- wlug - list.wlug.org.nz

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0

Oh, Those Lascivious Sinful Onions ...
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

A seed company had one of its ads banned by Facebook after the image in it was deemed to contain “overtly sexual positioning”. To the normal human eye it just looks like a picture of some onions. Not even the most depraved imagination seems incapable of conjuring more than that out of it. Judge for yourself <https://www.theregister.com/2020/10/13/in_brief_ai/> ...

1 0

Meeting next Monday
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Due to labour day, our next (and last meeting before the AGM) will be next Monday already. Ian will talk a few minutes about his experience upgrading his Ubuntu to 20.04.1. However, we could do with additional content. Suggestions? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notepad++/Windows -> Notepadqq/Linux
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Today, I was looking for a (graphical) text editor that could search through a directory structure and replace a particular string in lots of config files. Just using find in conjunction with sed wasn't gonna cut it, as I needed to inspect each individual file first (but then do a single subversion commit covering all the files). While searching on alternativeto.net for an alternative to Notepad++, using this URL: https://alternativeto.net/software/notepad-plus-plus/ I came across Notepadqq, which had the desired functionality: https://notepadqq.com/ Just like Notepad++, it also has syntax highlighting for lots of different file types. It's great to have such a wide variety of editors out there! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Long-term WLUG member featured in a good-news article
by Eric Light 13 Oct '20

13 Oct '20

Hi everyone! I apologise if this isn't appropriate here (it does verge on a political post), but I noticed a familiar name in The Spinoff today. Most of you will know Roderick Aldridge from his membership in the WLUG over the years. It's been quite nice to see his writing on non-technical issues as well. https://thespinoff.co.nz/society/12-10-2020/im-80-years-old-ive-never-touch… Thanks Roderick :) E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

2 1

Linux 5.9 Boosts CPU Performance With FSGSBASE Support
by Peter Reutemann 13 Oct '20

13 Oct '20

'FSGSBASE support in Linux "has the possibility of helping Intel/AMD CPU performance especially in areas like context switching that had been hurt badly by Spectre/Meltdown and other CPU vulnerability mitigations largely on the Intel side," Phoronix wrote back in August. As it started its journey into the kernel, they provided a preview on August 10: The FSGSBASE support that was finally mainlined a few days ago for Linux 5.9 is off to providing a nice performance boost for both Intel and AMD systems... FSGSBASE support for the Linux kernel has been around a half-decade in the making and finally carried over the finish line by one of Microsoft's Linux kernel engineers... FSGSBASE particularly helps out context switching heavy workloads like I/O and allowing user-space software to write to the x86_64 GSBASE without kernel interaction. That in turn has been of interest to Java and others...On Linux 5.9 where FSGSBASE is finally mainlined, it's enabled by default on supported CPUs. FSGSBASE can be disabled at kernel boot time via the "nofsgsbase" kernel option. Today on the Linux kernel mailing list, Linus Torvalds announced the release of Linux 5.9: Ok, so I'll be honest - I had hoped for quite a bit fewer changes this last week, but at the same time there doesn't really seem to be anything particularly scary in here. It's just more commits and more lines changed than I would have wished for. And Phoronix reported: Linux 5.9 has a number of exciting improvements including initial support for upcoming Radeon RX 6000 "RDNA 2" graphics cards, initial Intel Rocket Lake graphics, NVMe zoned namespaces (ZNS) support, various storage improvements, IBM's initial work on POWER10 CPU bring-up, the FSGSBASE instruction is now used, 32-bit x86 Clang build support, and more. See our Linux 5.9 feature overview for the whole scoop on the many changes to see with this kernel.' -- source: https://linux.slashdot.org/story/20/10/12/0029215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's T2 Security Chip Has an Unfixable Flaw
by Peter Reutemann 13 Oct '20

