Even if an adversary was able to extract the cryptographic secret, they still would have to supply the fingerprint, facial scan, or -- in the absence of biometric capabilities -- the PIN that's associated with the token. What's more, hardware tokens use FIDO's Cross-Device Authentication flow, or CTAP, which relies on Bluetooth Low Energy to verify the authenticating device is in close physical proximity to the device trying to log in. "Users no longer need to enroll each device for each service, which has long been the case for FIDO (and for any public key cryptography)," said Andrew Shikiar, FIDO's executive director and chief marketing officer. "By enabling the private key to be securely synced across an OS cloud, the user needs to only enroll once for a service, and then is essentially pre-enrolled for that service on all of their other devices. This brings better usability for the end-user and -- very significantly -- allows the service provider to start retiring passwords as a means of account recovery and re-enrollment." In other words: "Passkeys just trade WebAuthn cryptographic keys with the website directly," says Ars Review Editor Ron Amadeo. "There's no need for a human to tell a password manager to generate, store, and recall a secret -- that will all happen automatically, with way better secrets than what the old text box supported, and with uniqueness enforced." If you're eager to give passkeys a try, you can use this demo site created by security company Hanko.' -- source: https://yro.slashdot.org/story/22/10/25/1912214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next *Tuesday*
by Peter Reutemann 26 Oct '22

26 Oct '22

Hi everyone We have a meeting next week on Tuesday (not Monday, due to Labour Day) with the following topic: "Ever wondered what Docker was all about? Peter Reutemann will give a hands-on introduction into the tool and show you why it is so useful." Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776731/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Memtest86+ Is Back After 9 Years
by Peter Reutemann 26 Oct '22

26 Oct '22

'Memtest86+ just got its first update after 9 years. The program has reportedly been rewritten from scratch and is back in active development. The new version, 6.0, features a plethora of updates to bring the application up to date, and support the latest system hardware from Intel and AMD. Tom's Hardware reports: For the uninitiated, MemTest86 was originally created back in the mid 1990s, and was one of the earliest DDR memory testing applications for personal computers. But development stopped in 2013 once Memtest86 was split into Memtest86 and Memtest86", with the former being bought by PassMark. Officially, we don't know why development stopped. But compared to the now modern Memtest86, Memtest86+ is the open-source variant. Needless to say, version 6.00 features a lot of updates, which were required to bring it up to modern standards compared to the 2013 version. The new version includes completely rewritten code for UEFI-based motherboards, the modern version of a BIOS, for both 32-bit and 64-bit versions of the application. Furthermore, the application features added support for x64 long mode paging, support for up to 256 cores, added detection for DDR4 and DDR5 memory -- since DDR3 was the latest memory standard in 2013 -- and adds support for XMP version 3.0. CPU support has been significantly enhanced, addingdetection for all pre-Zen and AMD Zen-based processors ranging from the Ryzen 1000 series to 7000 series, and any older parts that were made after 2013. Intel support has also been added for chips up to 13th gen Raptor Lake. Finally, the last patch notes indicate version 6.0 adds support for older Nvidia and AMD chipsets - probably pre-2010 since it mentions Nvidia nForce chipsets, along with numerous bug fixes, optimizations and enhancements.' -- source: https://hardware.slashdot.org/story/22/10/24/2315242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Just When You Thought Y2K Was Done And Dusted ...
by Lawrence D'Oliveiro 25 Oct '22

25 Oct '22

Remember what the whole Y2K issue was like, over a quarter-century ago? And all the work that had to be done to fix it? You’d think that lessons were learned, software developers would be wiser, and henceforth they would always use four digits for year numbers, so that a situation like that would not occur again. Guess again. Recently I hit a situation where a piece of software was *still* using just two digits for year numbers. Basically it was maintaining Certificate Revocation Lists (CRLs) for OpenVPN connections; these have an expiry date, in the form of the “nextupdate” field, to ensure that outdated lists are regularly replaced with fresh ones, to reduce the chance that anybody is inadvertently continuing to use compromised keys. The software in question is pfSense, from Netgate <https://forum.netgate.com/topic/172870/crl-has-expired>. The standard format for these CRLs can handle a full range of dates, but the internal system on pfSense for generating them can only handle years from 1950 to 2049. The generated CRLs were being given validity durations of 9999 days, which was fine up until about August this year, when the expiry date went past 2049, and wrapped around to 1950. On an incoming connection attempt, OpenSSL would check the CRL, find it invalid, and cause OpenVPN to drop the connection. The forum discussion above links to a patch to fix the issue. Only the patch doesn’t really make for a permanent fix: all it does is reduce the assigned validity duration from 9999 days to 730 days; the actual underlying software is still only working with 2-digit year numbers. This gives Netgate a few decades’ breathing room to come up with a proper fix.

