- wlug - list.wlug.org.nz

FSF Plans to Launch 'Forge', a Code-Hosting/Collaboration Platform
by Peter Reutemann 09 Mar '20

09 Mar '20

'The Free Software Foundation (FSF) announced plans to launch a public code hosting and collaboration platform ("forge") this year. Members of the FSF tech team are currently reviewing ethical web-based software that will help teams work on their projects, with features like merge requests, bug tracking, and other common tools. "Infrastructure is very important for free software, and it's unfortunate that so much free software development currently relies on sites that don't publish their source code, and require or encourage the use of proprietary software," FSF wrote in a blog post. "Our GNU ethical repository criteria aim to set a high standard for free software code hosting, and we hope to meet that with our new forge." As of now, the team said it has been researching a list of candidate programs and analyzing them in terms of ethical and practical criteria. The FSF blog post adds that "We plan on contributing improvements upstream for the new forge software we choose, to boost its score on those criteria... "We'll communicate with the upstream developers to request improvements and help clarify any questions related to the ethical repository criteria."' -- source: https://developers.slashdot.org/story/20/03/08/0323217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Blu-ray discs on Linux
by Ian Young 08 Mar '20

08 Mar '20

Hello all, Having acquired a laptop with a Blu-ray drive and then a Blu-ray disc I had a go at playing the disc with various live Linux versions. The closest was having the disc recognised and opening a player window (VLC iirc) but alas with no sound or vision. Other attempts failed with messages about no AACs being available or being unable to recognise the disc. A cursory survey of various web sources indicates that the best plan is to give up or use Windows. Anyone managed to get anywhere with this in Linux? The disc in question is by the band King Crimson live in Mexico titled Meltdown. Described as NTSC, Zone ABC, LPCM playable in all B-R players and drives. Thanks ~ Ian Y

2 1

FreeNAS and TrueNAS Are Merging
by Peter Reutemann 08 Mar '20

08 Mar '20

'FreeNAS is a free and open source operating system designed for network-attached storage (NAS) devices. For much of the past decade, the project has been led by the folks at iXsystems, which has also produced an enterprise version of the software called TrueNAS. Now iXsystems has announced that FreeNAS and TrueNAS are merging. Moving forward there will be a single operating system called TrueNAS rather than two different, but closely related operating systems. According to the company, the latest versions of the operating systems (FreeNAS 11.3 and TrueNAS 11.3) already share about 95-percent of the same source code. Starting with TrueNAS 12, there will only be a single OS image. But the company will offer two editions: TrueNAS CORE: open source edition TrueNAS Enterprise: commercial version with enterprise management and support.' -- source: https://news.slashdot.org/story/20/03/06/234216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

EFF: .Org Sale 'Threatens Instability and Dysfunction'
by Peter Reutemann 08 Mar '20

08 Mar '20

'In a scathing editorial, EFF continues to oppose Ethos Capital's plan to buy the PIR's .org domain registry for $1.1 billion, arguing that "the current system is stable and functional, and changing it threatens to introduce instability and dysfunction with no countervailing benefit to the community..." "[W]hile there is nothing currently wrong with .ORG, there is a lot that could go wrong if this deal moves forward." Ethos and PIR have repeatedly defended the proposed deal by arguing that converting PIR to a privately owned, for-profit enterprise will allow it to offer "new products and services," but without explaining what those new offerings might be. On Thursday, they finally admitted that they actually don't know what additional products and services .ORG registrants want or need, citing a lack of market research... The for-profit PIR that Ethos envisions would be a fundamentally different organization than today's PIR, and we have serious concerns about its business model and financial stability. Nothing we've heard from PIR and Ethos has convinced us that PIR should be transformed from something that we all know works to something that's unproven. To the contrary, the Ethos deal raises concrete dangers of censorship, financial and technical instability, and price-gouging of non-commercial .ORG registrants. And despite making their case for months, proponents of the deal haven't identified any specific benefits it would impart to .ORG users. ICANN can, and should, reject this change to the .ORG registry. But that time is running out; ICANN's current deadline to make a decision is Friday, March 20. You can still speak out: the ICANN Board is holding a public forum next week, Monday March 9 at 10am-11:30am Eastern Daylight Time. Anyone can join by videoconference and address the Board.' -- source: https://yro.slashdot.org/story/20/03/07/0619231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Edge Browser Scores Worst in Test of Telemetry Privacy
by Peter Reutemann 08 Mar '20