13 Oct '20

'A recently released tool is letting anyone exploit an unusual Mac vulnerability to bypass Apple's trusted T2 security chip and gain deep system access. The flaw is one researchers have also been using for more than a year to jailbreak older models of iPhones. But the fact that the T2 chip is vulnerable in the same way creates a new host of potential threats. Worst of all, while Apple may be able to slow down potential hackers, the flaw is ultimately unfixable in every Mac that has a T2 inside. From a report: In general, the jailbreak community haven't paid as much attention to macOS and OS X as it has iOS, because they don't have the same restrictions and walled gardens that are built into Apple's mobile ecosystem. But the T2 chip, launched in 2017, created some limitations and mysteries. Apple added the chip as a trusted mechanism for securing high-value features like encrypted data storage, Touch ID, and Activation Lock, which works with Apple's "Find My" services. But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass. On Macs, the jailbreak allows researchers to probe the T2 chip and explore its security features. It can even be used to run Linux on the T2 or play Doom on a MacBook Pro's Touch Bar. The jailbreak could also be weaponized by malicious hackers, though, to disable macOS security features like System Integrity Protection and Secure Boot and install malware. Combined with another T2 vulnerability that was publicly disclosed in July by the Chinese security research and jailbreaking group Pangu Team, the jailbreak could also potentially be used to obtain FileVault encryption keys and to decrypt user data. The vulnerability is unpatchable, because the flaw is in low-level, unchangeable code for hardware. "The T2 is meant to be this little secure black box in Macs -- a computer inside your computer, handling things like Lost Mode enforcement, integrity checking, and other privileged duties," says Will Strafach, a longtime iOS researcher and creator of the Guardian Firewall app for iOS. "So the significance is that this chip was supposed to be harder to compromise -- but now it's been done."' -- source: https://apple.slashdot.org/story/20/10/12/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Five-Eyes Nations + Japan, India Ask Big Tech To Bake Backdoors Into Everything
by Lawrence D'Oliveiro 12 Oct '20

12 Oct '20

The abovementioned nations have issued a joint statement <https://www.theregister.com/2020/10/11/international_statementon_end_to_end…> where they “urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content”. One of the ways to do this is “Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight”. To the extent that this is not calling for restrictions on strong encryption altogether, merely on its wide adoption by certain large companies, I can live with it. Just so long as we are not forced into using the products and services provided by these companies as an inescapable part of our daily lives.

1 0

The Unreasonable Effectiveness Of The Julia Programming Language
by Lawrence D'Oliveiro 10 Oct '20

10 Oct '20

A report from the recent JuliaCon <https://arstechnica.com/science/2020/10/the-unreasonable-effectiveness-of-t…>: Six years ago, I wrote in these pages about the enduring prominence of Fortran for scientific computing and compared it with several other languages. I ended that article with a prediction that, in 10 years, a new language called Julia stood a good chance of becoming the one that scientists would turn to when tackling large-scale numerical problems. My prediction was not very accurate, though. It actually only took Julia about half that time. He goes on to talk about the “two-language problem” and the “expression problem”, and how Julia solves these through its “multiple-dispatch” feature. A key point is that, even with all these advanced features, it manages to maintain program speed close to that of C++.

1 0

controlling network manager from the console
by Peter Reutemann 08 Oct '20

08 Oct '20

Hi everyone For a project at work, I'm working with a Nvidia Jetson Nano (https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-na…) In order to get it hooked up to the wireless network, I came across the following tutorial: https://learn.sparkfun.com/tutorials/adding-wifi-to-the-nvidia-jetson/all The interesting tidbit in this article was the "nmcli" tool (https://linux.die.net/man/1/nmcli) to control the network manager from the console. Really neat! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Botched Excel Import May Have Caused Loss Of 15,841 UK COVID-19 Cases
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Looks like someone tried to load a file of nationwide Coronavirus test results into Microsoft Excel, and exceeded its maximum-row limit <https://arstechnica.com/tech-policy/2020/10/excel-glitch-may-have-caused-uk…>. The omission has since been fixed.

1 2

Free Software Foundation Turns 35
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

<https://www.theregister.com/2020/10/06/fsf_35/>: The FSF is keen that all should don their sandals and share in the celebration, perhaps by trying out an approved GNU/Linux distribution, or switching out a proprietary app like Microsoft Office for LibreOffice, or Adobe Photoshop for the GNU Image Manipulation Program. Heck, one could even have a crack at GNU Emacs and celebrate a keyboard shortcut or two.

1 0

Python 3.9 Is Out
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Worth noting from <https://devclass.com/2020/10/06/python-3_9/>: * Merging of dictionaries with “|” and “|=” operators * Generics in type hints * General expressions now allowed in decorators (I didn’t actually realize there were restrictions before) * New PEG parser, with option to revert to old parser for now (not that I expect to notice any difference between the two) * Deprecation of features for Python 2 backward compatibility (to be removed altogether in 3.10)

1 0

Oracle vs Google Goes To The US Supreme Court
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

