- wlug - list.wlug.org.nz

Google Partners With Parallels To Bring Windows Apps To Chrome OS
by Peter Reutemann 17 Jun '20

17 Jun '20

'For years, Parallels has provided virtualization software so you could run full Windows installs on a Mac, but today they're tackling a new OS. From a report: The company just announced that it is partnering with Google to work on bringing full Windows application support to Chrome OS enterprise devices. That's a big deal for the many businesses out there that run various pieces of legacy Windows software -- or just any business that wants to run Microsoft's Office software natively. It could Chrome OS devices a lot more viable in a variety of workspaces that may have previously had to rely on Windows hardware, though of course that'll depend on how well it is implemented. How exactly this will work remains to be seen; Parallels only said that partnership would "seamlessly add full-featured Windows apps, including Microsoft Office, to Chromebook Enterprise devices."' -- source: https://tech.slashdot.org/story/20/06/16/2059248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Will Soon Bake Anti-malware Defenses Directly Into its CPUs
by Peter Reutemann 16 Jun '20

16 Jun '20

'The history of hacking has largely been a back-and-forth game, with attackers devising a technique to breach a system, defenders constructing a countermeasure that prevents the technique, and hackers devising a new way to bypass system security. On Monday, Intel is announcing its plans to bake a new parry directly into its CPUs that's designed to thwart software exploits that execute malicious code on vulnerable computers. From a report: Control-Flow Enforcement Technology, or CET, represents a fundamental change in the way processors execute instructions from applications such as Web browsers, email clients, or PDF readers. Jointly developed by Intel and Microsoft, CET is designed to thwart a technique known as return-oriented programming, which hackers use to bypass anti-exploit measures software developers introduced about a decade ago. While Intel first published its implementation of CET in 2016, the company on Monday is saying that its Tiger Lake CPU microarchitecture will be the first to include it. ROP, as return-oriented programming is usually called, was software exploiters' response to protections such as Executable Space Protection and address space layout randomization, which made their way into Windows, macOS, and Linux a little less than two decades ago. These defenses were designed to significantly lessen the damage software exploits could inflict by introducing changes to system memory that prevented the execution of malicious code. Even when successfully targeting a buffer overflow or other vulnerability, the exploit resulted only in a system or application crash, rather than a fatal system compromise.' -- source: https://it.slashdot.org/story/20/06/15/1453215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Meet the Big Tech Critic Behind Hey, Basecamp's Radical New Email Platform
by Peter Reutemann 16 Jun '20

16 Jun '20

'The Basecamp cofounder and creator of web application framework Ruby on Rails David Heinemeier Hansson has become increasingly outspoken about Big Tech's privacy violations and monopolistic tendencies. Now he's inviting you to join the cause -- by switching your email provider. From a report: Two years ago, he and fellow Basecamp cofounder and CEO Jason Fried decided to do something about it. The culmination of that work is a paid, $99-per-year email service called Hey, which launches today. Along with protecting users from the types of invasive surveillance tactics that have become de rigueur online, Hey also contains some radical ideas about the way that modern correspondence should work. Silicon Valley will be watching the product closely: Consumers like to say they value their privacy, but are they finally willing to pay for it? [...] Most people haven't tried a new email service since Gmail launched 16 years ago, if not earlier. A handful of startups have played around with email interfaces in the years since, trying to make the experience cleaner and mobile-friendly, but no one has touched concepts as foundational as the inbox itself. Hansson and Fried argue that now is the time to do just that. They have made several radical changes to the inbox, the most glaring of which is that you, the email recipient, have control over who is allowed to appear there. That means you screen all first-time senders. They've also separated out what they call the "The Feed" and the "Paper Trail," so that there are distinct places for emails like newsletters and shipping confirmation notices. Because The Feed requires opt-in confirmation, it's much more pleasant to browse than Gmail's cluttered Promotions tab. It's also more private: Hey strips incoming messages of the tracking tools known as spy pixels that have become common practice in many emails. (The service indicates any emails that originally had tracking capabilities by displaying a small binoculars icon next to them.)' -- source: https://yro.slashdot.org/story/20/06/15/2034209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Criticized Over 'Senseless Attack on the URL Bar'
by Peter Reutemann 16 Jun '20

