- wlug - list.wlug.org.nz

NSA Urges System Administrators To Replace Obsolete TLS Protocols
by Peter Reutemann 22 Jan '21

22 Jan '21

'The US National Security Agency has issued a security advisory this month urging system administrators in federal agencies and beyond to stop using old and obsolete TLS protocols. From a report: "NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used," the agency said. "Using obsolete encryption provides a false sense of security because it seems as though sensitive data is protected, even though it really is not," the agency added. Even if TLS 1.2 and TLS 1.3 are deployed, the NSA warns against configuring these two protocols with weak cryptographic parameters and cipher suites.' -- source: https://tech.slashdot.org/story/21/01/21/1646211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leave.EU Stays In The EU
by Lawrence D'Oliveiro 21 Jan '21

21 Jan '21

The domain that was registered by Brexiteers to promote their campaign for the UK to leave the EU has been re-domiciled to an address in the EU <https://www.theregister.com/2021/01/08/leave_eu_domain_name_hilarity/>. This is because of rule changes that mean UK-based entities are no longer entitled to register .eu names. So if the site wants to stay up under that name, it cannot, contrary to its own name, leave the EU. Just to add to the fun, the individual in the Republic of Ireland who is named on the domain registration claims to know nothing about it, and says he “will be looking into the matter”.

3 3

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Wine 6.0 Released
by Peter Reutemann 20 Jan '21

20 Jan '21

'Wine 6.0 has been released today and contains over 8,300 changes, according to its full release notes. Windows Central reports: The new release of version 6.0 has thousands of changes, but Wine's website highlights some of the biggest improvements: Core modules in PE format; Vulkan backend for WineD3D; DirectShow and Media Foundation support; and Text console redesign. The full release notes for Wine 6.0 explain that the core DLLs, which include NTDLL, KERNEL32, GDI32, and USER32 are now built in the Portable Executable (PE) format. As a result, people should see improvements for certain copy protection schemes. The update also includes a new mechanism to associate a Unix library with the PE module. This change makes it so systems can call Unix libraries from PE when trying to perform a function that can't be handled by Win32 APIs. Wine 6.0 also includes an experimental Vulkan rendered that translates Direct3D shaders to SPIR-V shaders. In another change related to Direct3D, the Direct3D graphics card database now recognizes more graphics cards and includes updated driver versions. ' -- source: https://tech.slashdot.org/story/21/01/19/039257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Becomes First Browser To Add Native Support For the IPFS Protocol
by Peter Reutemann 20 Jan '21

20 Jan '21

'With the release of Brave 1.19 today, Brave has become the first major browser maker to support IPFS, a peer-to-peer protocol meant for accessing decentralized or censored content. From a report: Released in 2015, IPFS stands for InterPlanetary File System. It is a classic peer-to-peer protocol similar to BitTorrent and designed to work as a decentralized storage system. IPFS allows users to host content distributed across hundreds or thousands of systems, which can be public IPFS gateways or private IPFS nodes. Users who want to access any of this content must enter an URL in the form of ipfs://{content_hash_ID}. Under normal circumstances, users would download this content from the nearest nodes or gateways rather than a central server. However, this only works if users have installed an IPFS desktop app or a browser extension. Brave says that with version 1.19, users will be able to access URLs that start with ipfs://, directly from the browser, with no extension needed, and that Brave will natively support ipfs:// links going forward. Since some major websites like Wikipedia have IPFS versions, users in oppressive countries can now use Brave's new IPFS support to go around national firewalls and access content that might be blocked inside their country for political reasons and is available via IPFS.' -- source: https://it.slashdot.org/story/21/01/19/2015252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye Releases Tool For Auditing Networks for Techniques Used by SolarWinds Hackers
by Peter Reutemann 20 Jan '21

20 Jan '21

'Cybersecurity firm FireEye has released today a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached. From a report: Together with the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks. Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike. The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.' -- source: https://tech.slashdot.org/story/21/01/19/2023209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The NSA warns enterprises to beware of third-party DNS resolvers
by Peter Reutemann 19 Jan '21