The US Supreme Court is due to hear Google’s appeal tomorrow <https://arstechnica.com/tech-policy/2020/10/google-asks-supreme-court-to-ov…> against the CAFC ruling that APIs are copyrightable and that Google infringed Oracle’s copyright on the Java APIs. A few companies (including GitHub) have filed “amicus curiae” briefs explaining why allowing the verdict against Google to stand will have unfortunate consequences for the entire software industry. The CAFC (Court of Appeals for the Federal Circuit) is a notoriously “intellectual-property-friendly” court, shall we say. They wouldn’t even have got the chance to rule on the original verdict by Judge Alsup, except that the suit initially included a patent claim (that was very quickly thrown out). Definite points to Oracle’s lawyers for doing this: like a chess strategy where you advance a seemingly unimportant pawn in the opening moves that is immediately sacrificed, but the long-term consequences for your opponent’s position only become apparent some time later in the game.

1 0

Developers Are Managing 100× More Code Than They Were 10 Years Ago
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

This survey <https://arstechnica.com/gadgets/2020/10/sourcegraph-devs-are-managing-100x-…> reports on the explosion in typical source code bases that seems to have occurred over the past decade. I have a couple of concerns with this: * The obvious quantity-versus-quality issue. How much of this is due to things like node.js pulling in hundreds of dependencies for a comparatively small class library? Clearly, “managing” does not mean “writing” or even “maintaining”. * The use of “technology” as some kind of synonym for “information technology”. You mean it didn’t require “technology” to conduct insurance, retail, food and beverage businesses before? After all, pencil and paper are “technologies”, too. And if you think they are easy things to make, well ... try making them yourself. </rant>

1 0

What Operating Systems Keep Things Running In Space?
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

Nice report <https://arstechnica.com/features/2020/10/the-space-operating-systems-bootin…> going into some details on the proprietary VxWorks (popular with NASA) and the open-source RTEMS (originating from the US military, now heavily used by ESA). Also mentions SpaceChain, which was developed in order to implement a BitCoin network in space. This is based on Sylix, which comes from the Chinese military, but is now open-source as well. And there is some use of Linux, but only in situations where hard-realtime constraints can be guaranteed by lower-level custom hardware. Summary: VxWorks and RTEMS are pretty much identical in basic features and maturity/reliability, but RTEMS does have an edge in configurability.

1 0

DigitalOcean’s “Hacktoberfest” Backfires
by Lawrence D'Oliveiro 03 Oct '20

03 Oct '20

Cloud company Digital Ocean has started its seventh annual “Hacktoberfest” <https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_requ…>, promising free T-shirts to those who submit “quality” pull requests to online open-source repositories. Seems this year, the “quality” proviso is being roundly ignored. Many project maintainers are being deluged with trivial and pointless patches, many of whose submittors readily admit they are only doing it for the T-shirt. Choice quote: Imagine an arsonist declaring, "Only you can prevent forest fires," and you can get a sense of the frustration among open source maintainers. Actually, I’m surprised this hasn’t happened in previous years. But then again, maybe it has: "Hacktoberfest has never generated anything of value for open source ... It’s a marketing stunt which sends a deluge of low-effort contributions to maintainers, leaving them to clean up the spam." There’s also a link to a rather pungently-named Twitter account which is collecting examples of these useless patch submissions.

2 1

Developers Try Again To Upstream Motorola 68000 Series Support In LLVM
by Peter Reutemann 01 Oct '20

01 Oct '20

'Hobbyist developers are trying once again to get a Motorola 68000 back-end merged into the upstream LLVM compiler. Phoronix reports: The Motorola 68000 series processors have been around since the 80's thanks to the likes of the early Apple Macintosh computers. Fast forward to 2020, the Motorola 68000 is still a popular target for vintage computer enthusiasts and hobbyists. Community developers have worked on improving the Linux kernel support for M68k hardware like early Apple Powerbooks as recently as a few years ago and the compiler support is a continued target. GCC 11 due out next year was looking to drop the M68k target over its unmaintained status. Hobbyists though stepped up there so the M68k support will remain in GCC. Now developers are also looking at adding M68k support to the LLVM compiler. This isn't the first time that M68k support for LLVM has been brought up albeit never successfully landed to date. Building off the past failures to get the Motorola 68000 series support upstreamed, developers last week sent out new patches proposing this back-end -- this time they are showing more clarity about the developers involved and being committed to supporting the code, the sustainability of the code, and responding quickly to code review comments. This patch series is the latest attempt at upstreaming Motorola 68000 series support in LLVM. Besides all the back-end specific code there is also some common LLVM code changes that fall under greater scrutiny. ' -- source: https://hardware.slashdot.org/story/20/09/30/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Xen Project Officially Ports Its Hypervisor To Raspberry Pi 4
by Peter Reutemann 30 Sep '20