16 Jun '20

'The site Android Police is calling out new feature flags in Chrome's early-release Dev and Canary channels (V85) "which modify the appearance and behavior of web addresses in the address bar." The main flag is called "Omnibox UI Hide Steady-State URL Path, Query, and Ref" which hides everything in the current web address except the domain name... There are two additional flags that modify this behavior. One reveals the full address once you hover over the address bar (instead of having to click it), while the other only hides the address bar once you interact with the page... There's no public explanation yet for why Google is pressing ahead with these changes, but the company has said in the past that it believes showing the full address can make it harder to tell if the current site is legitimate. "Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage," Chromium software engineer Livvie Lin said in a design document earlier this year. However, it's also worth considering that making the web address less important, as this feature does, benefits Google as a company. Google's goal with Accelerated Mobile Pages (AMP) and similar technologies is to keep users on Google-hosted content as much as possible, and Chrome for Android already modifies the address bar on AMP pages to hide that the pages are hosted by Google. Modifying addresses on the desktop is another step towards making them irrelevant, which hurts the decentralized nature of the internet as a whol' -- source: https://tech.slashdot.org/story/20/06/14/192227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

regular meetings starting July
by Peter Reutemann 15 Jun '20

15 Jun '20

Hi everyone This morning I received confirmation that the university will be allowing evening meetings again on campus (assuming that the COVID19 situation doesn't change for the worse). The start date is Monday, July 13th, which is the start date of B trimester. In theory, regular WLUG and Python meetings would start up again in July. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does the Internet Need a New Architecture that Puts Users First?
by Peter Reutemann 15 Jun '20

15 Jun '20

'Two VoIP pioneers argue in a Wired opinion piece that "Treating the internet like a public utility only bolsters the platform giants," adding "A more secure model starts with control by the people." As we rely on the internet more and more for work, social connections, and basic needs, it is time to talk about the future of meaningful online experiences, and the need for a new internet architecture. We need a user-focused, localized internet. This competitive architecture would deliver an experience that values real-time connectivity over one-way advertising and puts control with the user, not with big tech platforms. This paradigm would flip the model on its head, letting people start with complete privacy and security, and from there allow them to open their channels depending on trust level. It inverts the terms of service, where instead of any platform imposing them on users, users impose theirs terms on the platform. A new architecture that competes with the "public" internet is completely possible, and it begins with a policy approach that fosters the necessary innovation and investment, while allowing for flexibility and experimentation. Fixing the internet is not rooted in treating it like a public utility; it is not to be found in micromanagement by government. In fact, those very backward-looking policies only fuel more harm by protecting the status quo, which is likely why big tech platforms have been so fervently pushing for them... As we argued in challenges to the 2015 Federal Communications Commission's public-utility-based Net Neutrality rules, this also kills investment, startups, and new innovation... [T]he public internet we experience today created the trillion-dollar tech platforms, but it allows for a few entities in Silicon Valley to colonize the entire planet and kill consumer choice. Six companies control 43 percent of all internet traffic. Of those six, three — Google, Facebook, and Amazon — receive 70 percent of all digital ad revenue in the U.S... Exposing everyone to the equivalent of homelessness online for the purposes of selling advertising already exceeds the tolerance of most of us. There exist more valuable uses of connectivity in support of human productivity than conjuring ever expanding modes of performance and creepy surveillance to drive advertising revenue' -- source: https://tech.slashdot.org/story/20/06/14/049230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub, Android, Python, Go: More Software Adopts Race-Neutral Terminology
by Peter Reutemann 15 Jun '20