19 Jan '21

'DNS over HTTPS is a new protocol that protects domain-lookup traffic from eavesdropping and manipulation by malicious parties. Rather than an end-user device communicating with a DNS server over a plaintext channel—as DNS has done for more than three decades—DoH, as DNS over HTTPS is known, encrypts requests and responses using the same encryption websites rely on to send and receive HTTPS traffic. Using DoH or a similar protocol known as DoT—short for DNS over TLS—is a no brainer in 2021, since DNS traffic can be every bit as sensitive as any other data sent over the Internet. On Thursday, however, the National Security Agency said in some cases Fortune 500 companies, large government agencies, and other enterprise users are better off not using it. The reason: the same encryption that thwarts malicious third parties can hamper engineers’ efforts to secure their networks. “DoH provides the benefit of encrypted DNS transactions, but it can also bring issues to enterprises, including a false sense of security, bypassing of DNS monitoring and protections, concerns for internal network configurations and information, and exploitation of upstream DNS traffic,” NSA officials wrote in published recommendations. “In some cases, individual client applications may enable DoH using external resolvers, causing some of these issues automatically.”' -- source: https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocat Author Gets Insanely Fast Backing To Build P2P Tech For Social Media
by Peter Reutemann 19 Jan '21

19 Jan '21

'TechCrunch: The idea for Capsule started with a tweet about reinventing social media. A day later cryptography researcher, Nadim Kobeissi -- best known for authoring the open-source E2E-encrypted desktop chat app Cryptocat (now discontinued) -- had pulled in a pre-seed investment of $100,000 for his lightweight mesh-networked microservices concept, with support coming from angel investor and former Coinbase CTO Balaji Srinivasan, William J. Pulte and Wamda Capital. The nascent startup has a post-money valuation on paper of $10 million, according to Kobeissi, who is working on the prototype -- hoping to launch an MVP of Capsule in March (as a web app), after which he intends to raise a seed round (targeting $1 million-$1.5 million) to build out a team and start developing mobile apps. For now there's nothing to see beyond Capsule's landing page and a pitch deck (which he shared with TechCrunch for review). But Kobeissi says he was startled by the level of interest in the concept. "I posted that tweet and the expectation that I had was that basically 60 people max would retweet it and then maybe I'll set up a Kickstarter," he tells us. Instead the tweet "just completely exploded" and he found himself raising $100,000 "in a single day" -- with $50,000 paid in there and then. "I'm not a startup guy. I've been running a business based on consulting and based on academic R&D services," he continues. "But by the end of the day -- last Sunday, eight days ago -- I was running a Delaware corporation valued at $10 million with $100,000 in pre-seed funding, which is insane. Completely insane."' -- source: https://news.slashdot.org/story/21/01/18/2144252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenWRT Forum User Data Stolen In Weekend Data Breach
by Peter Reutemann 19 Jan '21

19 Jan '21

'The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach over the weekend. Bleeping Computer reports: The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access to and copied a list with details about forum users and related statistical information. The intruder used the account of an OpenWRT administrator. Although the account had "a good password," additional security provided by two-factor authentication (2FA) was not active. Email addresses and handles of the forum users have been stolen, the moderators say. They add that they believe the attacker was not able to download the forum database, meaning that passwords should be safe. However, they reset all the passwords on the forum just to be on the safe side and invalidated all the API keys used for project development processes. Users have to set the new password manually from the login menu by providing their user name and following the "get a new password" instructions. Those logging in using GitHub credentials are advised to reset or refresh it. The OpenWRT forum credentials are separate from the Wiki. Currently, there is no suspicion that the Wiki credentials have been compromised in any way. OpenWRT forum administrators warn that since this breach exposed email addresses, users may become targets of credible phishing attempts. ' -- source: https://it.slashdot.org/story/21/01/18/2148210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Surpasses 100 Million Daily Search Queries For the First Time
by Peter Reutemann 19 Jan '21