08 Mar '20

'"New academic research published last month looked at the phone-home [telemetry] features of six of today's most popular browsers and found that the Brave browser sent the smallest amount of data about its users back to the browser maker's servers," reports ZDNet: The research, conducted by Douglas J. Leith, a professor at Trinity College at the University of Dublin, looked at Google Chrome, Mozilla Firefox, Apple Safari, Brave, Microsoft Edge (the new Chromium-based version), and the Yandex Browser. "In the first (most private) group lies Brave, in the second Chrome, Firefox, and Safari, and in the third (least private) group lie Edge and Yandex...." [T]he professor found evidence that Chrome, Firefox, and Safari all tagged telemetry data with identifiers that were linked to each browser instance. These identifiers allowed Google, Mozilla, and Apple to track users across browser restarts, but also across browser reinstalls... [T]he most intrusive phoning-home features were found in the new version of Microsoft Edge and the official Yandex Browser. According to Prof. Leith, both used unique identifiers that were linked to the device's hardware, rather than the browser installation. Tracking users by hardware allows Microsoft and Yandex to follow users across installations and potentially link browser installs with other apps and online identities. The professor said that Edge collected the hardware UUID of the user's computer, an identifier that cannot be easily changed or deleted without altering a computer's hardware. Similarly, Prof. Leith also found that Yandex transmitted a hash of the hardware serial number and MAC address to its backend servers. "As far as we can tell this behaviour [in Edge and Yandex] cannot be disabled by users," the professor said. The article also points out that Brave was the only browser that didn't use search autocomplete functionality to collect and send back information on a user's visited web pages. (Even though this can be disabled in Firefox, Chrome, and Safari, it's on by default.) But Edge and Yandex "also sent back information about visited web pages that did not appear to be related to the search autocomplete feature, suggesting the browsers had other ways to track users' browsing habits."' -- source: https://apple.slashdot.org/story/20/03/07/0054219 A couple of articles on how to turn off telemetry within Firefox: https://www.askvg.com/tip-disable-telemetry-and-data-collection-in-mozilla-… https://www.howtogeek.com/557929/how-to-see-and-disable-the-telemetry-data-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Could Have Fixed 2FA Code-Stealing Flaw in Authenticator App Years Ago
by Peter Reutemann 08 Mar '20

08 Mar '20

'Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT). Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.' -- source: https://tech.slashdot.org/story/20/03/07/0918212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hack Turns Apple's iPhone Into An Android
by Peter Reutemann 07 Mar '20

07 Mar '20

'Ten years ago, David Wang pulled off a remarkable trick, installing Android on the first-generation iPhone. Now Wang and his colleagues at cybersecurity startup Corellium are doing it again with the ostentatiously titled Project Sandcastle. From a report: And Forbes got an exclusive hands-on look at their Android for iPhone product ahead of its public release scheduled for later this Wednesday. The timing is sure to have Apple fanboys rubbernecking: Corellium is in the middle of being sued by Apple. As previously reported by Forbes, in August last year, Corellium was taken to court over Apple claims the startup breached copyright laws by creating software versions of the iPhone for security and testing. The case took a surprise turn late last month when Apple subpoenaed Spanish banking giant Santander and the $50 billion U.S. military and intelligence contractor L3Harris. But Corellium has lofty ambitions for Project Sandcastle, saying that it'll actually show how Apple's walled garden, which it has fiercely protected since launching its flagship phone in 2007, can be deconstructed and taken over by others' software. "Project Sandcastle is about having fun building something new from the sand -- from the literal silicon of the hardware," said Corellium CEO Amanda Gorton, in a statement sent to Forbes. "Apple restricts iPhone users to operate inside a sandbox, but users own that hardware, and they should be able to use that hardware the way they want. So where sandboxes create limits and boundaries on the hardware that users own, sandcastles provide an opportunity to create something new and wonderful from the limitless bounds of your imagination."' -- source: https://apple.slashdot.org/story/20/03/06/1954210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not All CUDA At The High End
by Lawrence D'Oliveiro 06 Mar '20

06 Mar '20

This item <https://www.nextplatform.com/2020/03/05/software-evolution-on-ornls-summit-…> reports on an interview with Dr Tjerk Straatsma, group lead for scientific computing at ORNL. Seems their supers have made heavy use of NVidia GPUs up to now, but this is set to change: Frontier, the next system for the OLCF, will have AMD CPUs and GPUs. To prepare for this system, software developers may want to make changes to their programming approach, with OpenMP directive-based and HIP native offloading as the most comparable to the OpenACC and CUDA approaches on Summit today. I wonder what happened to OpenCL as the cross-platform architecture for GPU computing?