30 Sep '20

'The Xen Project has ported its hypervisor to the 64-bit Raspberry Pi 4. The Register reports: The idea to do an official port bubbled up from the Xen community and then reached the desk of George Dunlap, chairman of the Xen Project's Advisory Board. Dunlap mentioned the idea to an acquaintance who works at the Raspberry Pi Foundation, and was told that around 40 percent of Pis are sold to business users rather than hobbyists. With more than 30 million Arm-based Pis sold as of December 2019, and sales running at a brisk 600,000-plus a month in April 2020, according to Pi guy Eben Upton, Dunlap saw an opportunity to continue Xen's drive towards embedded and industrial applications. Stefano Stabellini, who by day works at FPGA outfit Xilinx, and past Apache Foundation director Roman Shaposhnik took on the task of the port. The pair clocked that the RPi 4's system-on-chip used a regular GIC-400 interrupt controller, which Xen supports out of the box, and thought this was a sign this would, overall, be an easy enough job. That, the duo admitted, was dangerous optimism. Forget the IRQs, there was a whole world of physical and virtual memory addresses to navigate. The pair were "utterly oblivious that we were about to embark on an adventure deep in the belly of the Xen memory allocator and Linux address translation layers," we're told. [The article goes on to explain the hurdles that were ahead of them.] "Once Linux 5.9 is out, we will have Xen working on RPi4 out of the box," the pair said. [...] Stefano Stabellini told The Register that an official Xen-on-RPi port will make a difference in the Internet-of-Things community, because other Arm development boards are more costly than the Pi, and programmers will gravitate towards a cheaper alternative for prototyping. He also outlined scenarios, such as a single edge device running both a real-time operating system alongside another OS, each dedicated to different tasks but inhabiting the same hardware and enjoying the splendid isolation of a virtual machine rather than sharing an OS as containers. George Dunlap also thinks that an official Xen-on-RPi port could also be of use to home lab builders, or perhaps just give developers a more suitable environment for their side projects than a virtual machine or container on their main machines. Stay tuned to Project EVE's Github page for more details about how to build your own Xen-for-RPi. Hacks to get it up and running should also appear on the Xen project blog.' -- source: https://hardware.slashdot.org/story/20/09/29/2025213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare's Privacy Crusade Continues With a Challenge To Google Analytics
by Peter Reutemann 30 Sep '20

30 Sep '20

'Fortune: Cloudflare is launching a privacy-friendly rival to Google Analytics. Google Analytics is a free toolkit that's used by website administrators across the globe to help them track the behavior of the people visiting those sites -- how they find them, what they do there, the devices they're using, and so on. However, the service -- the most popular of its kind -- also helps Google track websites' visitors, so it can better profile them for advertising purposes. This privacy-invasive aspect makes many people squeamish. And that's where Cloudflare would now like to step in. Around its birthday every year, the decade-old company -- which went public last year -- announces a move intended to "give back" to the wider Internet community. These moves are often related to privacy. On Tuesday, it unveiled Cloudflare Web Analytics, a free-to-use toolkit that largely replicates what Google Analytics offers -- minus the invasive tracking, and thus the ability to assess the performance of targeted ads carried on websites. Cloudflare Web Analytics is immediately available to the company's paid customers, but any website owner will be able to use it from some point in the coming months. Cloudflare's scale is crucial here [...] because it takes substantial resources to run a free analytics platform, and Cloudflare already has a giant network that can support the load. Cloudflare Web Analytics isn't the company's only big announcement this week. "On Monday, Cloudflare launched a beta testing program for a cloud technology called Durable Objects," the report adds. "You can read the technical explanation here, but in essence this is a tool that allows developers of online services to make those services comply with the increasing number of data-localization and data-protection laws that limit where users' data is supposed to go." "With Durable Objects, Cloudflare says, it is possible to specify where particular data will reside on Cloudflare's network, so -- for example -- a German user's data does not have to leave Germany. Or, with an eye to other current news, a service such as TikTok could ensure that U.S. users' data never leaves the U.S., without having to create a separate version of its service for that country." ' -- source: https://tech.slashdot.org/story/20/09/29/2011226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 17 Android Apps Caught Engaging In WAP Billing Fraud
by Peter Reutemann 30 Sep '20

30 Sep '20

'Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected. Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run. Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains. ' -- source: https://tech.slashdot.org/story/20/09/28/236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0