- wlug - list.wlug.org.nz

NFC Flaws Let Researchers Hack an ATM By Waving a Phone
by Peter Reutemann 27 Jun '21

27 Jun '21

'Ars Technica reports: For years, security researchers and cybercriminals have hacked ATMs by using all possible avenues to their innards, from opening a front panel and sticking a thumb drive into a USB port to drilling a hole that exposes internal wiring. Now, one researcher has found a collection of bugs that allow him to hack ATMs -- along with a wide variety of point-of-sale terminals -- in a new way: with a wave of his phone over a contactless credit card reader. Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader -- rather than swipe or insert it -- to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe. Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems' firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash -- though that "jackpotting" hack only works in combination with additional bugs he says he has found in the ATMs' software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors. "You can modify the firmware and change the price to one dollar, for instance, even when the screen shows that you're paying 50 dollars. You can make the device useless, or install a kind of ransomware. There are a lot of possibilities here," says Rodriguez of the point-of-sale attacks he discovered. "If you chain the attack and also send a special payload to an ATM's computer, you can jackpot the ATM -- like cash out, just by tapping your phone." Rodriguez says he alerted the affected vendors -- which include ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and the unnamed ATM vendor -- to his findings between seven months and a year ago. Even so, he warns that the sheer number of affected systems and the fact that many point-of-sale terminals and ATMs don't regularly receive software updates -- and in many cases require physical access to update -- mean that many of those devices likely remain vulnerable. "Patching so many hundreds of thousands of ATMs physically, it's something that would require a lot of time," Rodriguez says.' -- source: https://it.slashdot.org/story/21/06/25/2049217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Admits to Mistakenly Signing a Malicious Malware Rootkit
by Peter Reutemann 27 Jun '21

27 Jun '21

'Bleeping Computer reports: Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control IPs. G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec community in tracing and analyzing the malicious drivers bearing the seal of Microsoft... This incident has once again exposed threats to software supply-chain security, except this time it stemmed from a weakness in Microsoft's code-signing process. G Data writes: We forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation. At the time of writing it is still unknown how the driver could pass the signing process. In a Friday blog post, Microsoft said it was contacting other antivirus software vendors "so they can proactively deploy detections," but also emphasized the attack's limited scope: The actor's activity is limited to the gaming sector specifically in China and does not appear to target enterprise environments. We are not attributing this to a nation-state actor at this time. The actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere. The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers. It's important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf. We will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections. There are no actions customers should take other than follow security best practices and deploy Antivirus software such as Windows Defender for Endpoint.' -- source: https://it.slashdot.org/story/21/06/26/1918225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Photos is so 2020—welcome to the world of self-hosted photo management
by Peter Reutemann 26 Jun '21

26 Jun '21

'We take more photos now than ever before. Growth in this segment is explosive, with over 1.4 trillion photos taken last year, according to InfoTrends. That's up from 1 trillion in 2017. Video is much the same, with YouTube saying in recent years that about 500 hours of video are uploaded to the platform every minute. Finding a solution to organizing and safely storing these precious memories is more important than ever, and it's becoming an increasingly large problem to solve. Photos depict a special moment in time, a memory or event that can't be recreated. They are irreplaceable and largely only exist digitally. Because of this, there are few categories of data that suit a free and open self-hosted solution better.' -- source: https://arstechnica.com/gadgets/2021/06/the-big-alternatives-to-google-phot… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A quick-start guide to OpenZFS native encryption
by Peter Reutemann 25 Jun '21

25 Jun '21

'One of the many features OpenZFS brings to the table is ZFS native encryption. First introduced in OpenZFS 0.8, native encryption allows a system administrator to transparently encrypt data at rest within ZFS itself. This obviates the need for separate tools like LUKS, VeraCrypt, or BitLocker.' -- source: https://arstechnica.com/gadgets/2021/06/a-quick-start-guide-to-openzfs-nati… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Peter Reutemann 25 Jun '21

