- wlug - list.wlug.org.nz

Samba and the French Government
by Peter Reutemann 20 Mar '20

20 Mar '20

>From the Catalyst March newsletter: 'For many years, several French Ministries have entrusted Samba with the role of authentication for Windows desktop machines - using Samba's Domain Controller capability. As modern versions of Windows began phasing out the NT4 Domain Control protocols, it became imperative for the French Ministries to upgrade to Active Directory. Thanks to the long-standing success they had had with Samba, the Ministries were keen to continue to use Samba, this time as an Active Directory (AD) Domain Controller (DC). However, the French Ministries faced a problem: the new AD domains would need to be combined so that a single domain serves a whole ministry, not just a single site. This meant that Samba needed to upscale. Samba was successfully operating in the smaller ministries of the French Government, however, scaling from a thousand users up to 100,000 users for the ministry of Finance was a new challenge that required Catalyst's Samba experts.' -- source: https://www.catalyst.net.nz/client-work/samba-and-french-government Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows Subsystem for Linux is making inroads with developers
by Peter Reutemann 20 Mar '20

20 Mar '20

'Last week, Microsoft and Canonical (the company behind the Ubuntu Linux distribution) were scheduled to host a developer conference focused on the Windows Subsystem for Linux (WSL) at Microsoft's Redmond campus. Ars was invited, and I had plane tickets in hand—but the physical conference was canceled at the last minute due to the coronavirus. Note that I did say the physical conference was canceled—WSLconf itself went on, with 22 speakers and 21 talks given. Virtual attendees were reportedly more than double the (sold out) physical attendee registration and included developers from all around the world. Presentations were given over the Bluejeans videoconferencing platform, and Canonical's Developer Advocate Hayden Barnes says that the recorded sessions will be made generally available soon.' -- source: https://arstechnica.com/information-technology/2020/03/the-windows-subsyste… Probably useful for developers that are stuck on Windows, but I'm not gonna trade my Linux Desktop for that horrible Windows one... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pixar Co-Founders Win Turing Award
by Lawrence D'Oliveiro 19 Mar '20

19 Mar '20

Pat Hanrahan and Ed Catmull split the latest ACM Turing award between them <https://www.theregister.co.uk/2020/03/18/pixar_founders_turing_award/>, in recognition of their pioneering work in computer graphics. Catmull has his name in the “Catmull-Clark” subdivision algorithm commonly used in 3D modellers to turn polygonal shapes into more curvy ones. He headed the Computer Graphics Lab at the New York Institute of Technology (NYIT), started in 1974, with the help of a load of funding from a wealthy benefactor. Among their many projects, NYIT tried to create what would have been, in 1984, the first feature-length movie done entirely in CG. It was called “The Works”. Unfortunately they never got much further than tantalizing fragments <https://www.youtube.com/watch?v=jgzAqRyhjVs>. Hanrahan was a key figure in the creation of the RenderMan renderer at Pixar. What was pioneering about that was the concept of a “shader”, written in a specialized programming language designed for describing how light reacts with a material. This was the “RenderMan Shading Language”. The same idea led to GLSL which became part of OpenGL later, and also the “Open Shading Language” (OSL) created and open-sourced at Sony Pictures ImageWorks, and adopted by many 3D software apps, including Blender.

1 0

Purism Librem Mini is a Tiny Linux Desktop
by Peter Reutemann 19 Mar '20

19 Mar '20

'Today, we get another diminutive desktop option, but this one is designed for Linux and privacy. From a report: Yes, Purism is finally launching a tiny desktop, and it will come pre-installed with the Debian-based PureOS. Called "Librem Mini," the cute bugger has 4 USB-A ports on the front, along with a 3.5mm audio jack, and the power button. On the rear, there are two more USB-A ports, a single USB-C port, Ethernet, HDMI, DisplayPort, and the power port. "Announcing the Purism Librem Mini. Our small form-factor mini-PC that puts freedom, privacy and security first. We're really excited about the Librem Mini, it's a device our community have wanted and we've wanted to offer for some time. The Librem Mini is accessible, small, light and powerful featuring a new 8th gen quad core i7 processor, up to 64 GB of fast DDR4 memory and 4k 60 fps video playback. It's a desktop for your home or oïfce, a media center for your entertainment, or an expandable home server for your files and applications," says Purism.' -- source: https://linux.slashdot.org/story/20/03/18/1654232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Against The Virus
by Lawrence D'Oliveiro 18 Mar '20

18 Mar '20

A researcher at Google has published plans for an Arduino-based DIY ventilator, in case hospitals run short of officially-approved units for patients <https://www.theregister.co.uk/2020/03/18/diy_ventilator_shortage/>. Quite a few other links there to homebrew efforts to address other ways to help deal with Covid-19. All potentially quite risky and unregulated, of course. So let’s just hope we won’t need any of it. And on a sad note: Meanwhile, technician Christian Fracassi reportedly <https://metro.co.uk/2020/03/16/firm-refuses-give-blueprint-coronavirus-equi…> helped make a 3D printed valve that helped save at least 10 lives at a hospital in Italy, although he may now face legal action from the company whose parts he copied.

