- wlug - list.wlug.org.nz

Check Point Releases Open-Source Fix For Common Linux Memory Corruption Security Hole
by Peter Reutemann 22 May '20

22 May '20

'For years, there's been a known security vulnerability hiding in the GNU C Library (glibc). This library, which is critical for Linux and many other operating systems and programs, had a dynamic memory management security hole that could be used for denial of service (DoS) attacks. Now, the security company, Check Point, has issued an open-source patch, which will make it much more difficult to exploit this memory allocation (malloc) problem. Check Point re-encountered this known problem when it discovered that so-called smart light bulbs could be used to hack into networks by exploiting unprotected single-linked-lists. The double-linked-list version of this problem had been fixed back in 2005 with Safe-Unlinking. But, the single-linked-list version, which is present in the memory primitive functions Fast-Bins and Thread Cache (TCache), remained vulnerable. Now, the fix is in for this problem. This new built-in security mechanism is called Safe-Linking. It protects malloc by signing its single-linked-list pointers with random numbers derived from Linux's Address Space Layout Randomization (ASLR) functionality. Combined with memory chunk alignment integrity checks, it protects the memory pointers from hijacking attempts and thus the system itself. The patch is now being integrated with the most common standard C library implementation, glibc. Safe-Linking will be released in glibc 2.32 in August 2020. It's already up and running in glibc's popular embedded counterpart: uClibc-NG.' -- source: https://linux.slashdot.org/story/20/05/21/2018256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Beta Firmware Brings True USB Boot for High-Speed Storage, No microSD Required
by Peter Reutemann 22 May '20

22 May '20

'Owners of a Raspberry Pi 4 Model B single-board computer looking to make the most of the device's high-speed USB 3.0 connectivity by turning it into the device's primary storage can now do so — at least, if they're willing to help out with beta-testing the latest firmware. The Raspberry Pi 4 launched last year with a range of improvements over its predecessor, including the option of up to four times as much memory and high-speed USB 3.0 connectivity for peripherals, but with a couple of regressions: The loss of the ability, present in the Raspberry Pi 3 range, to boot from a network server or USB Mass Storage device.' -- source: https://www.hackster.io/news/raspberry-pi-4-beta-firmware-brings-true-usb-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Term Of The Week: “RPA”
by Lawrence D'Oliveiro 21 May '20

21 May '20

Came across this phrase “robotic process automation” (RPA) <https://www.theregister.co.uk/2020/05/05/sba_rpa_ban/> which seems to be just another name for “web-scraping”. The site in question also offers APIs that can be used more directly to make requests and receive info. It’s just that the scraping works on a GUI designed for human users and human response times and data rates, so it creates a lot more overhead on the servers when being driven automatically with a lot of requests. Some outfits try to say that using such technology on their site is a violation of their terms of service. As one of the reader comments points out, if a company is banned from using a scraper bot that is batching its requests, and has to resort to hiring an army of humans, creating a concomitant swarm of separate login sessions, to enter the same data, the result can be even worse load on the servers.

1 1

Information Technology Asset Management (ITAM) Forum
by Lawrence D'Oliveiro 21 May '20

21 May '20

Choice quote from the founder/chairman <https://www.theregister.co.uk/2020/05/20/itam_forum_launches/>: “One of the reasons people have been interested in ITAM in the past is because they are sick of software audits and want to learn to defend themselves against audits...” Given the way the proprietary licence agreements are worded, it’s hard to see how you can avoid this and still use the same software. Further: “Ten years ago, people thought everything would be compliant in the cloud. Although software compliance is less of an issue, costs certainly aren’t planned. It is as complex as ever. Whether it's on the desktop, in the data centre or in the cloud, you’re looking at roughly 35 per cent waste across all of those platforms.” That’s a pretty high figure. It means that, when you buy proprietary software, you are paying about a 50% markup on the supposed price.

1 0

Samsung Smart TV - blocking ads
by Peter Reutemann 21 May '20

21 May '20

Hi everyone Just came across this tip on reddit for blocking ads on your Samsung Smart TV: https://www.reddit.com/r/YouShouldKnow/comments/gn7fw5/ysk_if_you_own_a_sam… Blocking "ads.samsung.com" (or similar) on the router seems to be sufficient... The above link has more domains listed for Samsung and LG. Not that I'm connecting my TV to the internet in the first place... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

List Of Spreadsheet Horror Stories
by Lawrence D'Oliveiro 21 May '20

21 May '20

One of the things the European Spreadsheet Risks Interest Group likes to do is collect horror stories about the (mis)use of spreadsheets <http://eusprig.org/horror-stories.htm>. Found the link in a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/19/sap_analytics_cloud_o…> to this article <https://www.theregister.co.uk/2020/05/19/sap_analytics_cloud_office_integra…> about how software company SAP, creator of a complete business analytics suite, has felt compelled to include an interface to Microsoft Excel, just because that’s what most of its customers are familiar with.