19 Jan '21

'Privacy-focused search engine DuckDuckGo reached a major milestone in its 12-year-old history last week when it recorded on Monday its first-ever day with more than 100 million user search queries. From a report: The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month on a regular basis. The numbers are small in comparison to Google's 5 billion daily search queries but it's a positive sign that users are looking for alternatives. DuckDuckGo's popularity comes after the search engine has expanded beyond its own site and now currently offers mobile apps for Android and iOS, but also a dedicated Chrome extension. More than 4 million users installed these apps and extension, the company said in a tweet in September 2020.' -- source: https://tech.slashdot.org/story/21/01/18/1450258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 18 Jan '21

18 Jan '21

Hi everyone Just a reminder that our AGM is coming up next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Tim Berners-Lee Will Fix the Internet
by Peter Reutemann 18 Jan '21

18 Jan '21

'"Sir Tim Berners-Lee, the British computer scientist who was knighted for inventing the internet navigation system known as the World Wide Web, wants to re-make cyberspace once again," reports Reuters: With a new startup called Inrupt, Berners-Lee aims to fix some of the problems that have handicapped the so-called open web in an age of huge, closed platforms such as Facebook. Building on ideas developed by an open-source software project called Solid, Inrupt promises a web where people can use a single sign-on for any service and personal data is stored in "pods," or personal online data stores, controlled by the user. "People are fed up with the lack of controls, the silos," said Berners-Lee, co-founder and chief technology officer of Inrupt, in an interview at the Reuters Next conference... John Bruce, a veteran technology executive who is CEO of Inrupt, said the company had signed up Britain's National Health Service, the BBC and the government of Flanders in Belgium as pilot customers, and hoped to announce many more by April... A key aim for Inrupt is to get software developers to write programs for the platform. Inrupt, like the original web, is at its core mostly a set of protocols for how machines talk to one another, meaning that specific applications bring it to life. "The use cases are so broad, it's like a do-over for the web," Berners-Lee said. In a video interview, Berners-Lee tells Reuters that what people are worried about isn't privacy per se but "the lack of empowerment" — for example, to collaborate with people. And then he acknowledges that the worldwide web does suffer from limited access control. "I wanted it to be a collaborative space, but in a way that was naive, because collaborative spaces you need to be private. You need to start off with just a limited sharing, and then you allow the sharing to increase." Social networks provided some features like a unique login and identity. But unfortunately, then "The large social networks will tend to get larger" — and ultimately without a single global signon, users then become trapped in separate silos.' -- source: https://tech.slashdot.org/story/21/01/16/2336244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Jamie Zawinski Calls Cinnamon Screensaver Lock-Bypass Bug 'Unconscionable'
by Peter Reutemann 18 Jan '21