2 2

Online Misinformation Monitor Newsletter
by Lawrence D'Oliveiro 20 Oct '22

20 Oct '22

Came across this useful series of monthly reports <https://www.newsguardtech.com/misinformation-monitor/> on how online services are being conduits for spreading misinformation and disinformation. Don’t trust them? Learn to watch out for those who keep insisting they are correct, versus those who are willing to offer reasons why they are correct (and are willing to correct their mistakes) <https://www.newsguardtech.com/about/why-should-you-trust-us/>.

1 0

Firefox 106 Is Now Available With PDF Annotation, Firefox View
by Peter Reutemann 20 Oct '22

20 Oct '22

'Firefox 106 is now available for download, bringing various new features and enhancements, such as a new PDF editing feature and new way to organize recently closed tabs. 9to5Linux reports: Mozilla says that Firefox 106 finally brings the long-anticipated two-finger swipe horizontal gesture for navigating back and forward on a website without having to hold down the Alt key. [...] Firefox 106 also introduces annotation capabilities to the built-in PDF viewer so you can write text, draw, or add signatures on PDF files. You'll be able to change the size and color of the text tool, as well as the thickness, opacity, and color of the draw tool. Another interesting new feature of the Firefox 106 release is called Firefox View, which is implemented as a pinned tab, promising to help you get back to the content you've previously discovered by allowing you to switch seamlessly between your devices running Firefox. On top of all that, Firefox 106 also brings major WebRTC changes to improve Windows and Wayland screen sharing, RTP performance and reliability, statistics, and more. There are also the usual bug and security fixes to make Firefox more stable and reliable on your system. ' -- source: https://news.slashdot.org/story/22/10/19/2053217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Praise of FFmpeg
by Peter Reutemann 19 Oct '22

19 Oct '22

'Drew DeVault, prolific FOSS blogger and hacker behind SourceHut, Sway, wlroots, and many other projects, writes in a blog post: I have relied on ffmpeg for many tasks and for many years. It has always been there to handle any little multimedia-related task I might put it to for personal use -- re-encoding audio files so they fit on my phone, taking clips from videos to share, muxing fonts into mkv files, capturing video from my webcam, live streaming hacking sessions on my own platform, or anything else I can imagine. It formed the foundation of MediaCrush back in the day, where we used it to optimize multimedia files for efficient viewing on the web, back when that was more difficult than "just transcode it to a webm." ffmpeg is notable for being one of the first large-scale FOSS projects to completely eradicate proprietary software in its niche. Virtually all multimedia-related companies rely on ffmpeg to do their heavy lifting. It took a complex problem and solved it, with free software. The book is now closed on multimedia: ffmpeg is the solution to almost all of your problems. And if it's not, you're more likely to patch ffmpeg than to develop something new. The code is accessible and the community are experts in your problem domain. ffmpeg is one of the foremost pillars of achievement in free software. It has touched the lives of every reader, whether they know it or not. If you've ever watched TV, or gone to a movie, or watched videos online, or listened to a podcast, odds are that ffmpeg was involved in making it possible. It is one of the most well-executed and important software projects of all time.' -- source: https://tech.slashdot.org/story/22/10/17/188205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Announces KataOS
by Peter Reutemann 19 Oct '22