1 0

Text processing in the shell
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Just came across this article, which also has real-world examples: 'One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc. When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.' -- source: https://blog.balthazar-rouberol.com/text-processing-in-the-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday - cancelled
by Peter Reutemann 18 Mar '20

18 Mar '20

Hi everyone Due to COVID-19, we are cancelling all WLUG meetings for the foreseeable future. Stay safe and we'll see you again when things are back to normal! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday (in theory)
by Peter Reutemann 16 Mar '20

16 Mar '20

Hi everyone At this stage, the university is monitoring the COVID-19 situation but (to my knowledge) isn't closing yet nor is it curtailing meetings such as ours. However, this could change any day and I will post an update when this should happen. So, at this stage we have an exciting WLUG meeting scheduled for next Monday: 'The voice interface represents another big shift in user interfaces, and could be as big a shift as the shift from switches to terminals, the switch from terminals to windowed GUIs, or the switch from full computers to small touchscreen devices. Unfortunately, right now most of these devices are little more than a telephone for talking to a server in the cloud. That is a big problem for privacy, and presents the user with a false choice between access and privacy. Today's computers are capable of handling a verbal interface without requiring a cloud service to handle all of your requests. Aaron Chantrill is one of the developers on the Naomi Project, a free and open source voice assistant (https://projectnaomi.com) It is a plugin based system based on Jasper (http://jasperproject.github.io/) and depending on how the user chooses to configure it, can run totally offline. In this presentation, Aaron would like to introduce people to the Naomi Project, talk about the benefits of a verbal interface, talk about the current architectures of virtual assistants, and ways in which that architecture can be altered to provide better privacy, and also do a comparison of offline speech to text and text to speech solutions, including Pocketsphinx, Mozilla Deepspeech, Kaldi, and Julius. Finally, He will invite people to participate in building and improving Naomi. There is a lot to do and much of it is both engaging and cutting-edge.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792000/ https://gettogether.community/events/3276/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ice Lake GPU underperforming? Put it in powersave mode. Wait, what?
by Peter Reutemann 16 Mar '20

16 Mar '20

'Back in December, Linux users were starting to notice that Ice Lake-equipped laptops were getting better framerates in powersave mode than in performance mode. This Tuesday, Intel developer Francisco Jerez released a patchset to address the conundrum. Jerez begins by noting the fact that if your system bottleneck is I/O, boosting CPU performance won't help—the CPU can't process more data if the I/O subsystem isn't providing it fast enough. "In IO-bound scenarios (by definition) the throughput of the system doesn't improve with increasing CPU frequency beyond the threshold value at which the IO device becomes the bottleneck." Jerez goes on to note that pointlessly boosting the CPU into turbo frequencies when there's no additional data for it to process doesn't just hurt power efficiency. In the case of laptop designs, there's typically no room for desktop- or server-style "overengineering"—you've got limited space as well as limited power. This means, among other things, that there's only so much cooling to go around. "With the current governors [...] the CPU frequency tends to oscillate with the load, often with an amplitude far into the turbo range, leading to severely reduced energy efficiency." This is particularly likely to become a problem in games, where the GPU portions of the processor get a much bigger workout than the x86 CPU itself. If you unnecessarily boost CPU frequency, you waste your TDP budget dealing with unnecessary waste heat from the CPU—which may in turn require throttling the GPU, since you've already eaten through your thermal overhead.' -- source: https://arstechnica.com/gadgets/2020/03/power-management-is-hard-linux-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internet 'is Not Working For Women and Girls', Says Sir Tim Berners-Lee
by Peter Reutemann 13 Mar '20

13 Mar '20

'Women and girls face a "growing crisis" of online harms, with sexual harassment, threatening messages and discrimination making the web an unsafe place to be, Sir Tim Berners-Lee has warned. The inventor of the world wide web said the "dangerous trend" in online abuse was forcing women out of jobs, causing girls to skip school, damaging relationships and silencing female opinions, prompting him to conclude that "the web is not working for women and girls." "The world has made important progress on gender equality thanks to the unceasing drive of committed champions everywhere," Berners-Lee wrote in an open letter to mark the web's 31st birthday on Thursday. "But I am seriously concerned that online harms facing women and girls -- especially those of colour, from LGBTQ+ communities and other marginalised groups -- threaten that progress."' -- source: https://tech.slashdot.org/story/20/03/12/1436247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Slams Facebook In Solitary Confinement: Browser Add-On Stops Social Network Stalking Users Across the Web
by Peter Reutemann 13 Mar '20