18 Jan '21

'Legendary programmer Jamie Zawinski has worked on everything from the earliest releases of the Netscape Navigator browser to XEmacs, Mozilla, and, of course, the XScreenSaver project. Now Slashdot reader e432776 writes: JWZ continues to track issues with screensavers on Linux (since 2004!), and discusses a new bug in cinnamon-screensaver. Long-standing topics like X11, developer interaction, and code licensing all feature. Solutions to these long-standing issues remain elusive. Jamie titled his blog post "I told you so, 2021 edition": You will recall that in 2004 , which is now seventeen years ago, I wrote a document explaining why I made the design trade-offs that I did in XScreenSaver, and in that document I predicted this exact bug as my example of, "this is what will happen if you don't do it this way." And they went and made that happen. Repeatedly. Every time this bug is re-introduced, someone pipes up and says something like, "So what, it was a bug, they've fixed it." That's really missing the point. The point is not that such a bug existed, but that such a bug was even possible. The real bug here is that the design of the system even permits this class of bug. It is unconscionable that someone designing a critical piece of security infrastructure would design the system in such a way that it does not fail safe . Especially when I have given them nearly 30 years of prior art demonstrating how to do it right, and a two-decades-old document clearly explaining What Not To Do that coincidentally used this very bug as its illustrative strawman! These bugs are a shameful embarrassment of design -- as opposed to merely bad code... ZDNet reports that Linux Mint has issued a patch for Cinnamon that fixes the screensaver bug. But HotHardware notes that it was discovered when "one Dad let the kids play with the keyboard. This button-mashing actually crashed the machine's screensaver by sheer luck, allowing them onto the desktop, ultimately leading to the discovery of a high priority security vulnerability for the Linux Mint team." But that's not the only thing bothering Jamie Zawinski: Just to add insult to injury, it has recently come to my attention that not only are Gnome-screensaver, Mint-screensaver and Cinnamon-screensaver buggy and insecure dumpster fires, but they are also in violation of my license and infringing my copyright. XScreenSaver was released under the BSD license, one of the oldest and most permissive of the free software licenses. It turns out, the Gnome-screensaver authors copied large parts of XScreenSaver into their program, removed the BSD license and slapped a GPL license on my code instead -- and also removed my name. Rude... Mint-screensaver and Cinnamon-screensaver, being forks and descendants of Gnome-screensaver, have inherited this license violation and continue to perpetuate it. Every Linux distro is shipping this copyright- and license-infringing code. I eagerly await hearing how they're going to make this right.' -- source: https://tech.slashdot.org/story/21/01/17/0024243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With Jon “maddog” Hall
by Lawrence D'Oliveiro 17 Jan '21

17 Jan '21

Been watching this nearly-hour-long conversation <https://www.youtube.com/watch?v=EZMA3Ge144U> with Jon “maddog” Hall, who if you don’t know him, was very likely the inspiration for the famous Dilbert cartoon featuring the Unix-using neckbeard telling the corporate jobsworth to “get a better computer” <https://dilbert.com/strip/1995-06-24>. Seems that there were several round-number anniversaries related to Unix coming due in 2019 (the year after the video was made), including the 50th anniversary of its creation at Bell Labs. After an early career on IBM mainframe equipment, maddog got a job as a sysadmin at Bell Labs, where he was introduced to Unix. Then he did various different jobs over many years at DEC. At about the half-hour mark, he talks about how he met Linus Torvalds, and asked the latter about porting his still-only-32-bit x86-only fledgling Linux kernel onto the 64-bit Alpha architecture. Linus wanted to do this, but he couldn’t get an Alpha machine from the Helsinki DEC office. So maddog went to bat, pulled a few strings, and got one for him. And it took just 9 months to take Linux from being x86-only and 32-bit-only to being cross-platform and 64-bit-native.

1 0

Windows 10 Bug Corrupts Your Hard Drive On Seeing This File's Icon
by Peter Reutemann 15 Jan '21

15 Jan '21

'An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. Bleeping Computer reports: In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. [...] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file's icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, "restart to repair hard drive" notifications start popping up on the Windows PC -- all this without the user even having opened or double-clicked on the shortcut file. ' -- source: https://hardware.slashdot.org/story/21/01/14/232238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BeagleV is a $150 RISC-V Computer Designed To Run Linux
by Peter Reutemann 15 Jan '21

15 Jan '21

'Seeed Studios -- the makers of the Odyssey mini-PC -- have teamed up with well-known SBC vendor BeagleBoard to produce an affordable RISC-V system designed to run Linux. The new BeagleV (pronounced "Beagle Five") system features a dual-core, 1GHz RISC-V CPU made by StarFive -- one of a network of RISC-V startups created by better-known RISC-V vendor SiFive. The CPU is based on two of SiFive's U74 Standard Cores -- and unlike simpler microcontroller-only designs, it features a MMU and all the other trimmings necessary to run full-fledged modern operating systems such as Linux distributions. StarFive's VIC7100 processor design is aimed at edge AI tasks as well as general-purpose computing. In addition to the two RISC-V CPU cores, it features a Tensilica Vision VP6 DSP for machine-vision applications, a Neural Network Engine, and a single-core NVDLA (Nvidia Deep Learning Accelerator) engine.' -- source: https://hardware.slashdot.org/story/21/01/13/1928249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Reveals Sophisticated Windows and Android Hacking Operation
by Peter Reutemann 15 Jan '21