19 Oct '22

'Last Friday, Google announced the release of KataOS, a security-minded operating system focused on embedded devices running ambient machine learning workloads. As Phoronix notes, it uses the Rust programming language and is "built atop the seL4 microkernel as its foundatin." From Google's Open-Source Blog: As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability. Through the seL4 CAmkES framework, we're also able to provide statically-defined and analyzable system components. KataOS provides a verifiably-secure platform that protects the user's privacy because it is logically impossible for applications to breach the kernel's hardware security protections and the system components are verifiably secure. KataOS is also implemented almost entirely in Rust, which provides a strong starting point for software security, since it eliminates entire classes of bugs, such as off-by-one errors and buffer overflows. The current GitHub release includes most of the KataOS core pieces, including the frameworks we use for Rust (such as the sel4-sys crate, which provides seL4 syscall APIs), an alternate rootserver written in Rust (needed for dynamic system-wide memory management), and the kernel modifications to seL4 that can reclaim the memory used by the rootserver. KataOS code is being worked on via GitHub under the AmbiML umbrella.' -- source: https://tech.slashdot.org/story/22/10/17/2256206 Someone keen to demo this at one of our next meetings? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds To Kernel Devs: Grow Up and Stop Pulling All-Nighters Just Before Deadline
by Peter Reutemann 19 Oct '22

19 Oct '22

'Linux kernel boss Linus Torvalds has released the first release candidate for version 6.1 of the project and added an appeal for developers to make his life easier by adding code earlier in the development cycle. The Register reports: "Let me just say that after I got my machine sorted out and caught up with the merge window, I was somewhat frustrated with various late pull requests. I've mentioned this before, but it's _really_ quite annoying to get quite a few pull requests in the last few days of the merge window." He then offered further guidance on how kernel devs can do it right. "Yes, the merge window is two weeks, but that's very much to allow me time to look things over, not 'two weeks to hurriedly put together a branch that you send Linus on Friday of the second week'," he wrote. "The whole 'do an all-nighter to get the paper in the day before the deadline' is something that should have gone out the window after high school. Not for kernel development." His next line was: "You know who you are." "Anyway, it's not the first time I've said this, I doubt it will be the last. But maybe more people could take it to heart, ok?" he added, before concluding his post with a slightly non-traditional call for testers to visit Linux's git tree because "The merge window may not be the biggest ever, but it's certainly big enough that the shortlog is much too big to post, and below is just my usual merge log." "For all the gory details, please refer to the git tree."' -- source: https://linux.slashdot.org/story/22/10/17/220230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu's New Terminal 'Ad' is Angering Users
by Peter Reutemann 19 Oct '22

19 Oct '22

'Joey Sneddon, reporting at OMG! Ubuntu: In September I tweeted a screenshot of something unexpected that has started to show up in the terminal when I ran system updates. It didn't enrage me at the time (and it kinda still doesn't) but I did find it a little ... Off. Now, if you're suitably tuned-in to the Linux newswire and/or an avid attendee of social media you'll probably heard about the drama in question. If you haven't, then allow me to... Yes, the furore is over an "ad" for Ubuntu Pro, Canonical's revamped support offering that replaces/augments Ubuntu Advantage (which has been around for many years) that appears in the terminal when managing system updates. Other people are calling it an "ad" (hence quote marks). I prefer the term plug (which, it turns out, some people aren't familiar with; it means to mention something in order to promote it). For although this sentence is technically advertising something, in this case Ubuntu Pro, the offering itself is free for regular users (on up-to five devices). Thus, it's not like this is an "ad" that generates Canonical revenue. It's more akin to a public service announcement to raise awareness.' -- source: https://news.slashdot.org/story/22/10/18/1847203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xv6 Open-Source Teaching OS
by Lawrence D'Oliveiro 17 Oct '22

17 Oct '22

You may know that the MINIX operating system, the inspiration for Linux, was created for teaching purposes (namely, Andrew Tanenbaum’s “Operating Systems” textbook). In the same vein, Xv6 is a newer teaching OS from MIT <https://pdos.csail.mit.edu/6.828/2022/xv6.html>, for use in an undergraduate operating systems course. Originally it was implemented on x86, but now it has moved to RISC-V. The inspiration for Xv6 was the old 6th Edition Unix from Bell Labs from 1975, back when it only ran on DEC PDP-11 processors. This OS version was the subject of the famous “Lions book” <https://en.wikipedia.org/wiki/A_Commentary_on_the_UNIX_Operating_System>, circulation of which was supposed to be restricted to those with licences to the Unix source code. And then with the 7th Edition, AT&T even forbade classroom use of this source code. Nevertheless, the book still spread via, shall we say, samizdat ... The Xv6 GitHub area is here <https://github.com/mit-pdos>.