1 0

Let’s Encrypt changes course on certificate revocation
by Peter Reutemann 06 Mar '20

06 Mar '20

'Earlier this week, Let's Encrypt announced that it would revoke roughly three million—2.6 percent—of its currently active certificates. Last night, however, the organization announced that it would delay the revocation of many of those certificates in the interest of Internet health. The impact of the revocation on system administrators was and is significant due to the very short window of maintenance allowed before the revocation went into effect. Roughly thirty-six hours were available from the initial announcement to the beginning of scheduled certificate revocation. Half an hour prior to the scheduled revocations, more than one million affected certificates had still not been renewed, and Let's Encrypt announced an additional delay to give administrators more time.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-holds-o… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Almost Half of Mobile Malware Are Hidden Apps
by Peter Reutemann 06 Mar '20

06 Mar '20

'Certain apps are hiding themselves and stealing resources and data from mobile devices, according to a new report by security firm McAfee. From a report: This is a growing threat comprising almost half of all malicious mobile malware, and a 30% increase from 2018, said Raj Samani, chief scientist and McAfee fellow, who authored the Q1 2020 McAfee Mobile Threat Report. "This shows where the focus from criminals [is] on the mobile platform, which is in stark contrast to non-mobile malware,'' Samani said. A new malware family called LeifAccess or Shopper is taking advantage of the accessibility features in Android to create accounts, download apps, and post reviews, according to the report. LeifAccess, "is a broad campaign [and] is using alternate methods to achieve installation but thereafter trying to achieve legitimacy to the user with fake warnings," Samani said. For example, LeifAccess does not create an icon or shortcut, "so it's not immediately obvious that the app is installed ... but for some of the hidden apps within the report, malicious mobile attacks will even masquerade as a legitimate app," he said.' -- source: https://it.slashdot.org/story/20/03/04/2021233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ampere Altra is the First 80-core ARM-based Server Processor
by Peter Reutemann 06 Mar '20

06 Mar '20

'Ampere has unveiled the industry's first 80-core ARM-based 64-bit server processor today in a bid to outdo Intel and Advanced Micro Devices in datacenter chips. From a report: Ampere announced today that it has begun providing samples of the Ampere Altra processor for modern cloud and edge computing datacenters. The Ampere Altra processor runs on 210 watts and is targeted at such server applications as data analytics, artificial intelligence, database, storage, telco stacks, edge computing, web hosting, and cloud-native applications. Intel dominates about 95.5% of the server chip market with its x86-based processors, and AMD has the rest. But Ampere is targeting power-efficient, high-performance, and high-memory capacity features. Renee James, former president of Intel and CEO of Ampere, said in an interview with VentureBeat that the chip is faster than a 64-core AMD Epyc processor and Intel's 28-core high-end Xeon "Cascade Lake" chip.' -- sources: https://hardware.slashdot.org/story/20/03/04/2027230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CSME Bug Worse Than Previously Thought
by Peter Reutemann 06 Mar '20

06 Mar '20

'Security researchers say that a bug in one of Intel's CPU technologies that was patched last year is actually much worse than previously thought. From a report: "Most Intel chipsets released in the last five years contain the vulnerability in question," said Positive Technologies in a report published today. Attacks are impossible to detect, and a firmware patch only partially fixes the problem. To protect devices that handle sensitive operations, researchers recommend replacing CPUs with versions that are not impacted by this bug. Only the latest Intel 10th generation chips are not vulnerable, researchers said. The actual vulnerability is tracked as CVE-2019-0090, and it impacts the Intel Converged Security and Management Engine (CSME), formerly called the Intel Management Engine BIOS Extension (Intel MEBx). ' -- source: https://it.slashdot.org/story/20/03/05/149222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GCHQ’s Advice For Securing Smart-Home Gadgets
by Lawrence D'Oliveiro 05 Mar '20

05 Mar '20

For those who can’t be bothered trying to understand the ins and outs of security concerns with “Internet-Of-Things” devices <https://www.theregister.co.uk/2020/03/03/ncsc_smart_gadget_security_tips/> such as cameras and baby monitors, GCHQ advises: * If your camera comes with a default password, change it to a secure one – connecting three random words which you'll remember is a good way to do this. You can usually change your password using the app you use to manage the device. * Keep your camera secure by regularly updating security software. Not only does this keep your devices secure, but often adds new features and other improvements. * If you do not use the feature that lets you remotely access the camera from the internet, it is recommended you disable it.