13 Mar '20

'Tim Anderson reporting via The Register: The first thing users will see after updating to Mozilla's latest browser, Firefox 74, is a prompt to install the Facebook Container add-on. The Facebook Container add-on is not new, but has been enhanced in its latest version, 2.1.0, with the ability to add custom sites to the container so that you can "login with Facebook wherever you need to." The purpose of the Facebook Container is to let you continue to use Facebook but without having the social network site track your browsing elsewhere. "Installing this extension closes your Facebook tabs, deletes your Facebook cookies, and logs you out of Facebook," say the docs. When you visit Facebook and log in, the cookies it plants are isolated to the container. This prevents Facebook Like buttons and embedded comments from working on other sites. There is also an issue with sites that require or offer a Facebook login, which you can now overcome by adding those sites to the container. Sites are added by clicking a fence icon and selecting "Allow site in Facebook container." The effect is like having two web browsers, one in which you are logged into Facebook and subject to potential tracking on any site which has Facebook content, and another where Facebook has no knowledge of you.' -- source: https://news.slashdot.org/story/20/03/12/2027215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modern RAM Used For Computers, Smartphones Still Vulnerable To Rowhammer Attacks
by Peter Reutemann 13 Mar '20

13 Mar '20

'According to new research published today, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack. But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh," a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.' -- source: https://it.slashdot.org/story/20/03/12/2042242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Practices At The CIA
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

The trial of an ex-CIA operative accused of leaking some military-grade hacking tools <https://www.schneier.com/blog/archives/2020/03/cia_dirty_laund.html> has exposed some embarrassing details about the security practices of an organization that, you would expect, has security as its core mission. They regularly used (and freely circulated) rubbish passwords for services on their intranet for the elite “Operational Support Branch”, the excuse being that access to that intranet was already being tightly controlled. The old adage that “a system is only as secure as its weakest point”? They have heard of it...

1 0

Want To Use An Open-Source, Royalty-Free Video Codec? Pay Up, Please!
by Lawrence D'Oliveiro 13 Mar '20

13 Mar '20

A company called Sisvel is assembling a pool of patents claiming to cover the AV1 video codec <https://www.techdirt.com/articles/20200312/04075244087/former-refrigerator-…>. They expect to eventually have an arsenal of about 2000 patents, for which they will demand licence fees. If you remember, AV1 was created precisely to avoid the patent morass that surrounds H.265 aka HEVC.

1 0

Microsoft delivers emergency patch to fix wormable Windows 10 flaw
by Peter Reutemann 13 Mar '20

13 Mar '20

'Microsoft on Thursday released an unscheduled fix for a critical security bug that makes it possible for attackers to remotely execute malicious code that can spread from vulnerable machine to vulnerable machine without requiring any interaction from users. The flaw, in version 3 of Microsoft's implementation of the Server Message block protocol, is present only in 32- and 64-bit Windows 10 versions 1903 and 1909 for clients and servers. Although the vulnerability is difficult to exploit in a reliable way, Microsoft and outside researchers consider it critical because it opens large networks to "wormable" attacks, in which the compromise of a single machine can trigger a chain reaction that causes all other Windows machines to quickly become infected. That's the scenario that played on with the WannaCry and NotPetya in 2017. In a bulletin accompanying Thursday's patch, Microsoft said it has no evidence the flaw is being actively exploited, but the company went on to label the bug as "exploitation more likely." That designation means malicious actors will probably develop and use exploits in the future.' -- source: https://arstechnica.com/information-technology/2020/03/microsoft-delivers-e… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows has a new wormable vulnerability, and there’s no patch in sight
by Peter Reutemann 12 Mar '20

12 Mar '20

'Word leaked out on Tuesday of a new vulnerability in recent versions of Windows that has the potential to unleash the kind of self-replicating attacks that allowed the WannaCry and NotPetya worms to cripple business networks around the world. The vulnerability exists in version 3.1.1 of the Server Message Block, the service that’s used to share files, printers, and other resources on local networks and over the Internet. Attackers who successfully exploit the flaw can execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in this bare-bones advisory. The flaw, which is tracked as CVE-2020-0796, affects Windows 10, versions 1903 and 1909 and Windows Server versions 1903 and 1909, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks. Patches aren’t available, and Tuesday’s advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said, “Beyond the advisory you linked, nothing else to share from Microsoft at this time.” In the meantime, Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server. Users can use the following PowerShell command to turn off compression without needing to reboot the machine: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force That fix won't protect vulnerable client computers or servers if they connect to a malicious SMB service, but in that scenario, the attacks aren't wormable. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.' -- source: https://arstechnica.com/information-technology/2020/03/windows-has-a-new-wo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Before it sued Google for copying from Java, Oracle got rich copying IBM’s SQL
by Peter Reutemann 11 Mar '20