1 0

Pine64 Announces 'Sub-$10, Linux-Capable' SBC - the Ox64
by Peter Reutemann 17 Oct '22

17 Oct '22

'Pine64 has announced a new "sub $10 Linux capable single board computer" called the Ox64. Liliputing says the tiny SBC "looks a lot like a Raspberry Pi Pico. But while Raspberry Pi's tiny board is powered by an RP2040 microcontroller, the Ox64 has a dual-core RISC-V processor, 64MB of embedded RAM, and support for up to 128Mb of flash storage plus a microSD card for additional storage." It's expected to support RTOS and Linux and blurs the lines between a microcontroller and a (very low power) single-board PC. It's expected to go on sale in November with prices starting at $6 for an RTOS-ready version of the board and $8 for a Linux-compatible model. As spotted by CNX Software earlier this month, the board is designed to be a small, inexpensive single-board computer with a RISC-V processor that's aimed at developers. Pine64's October update also reveals that their Star64 and QuartzPro64 single-board computers "now boot Linux (and run it well too already!)"' -- source: https://news.slashdot.org/story/22/10/15/2314226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bad DIMM on Linus Torvalds' Desktop System Moves Kernel Merges to His Laptop
by Peter Reutemann 17 Oct '22

17 Oct '22

'When a kernel developer asked Linus Torvalds if he'd missed a Git pull, Torvalds "revealed the request was still in his queue as 'I'm doing merges (very slowly) on my laptop, while waiting for new ECC memory DIMMs to arrive,'" reports The Register: Torvalds needs the DIMMs because over the last few days he experienced what he described as "some instability on my main desktop... with random memory corruption in user space resulting in my allmodconfig builds randomly failing with internal compiler errors etc." The Linux boss's first thought was that a new kernel bug had caused the problem — which isn't good but sometimes happens. His instinct was wrong. "It was literally a DIMM going bad in my machine randomly after 2.5 years of it being perfectly stable," he wrote. "Go figure. Verified first by booting an old kernel, and then with memtest86+ overnight." Torvalds appears to have been tracking delivery of the new DIMMs as he reported replacement memory was "out for delivery" and predicted it should arrive later on Sunday evening.... His post also mentions that his main PC was set up for error correction code memory (ECC memory), but "during the early days of COVID when there wasn't any ECC memory available at any sane prices. And then I never got around to fixing it, until I had to detect errors the hard way." "I absolutely *detest* the crazy industry politics and bad vendors that have made ECC memory so 'special'," he added.' -- source: https://linux.slashdot.org/story/22/10/15/2334251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.0 Released for the AmigaOne X1000/X5000 PowerPC-Based AmigaOS Computers
by Peter Reutemann 17 Oct '22

17 Oct '22

'Hyperion Entertainment is pleased to announce the immediate availability of a very substantial and comprehensive update of the Software Development Kit (SDK) for AmigaOS 4.1 54.16. Also Linux: Kernel 6.0 for AmigaOne X1000/X5000 has been released and the biggest Amiga event of the year will be held upcoming weekend in Mönchengladbach, Germany: the Amiga37 event.' -- source: https://linux.slashdot.org/story/22/10/15/2124215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office Rebranding
by Lawrence D'Oliveiro 14 Oct '22

14 Oct '22

I suppose you’ve heard by now that “Microsoft Office” is losing the “Office” part of the name, and becoming “Microsoft 365”. Accompanying this rebranding is a new set of logos <https://arstechnica.com/gadgets/2022/10/rip-to-microsoft-office-henceforth-…>. One thing I notice about them is the gradient shading, shadows and general faux-3D look. Does this mark an end to the “flat” design fad that seems to have become so popular over the last decade? Or does this only apply to the logo branding, not to onscreen icons, UI etc? (In which case, I wonder how their design gurus feel about such a disconnect between those different aspects of the same product.) Of course, I ask this as someone who never stopped being a fan of 3D style ...