15 Jan '21

'Google published a six-part report this week detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices. >From a report: The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said. "One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts. Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices. The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.' -- source: https://tech.slashdot.org/story/21/01/14/1610220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10X for Single Screens Leaks
by Peter Reutemann 15 Jan '21

15 Jan '21

'Just ahead of its launch for commercial PC-like devices, an install image of Windows 10X for single screens has leaked, giving us an early peek at Microsoft's new OS. And yes, it's just like Chrome OS. From a report: Let's just get that out of the way. Microsoft has been working for years on a Chromebook competitor, but it has been largely unsuccessful. Windows 10 S, which was originally called Windows 10 Cloud, was Terry Myerson's approach, and that, of course, crashed and burned, in part because it looked identical to Windows 10 but couldn't run downloaded Windows 10 desktop applications. And now we have Windows 10X. Microsoft tried to hide its true intent with this product by pretending last year that it was aimed at a new generation of dual-display PCs, but the software giant really created 10X to compete with Chrome OS on inexpensive single-display PCs. So after failing to get its container-based Windows desktop application compatibility solution to work, Microsoft scaled back and repositioned Windows 10X as was originally intended: It will now ship only on new traditional PCs aimed at education and other commercial markets.' -- source: https://tech.slashdot.org/story/21/01/14/1657218 Wouldn't be surprised if they got bitten again by not having separate kernel/window manager architecture in Windows... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Foundation Now Offers a Suite of Open-Source Management Classes
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Linux Foundation has new courses to help you manage open-source projects and technical staff within your organization. Steven J. Vaughan-Nichols writes via ZDNet: Previously, if you want to know how to run open-source well in your company, you had to work with OASIS Open or the TODO Group. Both are non-profit organizations supporting best open source and open standards practices. But, to work with either group, effectively, you already had to know a lot about open source. [...] This 7-module course series is designed to help executives, managers, software developers, and engineers understand the basic concepts for building effective open-source practices. It's also helpful to those in the C suite who want to set up effective open-source program management, including how to create an Open Source Program Office (OSPO). The program builds on the accumulated wisdom of many previous training modules on open-source best practices while adding fresh and updated content to explain all of the critical elements of working effectively with open source in enterprises. The courses are designed to be self-paced, and reasonably high-level, but with enough detail to get new open-source practitioners up and running quickly. Guy Martin, OASIS Open's executive director, developed these courses. Martin knows his way around open source. He has a unique blend of over 25 years' experience both as a software engineer and open-source strategist. Marin has helped build open-source programs at Red Hat, Samsung, and Autodesk. He was also instrumental in founding the Academy Software Foundation, the Open Connectivity Foundation, and has contributed to TODO Group's best practices and learning guides. The "Open Source Management & Strategy program" costs $499 and is available to begin immediately. A certificate is awarded upon completion.' -- source: https://news.slashdot.org/story/21/01/13/2023236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Discusses Vendoring -- Again
by Peter Reutemann 14 Jan '21