15 Jun '20

'The terms 'allowlist' and 'blocklist' describe their purpose, while the other words use metaphors to describe their purpose," reads a change description on the source code for Android -- from over a year ago. 9to5Mac calls it "a shortened version of Google's (internal-only) explanation" for terminology changes which are now becoming more widespread. And Thursday GitHub's CEO said they were also "already working on" renaming the default branches of code from "master" to a more neutral term like "main," reports ZDNet: GitHub lending its backing to this movement effectively ensures the term will be removed across millions of projects, and effectively legitimizes the effort to clean up software terminology that started this month. But, in reality, these efforts started years ago, in 2014, when the Drupal project first moved in to replace "master/slave" terminology with "primary/replica." Drupal's move was followed by the Python programming language, Chromium (the open source browser project at the base of Chrome), Microsoft's Roslyn .NET compiler, and the PostgreSQL and Redis database systems... The PHPUnit library and the Curl file download utility have stated their intention to replace blacklist/whitelist with neutral alternatives. Similarly, the OpenZFS file storage manager has also replaced its master/slave terms used for describing relations between storage environments with suitable replacements. Gabriel Csapo, a software engineer at LinkedIn, said on Twitter this week that he's also in the process of filing requests to update many of Microsoft's internal libraries. A recent change description for the Go programming language says "There's been plenty of discussion on the usage of these terms in tech. I'm not trying to have yet another debate." It's clear that there are people who are hurt by them and who are made to feel unwelcome by their use due not to technical reasons but to their historical and social context. That's simply enough reason to replace them. Anyway, allowlist and blocklist are more self-explanatory than whitelist and blacklist, so this change has negative cost. That change was merged on June 9th -- but 9to5Mac reports it's just one of many places these changes are happening. "The Chrome team is beginning to eliminate even subtle forms of racism by moving away from terms like 'blacklist' and 'whitelist.' Google's Android team is now implementing a similar effort to replace the words 'blacklist' and 'whitelist.'" And ZDNet reports more open source projects are working on changing the name of their default Git repo from "master" to alternatives like main, default, primary, root, or another, including the OpenSSL encryption software library, automation software Ansible, Microsoft's PowerShell scripting language, the P5.js JavaScript library, and many others.' -- source: https://developers.slashdot.org/story/20/06/14/1722223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bypassing DRM On Your Fridge
by Lawrence D'Oliveiro 14 Jun '20

14 Jun '20

Certain refrigerators made by General Electric in the US <https://www.theregister.com/2020/06/13/ge_refrigerator_drm_keeps_turning/> have an RFID chip in their water filters to ensure that you only replace them with genuine GE parts. People have figured out how to hack this so cheaper third-party replacement filters will work, and now there is a website explaining the procedure. Quote: The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. I wonder how the lead levels are in the Flint, Michigan water supply these days ...

1 0

OpenZFS Removed Offensive Terminology From Its Code
by Peter Reutemann 13 Jun '20

13 Jun '20

'On Wednesday evening, ZFS founding developer Matthew Ahrens submitted what should have been a simple, non-controversial pull request to the OpenZFS project: wherever possible without causing technical issues, the patch removed references to "slaves" and replaced them with "dependents." This patch in question doesn't change the way the code functions -- it simply changes variable names in a way that brings them in conformance with Linux upstream device-mapper terminology, in 48 total lines of code (42 removed and 48 added; with one comment block expanded slightly to be more descriptive). But this being the Internet, unfortunately, outraged naysayers descended on the pull request, and the comments were quickly closed to non-contributors. I first became aware of this as the moderator of the r/zfs subreddit where the overflow spilled once comments on the PR itself were no longer possible. "The horrible effects of human slavery continue to impact society," writes Ahrens in his pull request. "The casual use of the term 'slave' in computer software is an unnecessary reference to a painful human experience." Ahrens' pull request has been reviewed by fellow lead developers Brian Behlendorf and Ryan Moeller and merged into the OpenZFS project repository.' -- source: https://developers.slashdot.org/story/20/06/12/0543254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet Archive Kills Its Free Digital Library Over Copyright Concerns
by Peter Reutemann 13 Jun '20