4 5

SD Cards Version 8 Are Coming
by Lawrence D'Oliveiro 20 May '20

20 May '20

According to the pic linked from this article <https://www.theregister.co.uk/2020/05/20/sd_8_for_sd_express/>, the new SD card spec uses PCIe instead of the previous “SD Bus” interface to achieve around ... is it 4GB/s, or 4Gb/s? The article says it both ways, while the diagram uses capital B throughout. The current fastest SD cards have two rows of pins; this spec adds a third row.

1 0

Linux distro review: Fedora Workstation 32
by Peter Reutemann 20 May '20

20 May '20

'Today's Linux distro review is one I've been wanting to do for quite some time—Fedora Workstation. Fedora is one of the heavyweight desktop distros of the Linux world, with a vibrant community and a strong presence at every open source convention I've ever attended. (Remember physically attending events? Ars remembers.) I never felt particularly drawn to Fedora myself, because it's a bleeding-edge distro—one targeted to the very newest software, possibly at the expense of stability. That's not what I personally want in an operating system—I fix broken things professionally; I'd prefer not to fix them personally any more than I have to. But as one of the few distros using the next-generation Wayland display server by default, Fedora made me very curious indeed. Although the screenshots taken throughout this review are of virtual machines, my first installation of Fedora Workstation (ever!) was bare metal, on the HP Dragonfly Elite G1.' -- source: https://arstechnica.com/gadgets/2020/05/linux-distro-review-fedora-workstat… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

“To Fix Social Media, We Need To Introduce Digital Socialism”
by Lawrence D'Oliveiro 20 May '20

20 May '20

Some may find this opinion piece <https://www.aljazeera.com/indepth/opinion/fix-social-media-introduce-digita…> a bit too political, I don’t know. But he does mention some interesting open-source software projects, like the various “Fediverse” networks of decentralized social-media servers, and the “LibreSocial” project, which is trying to get rid of what little centralization still exists in those networks. Where I suppose it gets controversial is where he suggests that funding for such projects could be raised by taxing the existing Big Tech firms. But certainly many would agree the open-source projects he mentions are worth pursuing regardless.

1 0

OT: NZ COVID Tracer app
by Peter Reutemann 20 May '20

20 May '20

Hi everyone Just came through on my twitter feed: the NZ COVID Traver app is ready: https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Microsoft Launches Windows Terminal 1.0, Unveils GPU Support and Linux GUI Apps in WSL
by Peter Reutemann 20 May '20

20 May '20

'At Build 2020 today, Microsoft gave developers a slew of new tools to coax them into using Windows over macOS or Linux. From a report: Windows Terminal is now out of preview for enterprises, and Windows Subsystem for Linux (WSL) 2 is getting support for GPUs, Linux GUI apps, and a simplified install experience. Microsoft even released a Windows Package Manager in preview. Windows 10 runs on 1 billion monthly active devices (PCs, Xbox One consoles, and HoloLens devices), making it a massive platform for developers to target. [...] Microsoft today released Windows Terminal 1.0, which means it is stable for enterprise use. The open source application features multiple tabs, panes, tear-away windows, shortcuts, Unicode and UTF-8 character support, emojis, ligatures, extensions, GPU-accelerated text rendering engine, and custom themes, styles, and configurations. Windows Terminal is for users of PowerShell, Cmd, WSL, and other command-line tools. Microsoft also unveiled WSL improvements today, including support for GPUs, Linux GUI apps, and a simplified install experience. WSL is a compatibility layer for running Linux binary executables natively on Windows. Microsoft first shared it was working on WSL 2 a year ago at Build 2019. WSL 2 is slated to arrive in the next major Windows 10 update coming later this month (brilliantly called the Windows 10 May 2020 Update), but it won't have these new features. In the second half of the year, WSL 2 will get support for GPU compute workflows. ' -- source: https://linux.slashdot.org/story/20/05/19/163224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 83 Released With Enhanced Privacy Controls, Tab Groups Feature
by Peter Reutemann 20 May '20

20 May '20

'Google has released today version 83 of its Chrome web browser, one of the most feature-packed Chrome updates released since the browser's initial launch back in 2009. From a report: Today's v83 release includes a slew of new features. These include enhanced privacy controls, new settings for managing cookie files, a new Safety Check option, support for tab groups, new graphics for web form elements, a new API for detecting barcodes, and a new anti-XSS security feature, among many many others. The reason why Chrome 83 includes so many features is because Google canceled the Chrome 82 release due to the ongoing coronavirus pandemic. As a result, some of the Chrome 82 features were pushed into Chrome 83, while others were rescheduled for later this year.' -- source: https://slashdot.org/story/20/05/19/185244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 6.7 Released
by Peter Reutemann 20 May '20