25 Jun '21

'Network device maker Zyxel is warning customers of active and ongoing attacks that are targeting a range of the company’s firewalls and other types of security appliances. In an email, the company said that targeted devices included security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. The language in the email is terse, but it appears to say that the attacks target devices that are exposed to the Internet. When the attackers succeed in accessing the device, the email further appears to say, they are then able to connect to previously unknown accounts hardwired into the devices.' -- source: https://arstechnica.com/gadgets/2021/06/zyxel-scrambles-to-thwart-active-ha… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“I’m totally screwed.” WD My Book Live users wake up to find their data deleted
by Peter Reutemann 25 Jun '21

25 Jun '21

'Western Digital, maker of the popular My Disk external hard drives, is recommending customers unplug My Disk Live storage devices from the Internet until further notice while company engineers investigate unexplained compromises that have completely wiped data from devices around the world. The mass incidents of disk wiping came to light in this thread on Western Digital’s support forum. So far, there are no reports of deleted data later being restored.' -- source: https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu-maker Canonical Will Support Open Source Blender on Windows, Mac, and Linux
by Peter Reutemann 24 Jun '21

24 Jun '21

'Blender is one of the most important open source projects, as the 3D graphics application suite is used by countless people at home, for business, and in education. The software can be used on many platforms, such as Windows, Mac, and of course, Linux. Today, Ubuntu-maker Canonical announces it will offer paid enterprise support for Blender LTS. Surprisingly, this support will not only be for Ubuntu users. Heck, it isn't even limited to Linux installations. Actually, Canonical will offer this support to Blender LTS users on Windows, Mac, and Linux.' -- source: https://news.slashdot.org/story/21/06/23/1950222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Source AMD FidelityFX Super Resolution Impresses In PC Game Tests
by Peter Reutemann 24 Jun '21

24 Jun '21

'AMD's FidelityFX Super Resolution (FSR) PC graphics up-scaling technology is ready for prime-time and the company has allowed members of the press to showcase performance and visuals of the tech in action with a number of game engines. AMD FidelityFX Super Resolution is vendor-agnostic and doesn't require specialized hardware to function like NVIDIA DLSS, which relies on Tensor cores on-board NVIDIA Turing or Ampere GPUs to accelerate neural network models that have been specifically trained on game engines. In contrast, AMD FSR utilizes more traditional spatial upscaling to create a super resolution image from a single input frame, not multiple frames. AMD FSR then employs a library of open-source algorithms that work on sharpening both image edge and texture detail. In game testing at HotHardware, frame rates can jump dramatically with little to no perceptible reduction in image quality, and the technology even works on many NVIDIA GPUs as well. There are currently 19 titles that are available or planned with support for AMD FSR, but with the open nature of the technology and cross-GPU compatibility, game developers theoretically should have significant incentive for adoption to breath new performance into their game titles.' -- source: https://tech.slashdot.org/story/21/06/22/217251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS replacement distro Rocky Linux’s first general release is out
by Peter Reutemann 22 Jun '21

22 Jun '21

'Rocky Linux—one of at least two new distributions created to fill the void left when CentOS Linux was discontinued by parent corporation Red Hat—announced general availability of Rocky Linux 8.4 today. Rocky Linux 8.4 is binary-compatible with Red Hat Enterprise Linux 8.4, making it possible to run apps designed and tested only for RHEL without RHEL itself.' -- source: https://arstechnica.com/gadgets/2021/06/centos-replacement-distro-rocky-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Begins Testing Sponsors on Some Users' Default Home Page/New Tab Pages
by Peter Reutemann 21 Jun '21

21 Jun '21

'Earlier this year a new support page appeared at support.Mozilla.org describing sponsored shortcuts (or sponsored tiles), "an experimental feature currently being tested by a small percentage of Firefox users in a limited number of markets." Mozilla works with advertising partners to place sponsored tiles on the Firefox default home page (or New Tab page) that would be useful to Firefox users. Mozilla is paid when users click on sponsored tiles.... [W]e only work with advertising partners that meet our privacy standards for Firefox. When you click on a sponsored tile, Firefox sends anonymized technical data to our partner through a Mozilla-owned proxy service. The code for this proxy service is available on GitHub for interested technical audiences. This data does not include any personally identifying information and is only shared when you click on a Sponsored shortcut.... You can disable a specific Sponsored tile... You can also disable Sponsored shortcuts altogether. Describing the as-yet-experimental feature, Engadget wrote a story headlined "Don't freak out: Firefox is testing advertisements in new tabs." These are just the tests, still mainly aimed at fresh installs of the Firefox web browser and always to beta users, before the rollout of sponsored tiles. It does sound like adverts are in the pipe, but it depends on the reaction to Mozilla's initial tests. Mozilla's Jonathan Nightingale says that, last time around, the reaction wasn't as positive as his company hoped. "It didn't go over well," he states. Further, he insists that Firefox won't become "a mess of logos sold to the highest bidder; without user control, without user benefit." Long-time Slashdot reader angryargus says they spotted the feature when they noticed an Ebay advertisement, but appreciated the ability to opt out, and suggested the feature is "an annoying tradeoff off using a browser that's not as directly funded by a search engine."' -- source: https://news.slashdot.org/story/21/06/20/0153218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 21 Jun '21