1 0

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0

VirtualBox 7.0 adds first ARM Mac client, full encryption, Windows 11 TPM
by Peter Reutemann 12 Oct '22

12 Oct '22

'Nearly four years after its last major release, VirtualBox 7.0 arrives with a… host of new features. Chief among them are Windows 11 support via TPM, EFI Secure Boot support, full encryption for virtual machines, and a few Linux niceties. [...] Linux hosts receive "reworked" screen resizing, along with "initial support" for automatic updating of the Guest Additions inside Linux guests. Perhaps most interesting for Linux hosts is support for DXVK, the Vulkan-based implementation of DirectX layers that allows for running 3D Windows applications in Wine. This provides some parity with Windows hosts, which receive standard DirectX 11 support in this 7.0 release.' -- source: https://arstechnica.com/gadgets/2022/10/virtualbox-7-0-adds-first-arm-mac-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Confirms Alder Lake BIOS Source Code Leaked
by Peter Reutemann 10 Oct '22

10 Oct '22

'Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident: "Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...." The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities.... Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo. ' -- source: https://hardware.slashdot.org/story/22/10/09/2330258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Launches New Free Tier for Its Security-Focused 'Ubuntu Pro'
by Peter Reutemann 10 Oct '22

10 Oct '22

'"Starting with the Ubuntu 16.04 edition and including the later LTS versions, Canonical will offer expanded security coverage for critical, high, and medium Common Vulnerabilities and Exposures (CVEs) to all of Ubuntu's open-source applications and toolchains for ten years," reports ZDNet. "Yes, you read that right, you get security patches not just for the operating system, but for all of Ubuntu's open-source applications for a decade." Most of these are server programs, such as Ansible, Apache Tomcat, Drupal, Nagios, Redis, and WordPress. But, it also includes such developer essentials as Docker, Node.js, phpMyAdmin, Python 2, and Rust. Altogether, Canonical is supporting more than 23,000 packages. Indeed, it's now offering security for, as Mark Shuttleworth, Canonical's CEO, said, "Security coverage to every single package in the Ubuntu distribution." Canonical isn't doing this on its own. It's offering free, improved security in partnership with the security management company Tenable. Robert Huber, Tenable's Chief Security Officer, said, "Ubuntu Pro offers security patch assurance for a broad spectrum of open-source software. Together, we give customers a foundation for trustworthy open source." Beyond ordinary security, Canonical is backporting security fixes from newer application versions. This enables Ubuntu Pro users to use the Ubuntu release of their choice for long-term security without forced upgrades. Happy to keep using Ubuntu 20.04? No problem. You can run it until April 2030. Knock yourself out.... Users can obtain a free personal Ubuntu Pro subscription at ubuntu.com/pro for up to five machines. This free tier is for personal and small-scale commercial use. Mark Shuttleworth, CEO of Ubuntu's parent company company Canonical, explains in a new video that Ubuntu "is now the world's most widely used Linux..." "What makes most proud, though, is that we have found a way to make this available free of charge to anybody for their personal and for small-scale commercial use.... full commercial use for you, and any business you own, on up to five machines."' -- source: https://linux.slashdot.org/story/22/10/09/007217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Court Won’t Order Bad Tenants Facebook Group To Release Information
by Lawrence D'Oliveiro 10 Oct '22

10 Oct '22

A bunch of landlords in NZ were running a Facebook group called “Bad Tenants”, where they were sharing personal details about tenants <https://www.nzherald.co.nz/nz/court-wont-force-bad-tenants-facebook-group-t…>: ... it provides a space for landlords to share personal information about their tenants as a warning to other property owners, essentially blacklisting them. The Privacy Commission and Renters United have stated explicitly that this sharing of private information is against the law. So a tenant named Adam Sheehan took a complaint to the Privacy Commissioner last year, who directed that the group hand over any information they had about him. But they did not comply, and deleted the group. So then he went to court. But the court decided that there was no way they could enforce any decision made against the group. Under the Privacy Act 2020, any individual can request information that any organisation holds about them - whether it's the police, the Ministry of Health or an insurance broker - and they have to supply it. However, because a Facebook group isn't an organisation or an incorporated body, just a group of individuals, there was no one specifically for the tribunal to order to release Sheehan's information. I wonder, when groups or accounts or pages are deleted, does Facebook guarantee that that information really and permanently disappears?