20 May '20

'New OpenBSD version. String of good news. Some of the new changes, as highlighted by Phoronix, include: - FFS2 file-system improvements including using 64-bit timestamps and block numbers by default for new installs. - Support for the Raspberry Pi 4 on ARM64 while improving the Raspberry Pi 3 support too. Raspberry Pi 2/3 support has also improved for OpenBSD ARMv7. - Better support for Rockchip systems like the Pinebook Pro. - Various SMP improvements including better AMD SMT/Core/Package detection. - A wide variety of different hardware driver improvements, including Intel AX200 WiFi device support. - A FIDO driver introduced for FIDO/U2F security keys support. - Fixed handling of USB 2.0 devices when in use on different USB 3.0 controllers. - The PowerPC OpenBSD build switched over to Clang as its default code compiler. - Various dhclient fixes. - Various security improvements. ' -- source: https://tech.slashdot.org/story/20/05/19/1935202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 May '20

20 May '20

Hi everyone For the meeting next week, the idea was to have a distro showdown. Since not everyone had experience yet with BigBlueButton, I would like to offer a trial run on Sunday night 8pm for the presenters. That should give them a chance to sort out video and audio. I'll send out a test link to the presenters off-list later on in the week. So far, I've got: - Ian - Ubuntu 20.04 - Tom - GhostBSD - Peter - Manjaro (never used it, but we can explore it together) Anyone else wanting to demo a distro? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner
by Peter Reutemann 19 May '20

19 May '20

'This has been a long while in the making—it's test results time. To truly understand the fundamentals of computer storage, it's important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It's also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers. First, a quick note: This testing, naturally, builds on those fundamentals. We're going to draw heavily on lessons learned as we explore ZFS topologies here. If you aren't yet entirely solid on the difference between pools and vdevs or what ashift and recordsize mean, we strongly recommend you revisit those explainers before diving into testing and results. And although everybody loves to see raw numbers, we urge an additional focus on how these figures relate to one another. All of our charts relate the performance of ZFS pool topologies at sizes from two to eight disks to the performance of a single disk. If you change the model of disk, your raw numbers will change accordingly—but for the most part, their relation to a single disk's performance will not.' -- source: https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disk… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Re: wlug Digest, Vol 347, Issue 17 - DishTV Box
by tom butz 19 May '20

19 May '20

Hi John, I've been using the cheap one (99 dollars) and it works well. They expect the hard-disk/memory stick to be formatted FAT32. The system could do that for you. The recording format is proprietary: it's .mpg, but if you play it back, there is an enormous amount of jitter every 5 seconds or so. There is no documentation, maybe because FreeView told them to keep it secret. The USB-connection is USB2 and supplies 500 mA of power: that should be enough for a memory stick but not an ordinary HD (they usually draw about 1000 mA). I've kept an old HD out of a notebook and use it with an adapter. It's slow but I've never lost anything. Maybe there are Y-connectors around that would bump the HD's power to 1000 mA, but I've not managed to find one. The system records in ordinary density and doesn't use a lot of space. As everything is so proprietary I haven't found a way to transfer/add parts to another HD/stick. Everything sits in 1 directory with a few subdirectories. Transferring the stuff to a computer would work if you filmed the TV-screen. You would then also be able to cut out the ads. I've read somewhere that there are devices that would record HDMI-output (which the DishTV provides) on a USB-device, so that should do the job. Gameplayers use something like that to record their moves... Just an aside: recording OnDemand movies: easy if you use 'simplescreenrecorder' (Windows and Linux). It creates an MKV-file you can edit. Tom.

3 2

dish tv
by john 18 May '20

18 May '20

Hi all' Does anyone know the file format for the Dish TV sat box?? I have a replacement empty drive. No File allocation and wonder if the Dish box will format the disk to it's own system? Cheers John.

1 0

Slack Now Strips Location Data From Images
by Peter Reutemann 16 May '20

16 May '20

'Slack has started to strip uploaded photos of their metadata. What may seem like an inconsequential change to how the tech giant handles storing files on its servers, it will make it far more difficult to trace photos back to their original owners. From a report: Almost every digital file -- from documents on your computer to photos taken on your phone -- contains metadata. That's data about the file itself, such as how big the file is, when it was created, and by whom. Photos and videos often include the precise coordinates of where they were taken. But that can be a problem for higher-risk Slack users, like journalists and activists, who have to take greater security precautions to keep their sources safe. The metadata inside photos can out sources, deanonymize whistleblowers, or otherwise make it easier for unfriendly governments to target individuals. Even if a journalist removes the metadata from a photo before publishing, a copy of the photo -- with its metadata -- may remain on Slack's servers. Whether a hacker breaks in or a government demands the data, it can put sources at risk' -- source: https://yro.slashdot.org/story/20/05/11/2051209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

ddr2 ram
by john 16 May '20

16 May '20

Some years ago, Windows Vista offered users who plugged in a USB flash drive the option of using the device as extra ram. I never actually tried this due to large amount of doubt about the functional ability of the claim. However I now have a number of Linux machines with DDR2 that I am unable to increase the physical memory of and wonder if this is a feasible option for these machines. Cheers John