13 Jun '20

'The Internet Archive's National Emergency Library is finished. The non-profit repository for digital preservation, which began offering millions of e-books for free to address the closure of libraries during the pandemic, buckled under a joint lawsuit filed by major publishers including Penguin Random House and HarperCollins. From a report: Publishers said lending out books without compensation was "mass copyright infringement." The digital library will close next week. The archive of books was initially invite-only and only allowed a given file to be downloaded a limited number of times at once, with each rental limited to 14 days. But then the pandemic hit and libraries closed, so the Internet Archive responded by making all the books accessible to everyone, with no limits.' -- source: https://news.slashdot.org/story/20/06/12/1411237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New FreeBSD Code of Conduct
by Peter Reutemann 13 Jun '20

13 Jun '20

'FreeBSD has has adopted a new LLVM-derived code of conduct. The code of conduct requires users to: be friendly and patient, be welcoming, be considerate, be respectful, be careful in the words that you choose and be kind to others, when we disagree, try to understand why. This isn't an exhaustive list of things that you can't do. Rather, take it in the spirit in which it's intended - a guide to make it easier to communicate and participate in the community. This code of conduct applies to all spaces managed by the FreeBSD project. This includes online chat, mailing lists, bug trackers, FreeBSD events such as the developer meetings and socials, and any other forums created by the project that the community uses for communication. It applies to all of your communication and conduct in these spaces, including emails, chats, things you say, slides, videos, posters, signs, or even t-shirts you display in these spaces. In addition, violations of this code outside these spaces may, in rare cases, affect a person's ability to participate within them, when the conduct amounts to an egregious violation of this code.' -- source: https://developers.slashdot.org/story/20/06/12/1430203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Important Ubuntu Kernel Security Updates, Patch Now
by Peter Reutemann 12 Jun '20

12 Jun '20

'Canonical already released the other day a new version of the intel-microcode firmware to mitigate the latest Intel vulnerabilities, but now it also published new versions of the Linux kernel for all supported Ubuntu releases, including Ubuntu 20.04 LTS, Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. Apart from mitigating the Intel SRBDS/CrossTalk vulnerability (CVE-2020-0543), the new Linux kernel security updates fix race conditions (CVE-2020-12114) discovered by Piotr Krysiuk in the file system implementation, which lets a local attacker cause a denial of service (system crash).' -- source: https://www.linuxtoday.com/security/canonical-releases-important-ubuntu-ker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hands on with Android 11 Beta 1—A new media player and suggested apps
by Peter Reutemann 12 Jun '20

12 Jun '20

'Android 11's first "beta" release is finally out after numerous delays. The beta release works on the Pixel 2, 3, 3a, and 4, and enrolling for the beta OTA at google.com/android/beta. is super easy. Previously, the Android beta has launched simultaneously on plenty of third-party devices, but that's not the case this year. So far, OnePlus has also shipped the beta, and that's about it. Google says that more devices are coming "in the coming weeks." The Android 11 Beta has gone through a wild ride. First, it was supposed to debut at the Shoreline Amphitheater for Google I/O in May 12, but the physical event was canceled due to the coronavirus outbreak. Then it was supposed to debut in an online version of Google I/O, but that was canceled, too, as everyone was still trying to deal with the logistics problems the new shelter-in-place requirements. With no release in May, a surprise fourth preview release of Android 11 was created, and the Beta was delayed until June 3, when Google would hold an online event for "The Android 11 Beta Launch Show." The online Android 11 launch show was delayed, too, due to the ongoing nationwide protests against police brutality and the death of George Floyd. In its latest blog post, Google says the online launch show is also canceled entirely, and, surprise, the company is pressing the launch button now with zero fanfare. Not since Google canceled the launch of the Nexus 4 due to Hurricane Sandy in 2012 has a Google launch been such a hot, hot mess. With the Android 11 Beta finally go for launch, we're still seeing a bit of a mini I/O, even though every event is canceled. Google posted two blog posts, lots of documentation, and 12 videos covering new aspects of Android 11. The company is also planning "11 weeks of Android," a series that will see new developer talks posted each week. So far, the lack of fanfare seems appropriate for Android 11, which seems like a smaller release than we've gotten in previous years. This beta only has two new standout features we can point to.' -- source: https://arstechnica.com/gadgets/2020/06/hands-on-with-android-11-beta-1-a-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UPnP flaw exposes millions of network devices to attacks over the Internet
by Peter Reutemann 12 Jun '20