14 Jan '21

'Jake Edge, writing at LWN: The problems with "vendoring" in packages -- bundling dependencies rather than getting them from other packages -- seems to crop up frequently these days. We looked at Debian's concerns about packaging Kubernetes and its myriad of Go dependencies back in October. A more recent discussion in that distribution's community looks at another famously dependency-heavy ecosystem: JavaScript libraries from the npm repository. Even C-based ecosystems are not immune to the problem, as we saw with iproute2 and libbpf back in November; the discussion of vendoring seems likely to recur over the coming years. Many application projects, particularly those written in languages like JavaScript, PHP, and Go, tend to have a rather large pile of dependencies. These projects typically simply download specific versions of the needed dependencies at build time. This works well for fast-moving projects using collections of fast-moving libraries and frameworks, but it works rather less well for traditional Linux distributions. So distribution projects have been trying to figure out how best to incorporate these types of applications. This time around, Raphael Hertzog raised the issue with regard to the Greenbone Security Assistant (gsa), which provides a web front-end to the OpenVAS vulnerability scanner (which is now known as Greenbone Vulnerability Management or gvm). "the version currently in Debian no longer works with the latest gvm so we have to update it to the latest upstream release... but the latest upstream release has significant changes, in particular it now relies on yarn or npm from the node ecosystem to download all the node modules that it needs (and there are many of them, and there's no way that we will package them individually). The Debian policy forbids download during the build so we can't run the upstream build system as is." Hertzog suggested three possible solutions: collecting all of the dependencies into the Debian source package (though there would be problems creating the copyright file), moving the package to the contrib repository and adding a post-install step to download the dependencies, or removing gsa from Debian entirely. He is working on updating gsa as part of his work on Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has, so the Kali gsa package can simply use the upstream build process. He would prefer to keep gsa in Debian, "but there's only so much busy-work that I'm willing to do to achieve this goal". He wondered if it made more sense for Debian to consider relaxing its requirements. But Jonas Smedegaard offered another possible approach: analyzing what packages are needed by gsa and then either using existing Debian packages for those dependencies or creating new ones for those that are not available. Hertzog was convinced that wouldn't be done, but Smedegaard said that the JavaScript team is already working on that process for multiple projects.' -- source: https://linux.slashdot.org/story/21/01/13/1744228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WhatsApp Clarifies It's Not Giving All Your Data To Facebook
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Verge: WhatsApp has published a new FAQ page to its website outlining its stances on user privacy in response to widespread backlash over an upcoming privacy policy update. The core issue relates to WhatsApp's data-sharing procedures with Facebook, with many users concerned an updated privacy policy going into effect on February 8th will mandate sharing of sensitive profile information with WhatsApp's parent company. That isn't true -- the update has nothing to do with consumer chats or profile data, and instead the change is designed to outline how businesses who use WhatsApp for customer service may store logs of its chats on Facebook servers. That's something the company feels it is required to disclose in its privacy policy, which it's now doing after previewing the upcoming changes to business chats back in October. But a wave of misinformation on social media, not helped by Facebook's abysmal track record on privacy and its reputation for obfuscating changes to its various terms of service agreements, has resulted in a full-blown WhatsApp backlash that has users fleeing to competitors like Signal and Telegram. [...] WhatsApp executives, as well as Instagram chief Adam Mosseri and Facebook AR / VR head Andrew "Boz" Bosworth, are now trying to set the record straight, perhaps to little avail at this point. "We want to be clear that the policy update does not affect the privacy of your messages with friends or family in any way. Instead, this update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how we collect and use data," the company writes on the new FAQ page. It also stresses in the FAQ that neither Facebook nor WhatsApp read users' message logs or listen to their calls, and that WhatsApp doesn't store user location data or share contact information with Facebook. (It's also worth noting that data sharing with Facebook is extremely limited for European users due to stronger user privacy protections in the EU.) WhatsApp chief Will Cathcart also took to Twitter a few days ago to post a thread (later shared by Bosworth in the tweet above) trying to cut through the confusion and explain what's actually going on. "With end-to-end encryption, we cannot see your private chats or calls and neither can Facebook. We're committed to this technology and committed to defending it globally," Cathcart wrote. "It's important for us to be clear this update describes business communication and does not change WhatsApp's data sharing practices with Facebook. It does not impact how people communicate privately with friends or family wherever they are in the world." ' -- source: https://it.slashdot.org/story/21/01/13/065219 In the meantime, people are moving to Telegram and Signal... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers steal Mimecast certificate used to encrypt customers’ M365 traffic
by Peter Reutemann 13 Jan '21