21 Jun '21

Hi everyone 'New to the version control system git or wanting to share some handy tricks? Lawrence D'Oliveiro will give an introduction to the git command-line and how to manage files with it. After the intro, we will look into how to use github (e.g., forks, pull requests) and github alternatives.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861060/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Standard But Not Open Access: Schematron Author Complains About ISO Paywall
by Lawrence D'Oliveiro 19 Jun '21

19 Jun '21

Not the first time this has happened <https://www.theregister.com/2021/06/18/schematron_standard_paywall/>: a group volunteers to create an open standard, giving freely of their time, get it widely adopted, hand it over to a standards body like ISO to make it “official”, and the latter starts charging for copies of the spec. Note this response from ISO: "Unfortunately, the ISO Central Secretariat does not provide free copies of standards. All ISO Publications derive from the work and contributions of ISO and ISO Members that contain intellectual property of demonstrable economic value.” And how much did ISO pay those contributors for that “intellectual property”? Not a penny.

1 0

Microsoft’s Linux repositories were down for 18+ hours
by Peter Reutemann 19 Jun '21

19 Jun '21

'Yesterday, packages.microsoft.com—the repository from which Microsoft serves software installers for Linux distributions including CentOS, Debian, Fedora, OpenSUSE, and more—went down hard, and it stayed down for around 18 hours. The outage impacted users trying to install .NET Core, Microsoft Teams, Microsoft SQL Server for Linux (yes, that's a thing) and more—as well as Azure's own devops pipelines. We first became aware of the problem Wednesday evening when we saw 404 errors in the output of apt update on an Ubuntu workstation with Microsoft Teams installed. The outage is somewhat better-documented at this .NET Core issue report on Github, with many users from all around the world sharing their experiences and theories. The short version is that the entire repository cluster that serves all Linux packages for Microsoft was completely down—issuing a range of HTTP 404 (content not found) and 500 (Internal Server Error) messages for any URL—for roughly 18 hours. Microsoft engineer Rahul Bhandari confirmed the outage roughly five hours after it was initially reported, with a cryptic comment about the infrastructure team "running into some space issues." Eighteen hours after the issue was detailed, Bhandari said that the mirrors were once again available—although with temporarily degraded performance, likely due to cold caches. In this update, Bhandari said that the original cause of the outage was "a regression in [apt repositories] during some feature migration work that resulted in those packages becoming unavailable on the mirrors." We're still waiting for a comprehensive incident report, since Bhandari's status updates provide clues but no real explanations. The good news: We can confirm that packages.microsoft.com is indeed up once again, and it is serving packages as it should.' -- source: https://arstechnica.com/gadgets/2021/06/microsofts-linux-repositories-were-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Code Trainspotting
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

The item on One News this evening about difficulties bringing in families of skilled workers showed some brief screenshots of some source code. I noticed the identifier “nsown_capable”, and doing a search for this reveals it’s from the Linux kernel <https://elixir.bootlin.com/linux/v3.7/ident/nsown_capable>. Apologies to those bored to tears by this ...