12 Jun '20

'Millions of routers, printers, and other devices can be remotely commandeered by a new attack that exploits a security flaw in the Universal Plug and Play network protocol, a researcher said. CallStranger, as the exploit has been named, is most useful for forcing large numbers of devices to participate in distributed denial of service—or DDoS—attacks that overwhelm third-party targets with junk traffic. CallStranger can also be used to exfiltrate data inside networks even when they’re protected by data loss prevention tools that are designed to prevent such attacks. The exploit also allows attackers to scan internal ports that would otherwise be invisible because they’re not exposed to the Internet. Billions of routers and other so-called Internet-of-things devices are susceptible to CallStranger, Yunus Çadırcı, a Turkish researcher who discovered the vulnerability and wrote the proof-of-concept attack code that exploits it, wrote over the weekend. For the exploit to actually work, however, a vulnerable device must have UPnP, as the protocol is known, exposed on the Internet. That constraint means only a fraction of vulnerable devices are actually exploitable.' -- source: https://arstechnica.com/information-technology/2020/06/upnp-flaw-exposes-mi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: System76’s Ubuntu-based Pop!_OS
by Peter Reutemann 12 Jun '20

12 Jun '20

'The subject of today's Linux distro review is perhaps one of a kind—as far as we know, Pop!_OS is the first Linux distribution to be created and maintained by a hardware OEM manufacturer. At the very least, it's the first one anyone has taken seriously. That hardware manufacturer is System76, probably the world's best-known Linux-only laptop manufacturer. Some larger OEMs offer Linux as an alternative operating system on a few models—but System76 sells Linux systems, and only Linux systems. Until 2017, System76 sold its systems preinstalled with Ubuntu Linux. But Canonical left the company cold when it decided to stop development on its Unity desktop environment and move back to Gnome3—and, controversially, System76 decided that instead of merely adding its own private repository and a few packages to a stock Ubuntu install, it would create and manage its own Ubuntu-derived distribution. Crucially, the new distribution would not just be for System76 hardware. Although the company uses the new distro to simplify and retain more control over its hardware setup, it designed Pop!_OS to be a real distro suitable for use—and encouraged for use—on any Linux PC, whether purchased from System76 or not.' -- source: https://arstechnica.com/gadgets/2020/06/linux-distro-review-system76s-ubunt… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Launches AMD Ryzen-Powered 'Serval WS' Portable Linux Workstation
by Peter Reutemann 12 Jun '20

12 Jun '20

'Linux computer maker/seller System76 has been offering AMD processors in its Thelio desktop computers, but believe it or not, the company has never offered an AMD-powered laptop -- until now, that is. From a report: You see, starting today, you can buy a "Serval WS" powered by AMD. No, System76 is not offering mobile Ryzen chips in this laptop, but instead, desktop-class processors. As you can expect, this 15-inch portable Linux workstation is quite chunky and heavy as a result. With that said, it is simply impossible to cram this much power into a thin and light notebook. "The Serval WS comes with either the 3rd Gen Ryzen 3600, 3700X, or 3900 CPU. The latter is equipped with 12 Cores and 24 Threads, making this laptop perfect for taking on heavy computational loads. Having this kind of desktop-caliber power in a laptop body helps if you need to run complex simulations at your desk or quickly render 3D scenes while on the road. AMD CPUs are also known for having the an extremely high price per performance, which means you get maximum bang-for-buck," says System76. The laptop starts at $1,300 -- and BetaNews has all the specs.' -- source: https://linux.slashdot.org/story/20/06/11/1634258 CHeers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Activists Rally To Save Internet Archive as Lawsuit Threatens Site
by Peter Reutemann 12 Jun '20