11 Mar '20

'More than a decade ago, Google re-implemented the Java programming language as part of its new Android mobile operating system. Oracle, the owner of Java, then sued Google for copyright infringement in 2010. Later this month, the Supreme Court will hear oral arguments in this epic copyright case that will have huge implications for the entire software industry—and that could cost Google billions of dollars. Google says it has done nothing wrong. Copyright law specifically excludes "systems" and "methods of operation" from copyright protection. Google argues that the aspects of Java it copied—function names, argument types, and so forth—fit squarely into these exceptions. Google also argues that copyright's fair use doctrine allows for this kind of copying. The case is being closely watched by the software industry. Companies like Microsoft and IBM have warned that Oracle's stance could create chaos for the industry. They argue that making this kind of copying illegal would not only create legal headaches for a lot of software companies—it would be bad for customers, too. Software companies copy software interfaces—known in industry jargon as application programming interfaces (APIs)—of their competitors' products all the time. This allows competing software products to be interoperable so that a customer can take software designed to work on one platform and re-use it on another. That means lower switching costs for customers. It also means lower barriers for entry for software startups, since it's easier to sell a new product if it's compatible with a software product that customers already know and trust. If anyone should understand the importance of such copying, it's Oracle. After all, Oracle got its start in the 1970s selling a database product based on the then-new structured query language (SQL). SQL was invented by IBM. And Oracle doesn't seem to have gotten a license to use it. If Oracle wins its legal battle, one ironic result will be to make the software industry less hospitable to future startups like Oracle. Incumbent software companies would have a greater ability to lock customers into their own proprietary standards. Startups wouldn't be allowed to do what Oracle did four decades ago: make its product compatible with an established competitor, then make that interoperability a selling point. As I'll explain below, Oracle's copying of SQL seems pretty similar to Google's copying of Java. But an Oracle spokeswoman disagrees. "It’s an incorrect premise, comparing apples with broccoli, and being completely divorced from the facts of the case," she wrote in a Tuesday email.' -- source: https://arstechnica.com/tech-policy/2020/03/before-it-sued-google-for-copyi… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 74 Arrives With Stricter Add-on Rules, TLS 1.0 and TLS 1.1 Disabled
by Peter Reutemann 11 Mar '20

11 Mar '20

'Mozilla today launched Firefox 74 for Windows, Mac, and Linux. Firefox 74 includes stricter rules for add-ons, TLS 1.0 and TLS 1.1 disabled by default, and a handful of developer features.' -- source: https://news.slashdot.org/story/20/03/10/1515248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu 20.04’s zsys adds ZFS snapshots to package management [Updated]
by Peter Reutemann 11 Mar '20

11 Mar '20

'Last October, an experimental ZFS installer showed up in Eoan Ermine, the second interim Ubuntu release of 2019. Next month, Focal Fossa—Ubuntu's next LTS (Long Term Support) release—is due to drop, and it retains the ZFS installer while adding several new features to Ubuntu's system management with the fledgling zsys package. Phoronix reported this weekend that zsys is taking snapshots prior to package-management operations now, so we decided to install the latest Ubuntu 20.04 daily build and see how the new feature works.' -- source: https://arstechnica.com/gadgets/2020/03/ubuntu-20-04s-zsys-adds-zfs-snapsho… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Processors From 2011 To 2019 Vulnerable To Two New Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'AMD processors manufactured between 2011 and 2019 (the time of testing) are vulnerable to two new attacks, research published this week has revealed (PDF). The two new attacks impact the security of the data processed inside the CPU and allow the theft of sensitive information or the downgrade of security features. The research team said it notified AMD of the two issues in August 2019, however, the company has not released microcode (CPU firmware) updates, claiming these "are not new speculation-based attacks," a statement that the research team disagrees with. The two new attacks target a feature of AMD CPUs known as the L1D cache way predictor. Introduced in AMD processors in 2011 with the Bulldozer microarchitecture, the L1D cache way predictor is a performance-centric feature that reduces power consumption by improving the way the CPU handles cached data inside its memory. A high-level explanation is available below: "The predictor computes a uTag using an undocumented hash function on the virtual address. This uTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only oneway instead of all possible ways, reducing the power consumption." The two new attacks were discovered after a team of six academics [...] reverse-engineered this "undocumented hashing function" that AMD processors were using to handle uTag entries inside the L1D cache way predictor mechanism. Knowing these functions, allowed the researchers to recreate a map of what was going on inside the L1D cache way predictor and probe if the mechanism was leaking data or clues about what that data may be. While the attacks can be patched, AMD denies that these two new attacks are a concern, claiming they "are not new speculation-based attacks" and that they should be mitigated through previous patches for speculative execution side channel vulnerabilities. The research team says AMD's response is "rather misleading," and that the attacks still work on fully-updated operating systems, firmware, and software even today.' -- source: https://it.slashdot.org/story/20/03/09/2347202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPN and Ad-Blocking Apps Are Secretly Harvesting User Data
by Peter Reutemann 11 Mar '20