2 1

Matter Smart Home Standard Officially Launches
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Connectivity Standards Alliance and its members that include Apple, Google, Amazon, Samsung, and other smart home manufacturers, today announced the official launch of the Matter 1.0 smart home accessory standard. MacRumors reports: Companies that have agreed to support Matter now have all of the resources that they need to begin implementing Matter into their platforms, so we could see Apple integrating Matter into HomeKit very soon. In fact, iOS 16.1 is already laying the groundwork for Matter, so Matter could be announced with the launch of the update. With the Matter 1.0 launch, authorized test labs are now available for product certification, tools are available, and the open-source reference design SDK is complete. Alliance members with devices that have already been deployed and with plans to update their products with Matter support can do so as soon as their products are certified. The Connectivity Standards Alliance says that the first release of Matter will support a variety of smart home products such as lighting, HVAC controls, window coverings, safety and security sensors, door locks, media devices, controllers, and bridges. "What started as a mission to unravel the complexities of connectivity has resulted in Matter, a single, global IP-based protocol that will fundamentally change the IoT," said Tobin Richardson, President and CEO of the Connectivity Standards Alliance. "This release is the first step on a journey our community and the industry are taking to make the IoT more simple, secure, and valuable no matter who you are or where you live. With global support from companies large and small, today's Matter 1.0 release is more than a milestone for our organization and our members; it is a celebration of what is possible." ' -- source: https://mobile.slashdot.org/story/22/10/04/2145233 Home assistant has support for it: https://www.home-assistant.io/blog/2022/05/29/matter-in-home-assistant-work… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Adafruit’s Cheekmate gets to the bottom (ahem) of chess cheating controversy
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Internet has been abuzz for weeks about a particularly juicy chess cheating controversy that erupted last month. The reigning chess world champion, Magnus Carlsen, lost in the third round to a 19-year-old upstart, Hans Niemann, in what was widely considered to be a shocking upset. Carlsen withdrew from the tournament the next day, and his cryptic comments on Twitter fueled rampant speculation that Niemann had cheated. The fact that Niemann admitted to cheating in online chess matches didn't help his case, but he steadfastly insisted he never cheated in over-the-board games. The fierce debate eventually produced a bizarre viral conspiracy theory that Niemann had used anal beads to receive coded messages during the match. But would that even be possible? The folks at Adafruit Industries were sufficiently intrigued to put the theory to the test—you know, just to get to the bottom of the matter. The result is a prototype device called Cheekmate—because the Adafruit team rightfully loves their punny innuendoes—complete with a step-by-step guide for those who might want to build their own prototype. This device, Adafruit insists, is not for actual cheating: "That would be asinine… in brief, a stain on the sport, but to record for posterior whether this sort of backdoor intrusion is even plausible or just an Internet myth." Lacking any willing human volunteers to test the prototype, they ended up embedding Cheekmate in a big, juicy slab of pork butt.' -- source: https://arstechnica.com/gaming/2022/10/adafruits-cheekmate-gets-to-the-bott… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IceWM Reaches Version 3 After a Mere 25 Years
by Peter Reutemann 06 Oct '22

06 Oct '22

'A new version of a quarter-century-old window manager shows that there's still room for improvement and innovation, even in established, mature tools. The Register reports: IceWM is [...] a traditional stacking window manager allowing you to open, move, and resize windows. It's relatively simple, easy, and quick to learn. By default, it also provides an app launcher and an app switcher, using the familiar Windows 95 model: a hierarchical start menu and a taskbar. If you do a minimal install of openSUSE, you get IceWM. It's also one of the defaults in the lightweight antiX and Absolute Linux distros. With such a relatively simple remit, it's good to see that development is still going on. Version 2.0 appeared late in 2020, removing a legacy protocol and adding a new image rendering engine. Now version 3.0 is out with a whole new feature: tabbed windows. Reminiscent of one of The Reg FOSS desk's favorite OSes, the late and great Be OS, tabbed windows turn the title bar into a tab that is less than the full width of the window. In IceWM 3, this allows you to attach windows together to form one entity that can be moved and sized in a single operation â" but the contents of the different windows can be accessed individually using each one's tab. In other words, it works like browser tabs, but the different windows don't need to be from the same parent application. "IceWM's new tabbed windows are the sort of relatively simple improvement to the very well-established metaphor of window management that this vulture really likes to see: small, elegant, and yet helpful," adds The Register's Liam Proven. "We feel that there's plenty more room for improvement within this space. For instance, very few window managers offer the choice of where the title bar (or tab) is located; on a widescreen, placing them on the side, as wm2 and wmx do, would save valuable vertical pixels."' -- source: https://tech.slashdot.org/story/22/10/05/214241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1