12 Jun '20

'The Internet Archive is a massive endeavor -- it's an online library aiming to "provide Universal Access to All Knowledge." It has digitized millions of web pages, movies, photos, recordings, software programs, and books that might otherwise be lost to history. But it's neither un-censorable nor outside the bounds of copyright law. And now open internet supporters are wondering how to save it before it disappears. ' -- source: https://yro.slashdot.org/story/20/06/11/194226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 11 Will Help You Rein In Zombie App Permissions
by Peter Reutemann 11 Jun '20

11 Jun '20

'With 2.5 billion users worldwide, Google has a responsibility to make its Android operating system as secure as possible. But the company has at times struggled to adequately vet apps in the Google Play Store, allowing malicious programs through that thousands or millions of users go on to download. With Google's release of the Android 11 Beta on Wednesday, though, the company is taking steps to make it even more difficult for rogue apps to grab your data even when they do slip by. From a report: Google has worked for years to incrementally tighten Android security under the hood. And the release of Android 11 is particularly focused on expanding privacy improvements to give you more control over what your apps can access and giving more ways to distribute software updates across Android's fragmented and disjointed device population. Android 10 addressed some of this as well, requiring that app developers request permissions and then reaffirm user choices more often. Android 11 adds a feature that allows developer to request one-time permissions for things like the microphone, camera, or location as an alternative to all or nothing. You can share your location with a friend through a chat app once, for example, without granting indefinite location access, or having to remember to wade back into settings to revoke the permission later. "We can see that people are actually leveraging these features from Android 10 and thinking about their choices when they're giving apps access to permissions," says Charmaine D'Silva, an Android product manager who works on privacy. "So building on that this time we've added even more controls." Android 11 will also rein in apps that you don't use very often, automatically revoking permissions if you don't open it for a still undetermined period of time. If you start using the app again you can always reinstate its access, but the permission won't be lurking forgotten. Google plans to experiment with different cutoffs after 60-90 days, with the goal of eliminating stray permissions without breaking functionality.' -- source: https://yro.slashdot.org/story/20/06/10/1730228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Playing Around With the Fuchsia OS
by Peter Reutemann 11 Jun '20

11 Jun '20

'Security and software development company Quarkslab played around with Google's new Fuchsia operating system, which could one day replace Android on smartphones and Chrome OS on laptops. The researchers "decided to give a quick look at Fuchsia, learn about its inner design, security properties, strengths and weaknesses, and find ways to attack it." Here's what they concluded: Fuchsia's micro kernel is called Zircon. It is written in C++. [...] Contrary to every other major OS, it appears rather difficult to target the Zircon kernel directly. A successful RCE (Remote Code Execution) on the world-facing parts of the system (USB, Bluetooth, network stack, etc) will only give you control over the targeted components, but they run in independent userland processes, not in the kernel. From a component, you then need to escalate privileges to the kernel using the limited number of syscalls you can access with the handles you have. Overall, it seems easier to target other components rather than the kernel, and to focus on components that you can talk to via IPC and that you know have interesting handles. Overall, Fuchsia exhibits interesting security properties compared to other OSes such as Android. A few days of vulnerability research allowed us to conclude that the common programming bugs found in other OSes can also be found in Fuchsia. However, while these bugs can often be considered as vulnerabilities in other OSes, they turn out to be uninteresting on Fuchsia, because their impact is, for the most part, mitigated by Fuchsia's security properties. We note however that these security properties do not -- and in fact, cannot -- hold in the lowest layers of the kernel related to virtualization, exception handling and scheduling, and that any bug here remains exploitable just like on any other OS. All the bugs we found were reported to Google, and are now fixed. Again, it is not clear where Fuchsia is heading, and whether it is just a research OS as Google claims or a real OS that is vowed to be used on future products. What's clear, though, is that it has the potential to significantly increase the difficulty for attackers to compromise devices. ' -- source: https://tech.slashdot.org/story/20/06/10/008245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.19 Released
by Peter Reutemann 10 Jun '20