1 0

Smart Contract: Computer Says No
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

Another day, another tale of cryptocurrency failure <https://www.theregister.com/2021/06/17/iron_cryptocoin_titan/>. What’s different about this one is that it involved a “stablecoin”, which is some kind of attempt to reduce the volatility of a cryptocurrency by tying it in part to an actual currency. Note this linkage was only partial, and also involved a “smart contract”. This is a piece of autonomous code that, once let loose, makes its own decisions on what actions are and aren’t allowed. There is a suspicion that the smart contract involved had this line in it: require(_share_price > 0, "Invalid share price"); when it should have been require(_share_price >= 0, "Invalid share price"); and, depending on rounding errors, this could have caused all attempts at redemption to fail if the price fell too low to be distinguished from zero. And unlike regular legal contracts between carbon-based life forms, no court can overrule the operation of a smart contract†. Once it is put into effect, there is no reining it in. If the code is bug-free, you are fine (Do I hear sardonic laughter?). How many dozens of sci-fi stories and movies (both good and bad) have gone over this basic scenario? Do people learn nothing from pulp fiction!? But then again, the company did say "We already queued the fix for this, so people can redeem again at 5pm UTC." so maybe this wasn’t the issue at all. †Probably. None has yet tried.

1 0

Newly discovered Vigilante malware outs software pirates and blocks them
by Peter Reutemann 18 Jun '21

18 Jun '21

'A researcher has uncovered one of the more unusual finds in the annals of malware: booby-trapped files that rat out downloaders and try to prevent unauthorized downloading in the future. The files are available on sites frequented by software pirates. Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server, along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access thepiratebay.com and as many as 1,000 other pirate sites.' -- source: https://arstechnica.com/gadgets/2021/06/newly-discovered-vigilante-malware-… Didn't see that one coming... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Linux Project To Make Android, Chrome OS Harder To Hack
by Peter Reutemann 18 Jun '21

18 Jun '21

'Google said Thursday it's funding a project to increase Linux security by writing parts of the operating system's core in the Rust programming language, a modernization effort that could bolster the security of the internet and smartphones. From a report: If the project succeeds, it'll be possible to add new elements written in Rust into the heart of Linux, called the kernel. Such a change would mark a major technological and cultural shift for an open-source software project that's become foundational to Google's Android and Chrome operating systems as well as vast swaths of the internet. Miguel Ojeda, who's written software used by the Large Hadron Collider particle accelerator and worked on programming language security, is being contracted to write software in Rust for the Linux kernel. Google is paying for the contract, which is being extended through the Internet Security Research Group, a nonprofit that's also made it easier to secure website communications through the Let's Encrypt effort. Adding Rust modules to the Linux kernel would improve security by closing some avenues for hackers can use to attack phones, computers or servers. Since it was launched in 1991, Linux has been written solely in the powerful but old C programming language. The language was developed in 1972 and is more vulnerable to hacks than contemporary programming languages.' -- source: https://linux.slashdot.org/story/21/06/17/185239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Report Finds Phone Network Encryption Was Deliberately Weakened
by Peter Reutemann 18 Jun '21

18 Jun '21

'A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to a new research paper. Motherboard: The paper has sent shockwaves through the encryption community because of what it implies: The researchers believe that the mathematical probability of the weakness being introduced on accident is extremely low. Thus, they speculate that a weakness was intentionally put into the algorithm. After the paper was published, the group that designed the algorithm confirmed this was the case. Researchers from several universities in Europe found that the encryption algorithm GEA-1, which was used in cellphones when the industry adopted GPRS standards in 2G networks, was intentionally designed to include a weakness that at least one cryptography expert sees as a backdoor. The researchers said they obtained two encryption algorithms, GEA-1 and GEA-2, which are proprietary and thus not public, "from a source." They then analyzed them and realized they were vulnerable to attacks that allowed for decryption of all traffic. When trying to reverse-engineer the algorithm, the researchers wrote that (to simplify), they tried to design a similar encryption algorithm using a random number generator often used in cryptography and never came close to creating an encryption scheme as weak as the one actually used: "In a million tries we never even got close to such a weak instance," they wrote. "This implies that the weakness in GEA-1 is unlikely to occur by chance, indicating that the security level of 40 bits is due to export regulations." Researchers dubbed the attack "divide-and-conquer," and said it was "rather straightforward." In short, the attack allows someone who can intercept cellphone data traffic to recover the key used to encrypt the data and then decrypt all traffic. The weakness in GEA-1, the oldest algorithm developed in 1998, is that it provides only 40-bit security. That's what allows an attacker to get the key and decrypt all traffic, according to the researchers.' -- source: https://it.slashdot.org/story/21/06/17/206213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS fans, rejoice—RAIDz expansion will be a thing very soon
by Peter Reutemann 16 Jun '21