13 Jan '21

'Email management provider Mimecast said that hackers have compromised a digital certificate it issued and used it to target select customers who use it to encrypt data they sent and received through the company’s cloud-based service. In a post published on Tuesday, the company said that the certificate was used by about 10 percent of its customer base, which—according to the company—numbers about 36,100. The “sophisticated threat actor” then likely used the certificate to target “a low single digit number” of customers using the certificate to encrypt Microsoft 365 data. Mimecast said it learned of the compromise from Microsoft. Certificate compromises allow hackers to read and modify encrypted data as it travels over the Internet. For that to happen, a hacker must first gain the ability to monitor the connection going into and out of a target’s network. Typically, certificate compromises require access to highly fortified storage devices that store private encryption keys. That access usually requires deep-level hacking or insider access. The Mimecast post didn’t describe what type of certificate was compromised, and a company spokesman declined to elaborate. This post, however, discusses how customers can use a certificate provided by Mimecast to connect their Microsoft 365 servers to the company’s service. Mimecast provides seven different certificates based on the geographic region of the customer.' -- source: https://arstechnica.com/information-technology/2021/01/mimecast-says-hacker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

“The “S” in “IoT” stands for “security”.” (Copied from <https://forums.theregister.com/forum/all/2021/01/12/flash_is_dead/#c_4185268>.)

1 0

Keeping Flash Player Going A Little Longer
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

Adobe Flash Player has officially stopped working, since apparently Adobe included a logic bomb a few releases back with an expiry date in it <https://www.theregister.com/2021/01/12/flash_is_dead/>. However, for those who really, really need it, this article <https://charleswilkinson.co.uk/2021/01/12/how-to-use-flash-in-2021/> describes a workaround to re-enable it for certain sites (e.g. corporate intranet ones), by editing certain .cfg files. Those .cfg files don’t exist on a Linux installation -- not by default, anyway. However, doing a “strings” on libflashplayer.so finds (among other things) a reference to “/etc/adobe” and “/opt/adobe” directories. So perhaps you could create one of these and put files with the right names in it? Anyway, I’m just throwing this out there for anyone who wants to play with it. ;)

1 0

The Impractical but Indisputable Rise of Retrocomputing
by Peter Reutemann 13 Jan '21

13 Jan '21

'For all the personal technology introduced and popularized in 2020 -- upscale fitness bikes, at-home Covid tests, game consoles new and old -- the personal computer lands on the list with a bit of a thud. PCs lack the novelty of other gadgets, but they're practical, essential even, in a year when work, school and social life have come to rely heavily upon them. From a report: While modern, ever more efficient computers are selling better than they have in years, vintage computers -- impractical old devices in need of repairs and out-of-production parts -- are also in demand on sites like eBay. Collectors also flock to message boards, subreddits and Discord servers to buy, sell and trade parts. People are buying these PCs not necessarily for daily use, but for the satisfaction they get from rebuilding them. It's a trend one might chalk up to quarantine boredom, though it's been gaining traction for years. Retrocomputing, the hobby is called, is hardly just a way to pass the time. Instead, as enthusiasts see it, it's a means of communing with the past. "You get into this mind-set of what it must've been like to be somebody in the late '70s, having spent thousands of dollars on this thing that barely does anything more than a calculator," said Clint Basinger, 34, who runs the YouTube channel Lazy Game Reviews. (The devices do allow retrocomputers to make art and music using software unavailable on new computers and to play 8-bit games, but not much else beyond that.) "It's like a time machine to me," Mr. Basinger added. Before the pandemic, there were several vintage computing conventions located around the United States, to which collectors brought their computers to show off. Attendees bought and traded hardware at these events, as well as meet the friends they've made online.' -- source: https://it.slashdot.org/story/21/01/12/1910218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0