1 0

Let’s Encrypt discovers CAA bug, must revoke customer certificates
by Peter Reutemann 05 Mar '20

05 Mar '20

'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code. The bug opens up a window of time in which a certificate might be issued even if a CAA record in that domain's DNS should prohibit it. As a result, Let's Encrypt is erring on the side of security and safety rather than convenience and revoking any currently issued certificates it can't be certain are legitimate, saying: Unfortunately, this means we need to revoke the certificates that were affected by this bug, which includes one or more of your certificates. To avoid disruption, you'll need to renew and replace your affected certificate(s) by Wednesday, March 4, 2020. We sincerely apologize for the issue. If you're not able to renew your certificate by March 4, the date we are required to revoke these certificates, visitors to your site will see security warnings until you do renew the certificate.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-revokin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Microsoft Retiring MCSA/MCSD/MCSE Certifications
by Lawrence D'Oliveiro 04 Mar '20

04 Mar '20

Came across this Microsoft article <https://www.microsoft.com/en-us/learning/community-blog-post.aspx?BlogId=8&…> (linked from this YouTube video <https://www.youtube.com/watch?v=laaGuJItNCM>) explaining that Microsoft is “retiring” its more broad-based MCSA, MCSD and MCSE certifications in favour of a range of narrower, “role-based” ones. You’ll notice in the diagram on that page that everything starts with the cloud now: Azure, Dynamics 365 and Microsoft 365. And as we know, Microsoft has previously admitted that Azure is more about Linux instances rather than Windows ones. Myself, I never understood the emphasis on vendor-specific certifications. They have a short shelf-life, requiring continual “refreshing” or “updating” to new product versions--basically another revenue stream for the vendor.

1 0

Cisco: Avoid Coronavirus, Stay Home, Use Webex
by Peter Reutemann 04 Mar '20

04 Mar '20

'Ars Technica: Networking giant Cisco is getting into the coronavirus monitoring and mitigation game with its Webex remote meeting property. The company notes that in the wake of mandates issued to employees to halt travel plans and/or work from home, traffic across its Webex backbone has increased significantly. Webex meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began; traffic in other Asian countries is up by 400 percent or more, and free signup rates in impacted countries have increased 700 percent or more. In response, Cisco is offering temporarily unlimited usage (with no time restrictions) in all countries where the service is available (full list here), not just the ones worst hit by coronavirus. The company is also offering free 90-day licenses to businesses that are not currently Webex customers and offering free upgrades to customers whose current plan is insufficient to accommodate increased traffic due to the outbreak. In the worst affected countries, telepresence and remote work software like Webex is currently the only alternative to a complete shutdown of activities. In its press release, Cisco highlights the Nesbitt Center, an organization working with disabled young adults in Hong Kong. All Hong Kong schools, including the Nesbitt Center, have been required to suspend day programs during the outbreak. Webex videoconferencing has allowed the Nesbitt Center to continue delivering educational sessions despite the lockdown. Ars Technica also recommends Jitsi, a "free and open source software, offering video call and screen sharing capabilities." There's also Jitsi Meet for people "who just need to get something done on-the-fly with no setup at all." Do you have a favorite remote work software?' -- source: https://tech.slashdot.org/story/20/03/03/2013226/cisco-avoid-coronavirus-st… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If You Like RSS, You'll Love Fraidycat
by Peter Reutemann 04 Mar '20

04 Mar '20

'J. Fergus, writing for Input: Someone finally did it. We can now follow who we want on our own terms and get that information chronologically. Fraidycat is an app and browser extension that allows just that. Though it launched in November 2019, Fraidycat recently got a massive update, widening its compatibility and adding a dark mode. The open-source tool, brought to you by Kicks Condor, is available for Linux, Mac, and Windows in addition to Mozilla Firefox and Chrome as an extension. Fraidycat definitely pulls from RSS feeds more easily, but it also works on Twitter, Instagram, and SoundCloud. You drop the link to the account you'd like to follow -- from Medium bloggers to Twitch streamers to vision board Pinterest-ers -- and set how frequently you'd like to see their posts. Label it, hit save, and posts will appear as often as you'd like. The recent update notably folds Kickstarter into the mix and collapses Twitter threads for readability.' -- source: https://tech.slashdot.org/story/20/03/03/1441254 Personally, I use the "Feeder" app on my phone for my RSS feeds: https://f-droid.org/en/packages/com.nononsenseapps.feeder/ But Fraidycat looks like an interesting project. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox: removing "Save link to Pocket" menu item
by Peter Reutemann 04 Mar '20