16 Jun '21

'OpenZFS founding developer Matthew Ahrens opened a PR for one of the most sought-after features in ZFS history—RAIDz expansion—last week. The new feature allows a ZFS user to expand the size of a single RAIDz vdev. For example, you can use the new feature to turn a three-disk RAIDz1 into a four, five, or six RAIDz1.' -- source: https://arstechnica.com/gadgets/2021/06/raidz-expansion-code-lands-in-openz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting June 28th
by Peter Reutemann 15 Jun '21

15 Jun '21

Hi everyone I'm still looking for a topic for the next WLUG meeting (June 28). After chatting with Lawrence and Ian last night, we were thinking of having a "git" (as in version control) theme: - git basics - Lawrence? - using github (forking, pull requests, etc) - github alternatives How does that sound? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MySQL 101: Installation, care, and feeding on Ubuntu
by Peter Reutemann 14 Jun '21

14 Jun '21

'One of the tasks nearly any sysadmin frequently encounters is the care and feeding of the MySQL database server. You can build an entire career around nothing but this topic—making you a DB admin, not a humble sysadmin like yours truly—but for today, we're just going to cover the basics. For this guide, we're going to be using Ubuntu Linux as the underlying operating system—but most of these steps and tips will be either the same, or broadly similar, across nearly any OS or distribution you might install MySQL on.' -- source: https://arstechnica.com/gadgets/2021/06/mysql-101-installation-care-and-fee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Announces Bold New Changes To Chrome OS Release Cycle
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post this morning, Google announced plans to increase its update cadence for Chromebooks. Like Chrome, its operating system will now also follow a four-week Stable channel before moving to the next major milestone release. Android Police reports: Google will deliver fresh features more rapidly to Chromebooks starting with Chrome OS 96 -- all while keeping it stable, secure, and speedy. To adapt to the rigorous update release schedule, Google will skip Chrome OS 95, which will help it bridge the gap between M94 and Chrome's new four-week rollout strategy. Enterprise and education folks can opt enroll in an Extended Stable option for Chromebooks, which will update every 6 months. In light of the new rollout strategy, Google updated its documentation and pushed an update to its release calendar. The company will share plans about the choices Chrome OS administrators will have for milestone updates "in the coming months." ' -- source: https://tech.slashdot.org/story/21/06/11/2012215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch Released for 7-Year-Old Privilege Escalation Bug In Linux Service Polkit
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post on Thursday, GitHub security researcher Kevin Backhouse announced that Polkit, a Linux system service included in several modern Linux distros that provides an organized way for non-privileged processes to communicate with privileged ones, has been harbouring a major security bug for seven years. The bug, assigned (CVE-2021-3560) allows a non-privileged user to gain administrative shell access with a handful of standard command line tools. The bug was fixed on June 3, 2021 in a coordinated disclosure. "It's used by systemd," GitHub's blog post points out, "so any Linux distribution that uses systemd also uses polkit..." "It's very simple and quick to exploit, so it's important that you update your Linux installations as soon as possible. Any system that has polkit version 0.113 (or later) installed is vulnerable. That includes popular distributions such as RHEL 8 and Ubuntu 20.04."' -- source: https://linux.slashdot.org/story/21/06/12/174231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Tells Anti-Vaxxer To Shut Up On Linux Mailing List
by Peter Reutemann 14 Jun '21