11 Mar '20

'Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps. Four of these -- Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus -- were recently available in the Google Play store. Adblock Focus and Luna VPN were in Apple's App Store. Apple removed Adblock Focus and Google removed Mobile Data after being contacted by BuzzFeed News. The companies said they continue to investigate. Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products. Sensor Tower's app intelligence platform is used by developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps. Randy Nelson, Sensor Tower's head of mobile insights, said the company's apps do not collect sensitive data or personally identifiable information and that "the vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting." But, as BuzzFeed points out, most of the apps are no longer available "because they were removed due to policy violations."' -- source: https://yro.slashdot.org/story/20/03/10/0148245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs Vulnerable To New LVI Attacks
by Peter Reutemann 11 Mar '20

11 Mar '20

'A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.' -- source: https://it.slashdot.org/story/20/03/10/176200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo is Good Enough For Regular Use
by Peter Reutemann 10 Mar '20

10 Mar '20

'Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me. There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.' -- source: https://search.slashdot.org/story/20/03/09/1554252 I've been using DuckDuckGo for a number of years exclusively now and I agree with the author that when I can't find it with DDG, I can't find it with Google either. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How Wikipedia's Volunteers Became the Web's Best Weapon Against Misinformation
by Peter Reutemann 10 Mar '20

10 Mar '20

'Fast Company just published a 4,000 appreciation of Wikipedia's volunteer editors: [W]hile places like Facebook, YouTube, and Twitter struggle to fend off a barrage of false content, with their scattershot mix of policies, fact-checkers, and algorithms, one of the web's most robust weapons against misinformation is an archaic-looking website written by anyone with an internet connection, and moderated by a largely anonymous crew of volunteers. "I think there's a part of that that is encouraging, that says that a radically open, collaborative worldwide project can build one of the most trusted sites on the internet," says Ryan Merkley, the chief of staff at the Wikimedia Foundation, the 400-person nonprofit that provides support to Wikipedia's community of editors. "There's another piece of that that is quite sad," he adds, "because it's clear that part of being one of the most trusted sites on the internet is because everything else has collapsed around us...." [U]nlike parts of the web where toxic information tends to spread, the encyclopedia has one big advantage: Its goal is not to "scale." It's not selling anything, not incentivizing engagement, not trying to get you to spend more time on it. Thanks to donations from thousands of donors around the world, there are no advertisers or investors to please, no algorithms to gather data or stir up emotions or personalize pages; everyone sees the same thing. That philanthropic spirit drives Wikipedia's volunteers, too, who come to the website not to share memes or jokes or even discuss the news but, marvelously, to build a reliable account of reality.... Despite the trolls and propagandists, the majority of errors, especially on controversial and highly trafficked pages, go away within minutes or hours, thanks to its phalanx of devoted volunteers. (Out of Wikipedia's 138 million registered users, about 138,000 have actively edited in the past month.) The site is self-governed according to a Byzantine body of rules that aim for courtesy and a "show your work" journalistic ethics built on accurate and balanced reporting. Vigilant community-built bots can alert Wikipedians to some basic suspicious behavior, and administrators can use restrictions to temporarily lock down the most vulnerable pages, keeping them safe from fly-by editors who are not logged in. "Most of these edits are small improvements to phrasing or content," says a 73-year-old retired physicist from Massachusetts who's done hundreds of edits himself. He adds that "a few are masterpieces, and some are vandalism."' -- source: https://news.slashdot.org/story/20/03/09/0346251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Says it Will Generate Random Browser Fingerprints To Preserve User Privacy
by Peter Reutemann 10 Mar '20

10 Mar '20

'The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.' -- source: https://yro.slashdot.org/story/20/03/09/1822258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0