04 Mar '20

Hi everyone Ever got annoyed at the "Save link to Pocket" in Firefox's right-click popup menu? In case you don't use that feature (like me), here's how you can turn it off (and also re-enable): https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox It boils down to toggling the following setting ("about:config"): extensions.pocket.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Freedb.org Is Shutting Down
by Peter Reutemann 03 Mar '20

03 Mar '20

'Freedb, the community-generated database of music CD metadata, is shutting down on March 31, 2020. The service was set up as a free alternative to CDDB. Many CD-ripping applications pull metadata from Freedb to save the user having to type it in manually, but the service has some major limitations and has now been superseded by MusicBrainz. This wouldn't be the first time Freedb shut down. In 2006, the site shut down due to a disagreement among its developers, only to be brought back to life a few months later. It's unclear why Freedb is shutting down after all these years.' -- source: https://developers.slashdot.org/story/20/03/02/2245216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Have I Been Pwned' Is No Longer For Sale
by Peter Reutemann 03 Mar '20

03 Mar '20

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced in a blog post today that his website is no longer being sold and will continue running independently. The news comes several months after Hunt announced he was actively looking for a buyer. Last June, Hunt wrote: "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat. It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Now, according to Hunt, "unexpected changes" with the business model of the party believed to be the purchaser of the service "made the deal infeasible." "It wasn't something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers," writes Hunt in today's blog post. Hunt goes on to explain what's been happening since April 2019 and how the service will operate in the future. ' -- source: https://it.slashdot.org/story/20/03/02/2148230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Update On Microsoft's 'GitHub Arctic Vault Program'
by Peter Reutemann 02 Mar '20

02 Mar '20

'news.com.au reports: The GitHub Arctic Vault program is part of the now Microsoft-owned code repository GitHub...aimed at preserving the information for generations to come... "We chose to store GitHub's public repositories in the Arctic World Archive in Svalbard [a Norwegian island] because it is one of the most remote and geopolitically stable places on Earth and is about a mile down the road from the famous Global Seed Vault," said GitHub vice president of special projects Thomas Dohmke. Mr Dohmke said open source code in particular was worth preserving... "Ultimately, it's time to create multiple durable backups of the software our world depends on..." Other treasures include the original source code for MS-DOS (the precursor to Microsoft Windows), the open source code that powers Bitcoin, Facebook's React, and the publishing platform Wordpress... "The Arctic Code Vault was just the beginning of the GitHub Archive Program's journey to secure the world's open source code," GitHub vice president of special projects Thomas Dohmke told news.com.au. "We've partnered with multiple organisations and advisers to help us maximise the GitHub Archive Program's value and preserve all open-source software for future generations." One of those partners is Norwegian archival experts Piql, who specialise in very-long-term data storage. The company uses around 200 silver halide and polyester film reels designed to last a thousand years to store the information... ' -- source: https://developers.slashdot.org/story/20/03/01/2015212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostcat Bug Impacts All Apache Tomcat Versions Released in the Last 13 Years
by Peter Reutemann 01 Mar '20

01 Mar '20

'Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.' -- source: https://apache.slashdot.org/story/20/02/28/184218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Domain Costs Going Up
by Lawrence D'Oliveiro 29 Feb '20

29 Feb '20

InternetNZ is seeing fewer registrations of .nz domains, so it is raising prices <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123126…>. Apparently some are using .kiwi, and others are simply setting up pages on Facebook instead.

1 0

How Melissa Di Donato Is Going To Reinvent SUSE
by Peter Reutemann 28 Feb '20

28 Feb '20

'SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.' -- source: https://www.linux.com/topic/open-source/how-melissa-di-donato-is-going-to-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Linux Computer Gets Twice the RAM and USB-C Power Fix
by Peter Reutemann 28 Feb '20

28 Feb '20

'Brian Fagioli, writing for BetaNews: The Raspberry Pi line has provided great little Linux computers to nerds -- its low price and small size makes it ideal for tinkering and doing projects. But also, the device has proven to be a solid media device, wonderful for watching videos and emulating classic video games. In other words, it has been a very versatile computer, serving as many things to many people. With the release of the Raspberry Pi 4, however, it finally became powerful enough to serve as a true desktop computer. By installing a Linux distribution, some people can use it for day-to-day computer use, such as web browsing, playing media, and word processing. Unfortunately, the $35 base model came with a paltry 1GB of RAM. Today, this changes, as the company has dropped the price of the 2GB version to $35, effectively doubling the memory for the base model.' -- source: https://linux.slashdot.org/story/20/02/27/1520258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0