14 Jun '21

'Linus Torvalds was "clearly unamused" by a "humanoid conspiracy theory, and also on its discussion in a Linux kernel topic thread," reports Neowin. They add that Torvalds "weighed in quite heavily with some very strong language, mixed with some biology lessons..." Here's an excerpt from Torvalds' response (as shared by Slashdot reader Hmmmmmm): Please keep your insane and technically incorrect anti-vax comments to yourself. You don't know what you are talking about, you don't know what mRNA is, and you're spreading idiotic lies. Maybe you do so unwittingly, because of bad education. Maybe you do so because you've talked to "experts" or watched youtube videos by charlatans that don't know what they are talking about. But dammit, regardless of where you have gotten your mis-information from, any Linux kernel discussion list isn't going to have your idiotic drivel pass uncontested from me. Vaccines have saved the lives of literally tens of millions of people. Just for your edification in case you are actually willing to be educated: mRNA doesn't change your genetic sequence in any way. It is the exact same intermediate - and temporary - kind of material that your cells generate internally all the time as part of your normal cell processes, and all that the mRNA vaccines do is to add a dose their own specialized sequence that then makes your normal cell machinery generate that spike protein so that your body learns how to recognize it. The half-life of mRNA is a few hours. Any injected mRNA will be all gone from your body in a day or two. It doesn't change anything long-term, except for that natural "your body now knows how to recognize and fight off a new foreign protein" (which then tends to fade over time too, but lasts a lot longer than a few days). And yes, while your body learns to fight off that foreign material, you may feel like shit for a while. That's normal, and it's your natural response to your cells spending resources on learning how to deal with the new threat. And of the vaccines, the mRNA ones are the most modern, and the most targeted - exactly because they do *not* need to have any of the other genetic material that you traditionally have in a vaccine (ie no need for basically the whole - if weakened - bacterial or virus genetic material). So the mRNA vaccines actually have *less* of that foreign material in them than traditional vaccines do. And a *lot* less than the very real and actual COVID-19 virus that is spreading in your neighborhood. Honestly, anybody who has told you differently, and who has told you that it changes your genetic material, is simply uneducated. You need to stop believing the anti-vax lies, and you need to start protecting your family and the people around you. Get vaccinated... Get vaccinated. Stop believing the anti-vax lies. And if you insist on believing in the crazy conspiracy theories, at least SHUT THE HELL UP about it on Linux kernel discussion lists. ' -- source: https://science.slashdot.org/story/21/06/12/2210219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Also Leaving Freenode: FSF, GNU, plus Linux and Python support channels
by Peter Reutemann 14 Jun '21

14 Jun '21

'Freenode's Linux support channel has an official web page at freenode.linux.community, which now bears this announcement: 22+ year old ##linux on freenode has been seized by freenode staff The community's (multi-platform) site reminds visitors of the alternative channels #linux on Libera and Linux.Chat on Discord. But they're not the only ones making changes. "[T]he FSF and GNU have decided to relocate our IRC channels to Libera.Chat," reads an official announcement on the FSF blog. "Effective immediately, Libera is the official home of our channels, which include but are not limited to all those in the #fsf, #gnu, and #libreplanet namespaces." As we have had nearly twenty years of positive experiences with the Freenode staff, most of whom now comprise the staff of the Libera network, we are confident in their technical and interpersonal expertise, as well as their ability to make the network as long-lasting and integral to the free software community as they made Freenode. We look forward to joining the large number of free software and free culture projects who have already made Libera.Chat their home, and hope to stay there for many years to come. Also making a move: freenode's #Python channel. Software developer Ned Batchelder, one of the channel's operators (and also an architect at edX), shared a recent experience in a new blog post this morning. When they'd decided to move #python to the new Libera.chat network (run by former Freenode staffers), they also stayed in Freenode's channel "to let people know where everyone had gone." Yesterday, after a heated debate in the Freenode channel where I was accused of splitting the community, I got k-lined (banned entirely from Freenode). The reason given was "spamming", because of my recurring message about the move to Libera. Then the entire Freenode #python channel was closed... Was it malice or was it mistake? Does it matter? It's not a good way to run a network. After the channel was closed, people asking staff about what happened were banned from asking. That wasn't a mistake... [T]he new staff seems to be using force to silence people asking questions. It's clear that transparency is not a strong value for them. Setting aside network drama, the big picture here is that the Freenode #python community isn't split: it's alive and well. It's just not on Freenode anymore, it's on Libera. Freenode was a good thing. But the domain name of the server was the least important part of it, just a piece of technical trivia. There's no reason to stick with Freenode just because it is called Freenode. As with any way of bringing people together, the important part is the people. If all of the people go someplace else, follow them there, and continue. See you on Libera.' -- source: https://tech.slashdot.org/story/21/06/13/184251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0