10 Jun '20

'The KDE community has released Plasma 5.19, the popular free and open-source desktop environment. "In this release, we have prioritized making Plasma more consistent, correcting and unifying designs of widgets and desktop elements; worked on giving you more control over your desktop by adding configuration options to the System Settings; and improved usability, making Plasma and its components easier to use and an overall more pleasurable experience," reads the announcement. For a complete list of what's new, you can visit the Plasma 5.19 changelog.' -- source: https://tech.slashdot.org/story/20/06/09/2035226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New CrossTalk Attack Impacts Intel's Mobile, Desktop, and Server CPUs
by Peter Reutemann 10 Jun '20

10 Jun '20

'Academics from a university in the Netherlands have published details today about a new vulnerability in Intel processors. From a report: The security bug, which they named CrossTalk, enables attacker-controlled code executing on one CPU core to leak sensitive data from other software running on a different core. The Vrije University's Systems and Network Security Group (VUSec) says the CrossTalk vulnerability is another type of MDS (microarchitectural data sampling) attack. MDS attacks target user data while in a "transient" state, as it's being processed inside the CPU and its many data-caching systems. More specifically, CrossTalk attacks data while it's being processed by the CPU's Line Fill Buffer (LBF), one of these aforementioned CPU cache systems. According to the VUSec team, the LBF cache actually works with a previously undocumented memory "staging buffer" that is shared by all CPU cores.' -- source: https://it.slashdot.org/story/20/06/09/1941205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pinebook Pro review—a $200 FOSS-to-the-hilt magnesium-chassis laptop
by Peter Reutemann 10 Jun '20

10 Jun '20

Since we had our own demo of the Pinebook earlier this year, here is another take: 'In early March of this year, I ordered one of the FOSS-driven Pine64 project's newest designs—the Pinebook Pro. The company's manufacturing efforts have taken an enormous hit due to the impact of COVID-19 on its Chinese manufacturing partners, which kept me from receiving my Pinebook Pro until last week. Unfortunately, COVID-19 didn't merely slow down production. It also made QA impossible, which led to enough problems with my new laptop that it's going to need to be replaced. We'll talk about why that is in much greater detail later, but for right now, keep in mind that some parts of my experience aren't as-designed for the hardware. You should also keep in mind that the Pinebook isn't exactly a consumer product—it's a device aimed squarely at hobbyists and tinkerers with offbeat plans and limited budget. Most people will not want to replace their standard consumer laptop or Chromebook with a Pinebook Pro—but it's a fascinating look at what's possible in inexpensive hardware design with an intense focus on privacy, open source design, and community.' -- source: https://arstechnica.com/gadgets/2020/06/pinebook-pro-review-a-200-foss-to-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Plundering of crypto keys from ultrasecure SGX sends Intel scrambling again
by Peter Reutemann 10 Jun '20