5 6

Standby Fares For Those Flying Cloud
by Lawrence D'Oliveiro 14 May '20

14 May '20

New concept: “Spot” VMs on cloud services <https://www.theregister.co.uk/2020/05/13/azure_spot_vms/>. These are offered for a very low price, but equally the jobs run at very low priority, and are liable to be evicted at short notice--as little as 30 seconds, according to the article. They are there to fill up unused capacity that cannot be sold at the regular rate. But as soon as a customer appears willing to pay that rate, out you go.

1 0

3D File Manager As A Service
by Lawrence D'Oliveiro 13 May '20

13 May '20

This company called Saganworks is offering a navigable 3D world for accessing your files stored on their servers <https://blocksandfiles.com/2020/05/12/saganworks-virtual-reality-rooms-for-…>. This sort of thing has been done lots of times before, famously on SGI workstations (and seen in the “Jurassic Park” movie). I suppose Microsoft Bob also counts, in a way. Quote: “We don’t live in a 2D world, yet that’s how we’ve been retaining knowledge and memories from the time of early cave dwellers until now.” Speak for yourself, non-command-line user. Yes, the name is a contrived acronym, and also a homage to Carl Sagan ...

1 0

Ventoy USB Image Multi-Bootloader
by Lawrence D'Oliveiro 13 May '20

13 May '20

Been watching this video <https://www.youtube.com/watch?v=MYJ8du9TaxE> about a bootloader called “Ventoy”. Basically you install it onto a suitably-large USB stick, then you can just copy .iso image files of all the distros you want to try, and when you boot off that stick, it will offer a list of which OS image you want to start up. This even includes some Microsoft Windows installation images. Not everything is fully-compatible, though.

1 0

Commercial Use Of Open Source: Good & Bad
by Lawrence D'Oliveiro 13 May '20

13 May '20

<https://www.theregister.co.uk/2020/05/12/open_source_bugs/> The good news: commercial adoption of Open Source is on the up: ... almost all (99 per cent) of the codebases examined have at least one open source component and that 70 per cent of the code overall is open source. That's about twice as much as the company's 2015 report, which found only 36 per cent of audited code was open source. The bad news: the companies concerned seem to have few or no procedures in place for keeping those open-source components up to date: Ninety-one percent of the audited applications had components that are either four years out of date or have exhibited no active development for two years. In 2019 – the time-period covered by the 2020 report – the percentage of codebases containing vulnerable components rose to 75 per cent, up from 60 per cent in 2018. They also seem to be a little bit careless about the legalities: The Synopsys report also found that 68 per cent of codebases exhibited an open source license conflict and that 33 per cent of them had no identifiable license.

1 0

Eclipse Foundation Moving Base To Europe
by Lawrence D'Oliveiro 13 May '20

13 May '20

The Eclipse Foundation is “re-domiciling the legal entity that controls The Eclipse Foundation from the US to Europe” <https://www.theregister.co.uk/2020/05/12/eclipse_moves_to_europe/>. Seems like Europe is already accounting for a much bigger chunk of contributions than the US: Membership dues will eventually be stated in Euros and a new version of the membership agreement will be coming down the line to reflect the foundation's new status as a Belgian entity. This reader comment <https://forums.theregister.co.uk/forum/all/2020/05/12/eclipse_moves_to_euro…> gives some other examples of Open Source projects where either their organizations or the bulk of their contributors are not (or no longer) US-centric. E.g. The Document Foundation (which runs the LibreOffice project) is based in Berlin.

1 0

Apache 101: 0-WordPress in 15 minutes
by Peter Reutemann 13 May '20

13 May '20

'Recently, we took a look at the Caddy Web server. Today, we're going to back things up a little bit and look at the A from the classic LAMP stack: the Apache Web server. Apache has a bad reputation for being old, crusty, and low-performance—but this idea mostly stems from the persistence of ancient guides that still show users how to set it up in extremely antiquated ways. In this guide, we're going to set up an Ubuntu 20.04 droplet at Digital Ocean with an Apache Web server set up properly and capable of handling serious levels of traffic.' -- source: https://arstechnica.com/information-technology/2020/05/apache-101-0-wordpre… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0