10 Jun '20

'For the past two years, modern CPUs—particularly those made by Intel—have been under siege by an unending series of attacks that make it possible for highly skilled attackers to pluck passwords, encryption keys, and other secrets out of silicon-resident memory. On Tuesday, two separate academic teams disclosed two new and distinctive exploits that pierce Intel’s Software Guard eXtension, by far the most sensitive region of the company’s processors. Abbreviated as SGX, the protection is designed to provide a Fort Knox of sorts for the safekeeping of encryption keys and other sensitive data even when the operating system or a virtual machine running on top is badly and maliciously compromised. SGX works by creating trusted execution environments that protect sensitive code and the data it works with from monitoring or tampering by anything else on the system. Key to the security and authenticity assurances of SGX is its creation of what are called enclaves, or blocks of secure memory. Enclave contents are encrypted before they leave the processor and are written in RAM. They are decrypted only after they return. The job of SGX is to safeguard the enclave memory and block access to its contents by anything other than the trusted part of the CPU. Tuesday’s attacks aren’t the first to defeat SGX. In 2018, a different team of researchers broke into the fortified Intel region after building on an attack known as Meltdown, which, along with a similar attack known as Spectre, ushered in the flurry of processor exploits. A different team of researchers broke SGX earlier this year. Intel mitigated the earlier SGX vulnerability by introducing microcode updates. However, these mitigations did not last, as two new attacks have sent Intel scrambling anew to devise new defenses. Intel released the new updates on Tuesday and expects them to be available to end users in the coming weeks. Depending on the computer, the fix will either be installed automatically or will require manual intervention. Users, particularly those who rely on the SGX, should check with the manufacturer of their machine and ensure that the update is installed as soon as practical. The new SGX attacks are known as SGAxe and CrossTalk. Both break into the fortified CPU region using separate side-channel attacks, a class of hack that infers sensitive data by measuring timing differences, power consumption, electromagnetic radiation, sound, or other information from the systems that store it. The assumptions for both attacks are roughly the same. An attacker has already broken the security of the target machine through a software exploit or a malicious virtual machine that compromises the integrity of the system. While that’s a tall bar, it’s precisely the scenario that SGX is supposed to defend against.' -- source: https://arstechnica.com/information-technology/2020/06/new-exploits-plunder… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bryan Lunduke Explains Why Linux Sucks in 2020
by Peter Reutemann 09 Jun '20

09 Jun '20

'Roblimo once called it "a tradition, not just a speech" -- Bryan Lunduke's annual "Linux Sucks" presentations at various Linux conferences. But before you get too upset, in his 2014 interview with Slashdot Lunduke admitted "I love Linux, I have made my whole life around Linux. I work for Linux companies. I write for Linux magazines, but it really blows..." This year he's releasing a special YouTube version of Linux Sucks 2020, the first time Lunduke has attempted the talk without a live audience, "And it feels really wicked weird." But he's still trying to get a rise out of his audience. "Follow me on this into Journey Into Graphs and Numbers Land," Lunduke says playfully, pulling up one of his 160 x 90 pixel slides showing current market share for Windows, Mac, and then Linux "You might notice that some platforms have a higher market share than Linux does," he says with a laugh, describing one slide showing Linux as "scooping up the bottom of the barrel at 1.6%..." "But here's the thing. These numbers have been either consistent, or for Linux, slowly dropping." And then he puts up a graph showing the number of searches for Linux. "If you look back at 2004 -- the year 2004, 16 years ago -- that was the high point in interest in searching for the word Linux (or Linux plus other things). 2006 it was about half that -- so about two years later it had dropped down to about half. Here in 2020 it is so low, not only does it not fill up the first bar of pixels there, it's like only three pixels in. That doesn't happen -- that sort of decline does not happen -- unless the platform sucks. That's just the truth of the matter. That's just how it goes, right?"' -- source: https://linux.slashdot.org/story/20/06/07/1941256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Vulnerabilities in Popular Open Source Projects Doubled in 2019
by Peter Reutemann 09 Jun '20

09 Jun '20

'A study that analyzed the top 54 open source projects found that security vulnerabilities in these tools doubled in 2019, going from 421 bugs reported in 2018 to 968 last year. From a report: According to RiskSense's "The Dark Reality of Open Source" report, released today, the company found 2,694 bugs reported in popular open source projects between 2015 and March 2020. The report didn't include projects like Linux, WordPress, Drupal, and other super-popular free tools, since these projects are often monitored, and security bugs make the news, ensuring most of these security issues get patched fairly quickly. Instead, RiskSense looked at other popular open source projects that aren't as well known but broadly adopted by the tech and software community. This included tools like Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and others. RiskSense says that one of the main problems they found during their study was that a large number of the security bugs they analyzed had been reported to the National Vulnerability Database (NVD) many weeks after they've been publicly disclosed. The company said it usually took on average around 54 days for bugs found in these 54 projects to be reported to the NVD, with PostgreSQL seeing reporting delays that amounted to eight months.' -- source: https://it.slashdot.org/story/20/06/08/1417259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0