- wlug - list.wlug.org.nz

Google Fixes No-User-Interaction Bug In Android's Bluetooth Component
by Peter Reutemann 08 Feb '20

08 Feb '20

'Google has patched this week a critical security flaw in Android's Bluetooth component. If left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms. Researchers said that exploiting the bug requires no user interaction. All that is required is that the user has Bluetooth enabled on his device. However, while this requirement would have limited the attack surface in past years, it does not today since modern Android OS versions ship with Bluetooth enabled by default and many Android users use Bluetooth-based headphones meaning the Bluetooth service is likely to be enabled on many handsets. The bug can lead to remote code execution and the hijacking of a device. Fixes for the bug are available via the Android February 2020 Security Bulletin, which has been available for download starting this week. Android 9 and earlier are impacted.' -- source: https://tech.slashdot.org/story/20/02/07/0220203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing Disk Performance With fio
by Lawrence D'Oliveiro 07 Feb '20

07 Feb '20

Intro to a tool I hadn’t heard of before <https://arstechnica.com/gadgets/2020/02/how-fast-are-your-disks-find-out-th…>, but for which standard packages are available for Debian and derivatives. Lets you do all kinds of performance tests on your persistent storage (disks, SSDs), including hammering them with multiple concurrent I/O requests. Also I see Debian has “gfio”, which is a GUI front end based on GTK. (Just a quick *sigh* to see someone else use the old cliché of referring to magnetic media as “rust”. FYI, rust isn’t magnetic.)

2 1

Google Does Badly
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Kind of fun to read this report <https://www.aljazeera.com/ajimpact/alphabet-shares-fall-google-misses-sales…>, saying Google’s parent company Alphabet had its “worst fourth-quarter revenue growth since 2015”. Then you look at the numbers, showing ad revenue was up about 17% year-on-year, and while costs also went up: That left profit of $10.67bn, or $15.35 per share, compared with the analysts' average estimate of $8.787bn, or $12.53 per share. That’s right, Google was substantially *more* profitable than analysts were expecting. And yet its share price still apparently fell 3% after the news came out. That’s Wall Street for you...

1 0

A Reminder Of Why Removable Disk Packs Went Out Of Fashion
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

Tricky things, removeable storage devices. Requiring fine tolerances between medium and drive is just asking for trouble. Here <https://www.theregister.co.uk/2020/02/03/who_me/> is a story of how a crash in one removeable 1960s-era unit ended up destroying a whole string of disk drives. I can remember also reading, in an old Computer Centre bulletin from an Australian university archived on Bitsavers, an item on their policy on removeable drive cartridges: you could only use cartridges allocated by them, you were not allowed to bring in cartridges from elsewhere. A similar thing happened to me, when the Zip drive in my 1998-vintage PowerMac G3 developed the infamous “click of death”, I only killed a couple of cartridges before I realized I should never use that drive again. Nowadays we have SD cards and hot-pluggable USB drives, which are a bit more robust against such failure modes. Or are they ... ?

1 0

Google Maps Hacks, Or, A Traffic Jam In A Cart
by Lawrence D'Oliveiro 04 Feb '20

04 Feb '20

A German artist named Simon Weckert has tricked Google Maps into thinking a major traffic jam was going on, simply by pulling a cart full of old mobile phones around Berlin <https://www.theregister.co.uk/2020/02/03/google_maps_hack_cartful_phones/>.

1 0

Cringely Predicts IBM 'Disappears Into Red Hat'
by Peter Reutemann 03 Feb '20

03 Feb '20

'Tech pundit Robert X. Cringely has been sharing technology predictions every January for over two decades -- and he made another big one on Friday: IBM has three divisions — Global Technology Services (GTS), Global Business Services (GBS), and Red Hat. GTS is the legacy IT business, GBS is the professional services business invented by Lou Gerstner to save IBM the last time it was in huge trouble, and Red Hat is Linux. GTS — that part of IBM most of us still think of as IBM — will probably be sold by summer. Either it will go to private equity (depends on the total debt load) or it will be sold to HPE or maybe to Oracle. Either way, it's not a likely success story, but [current CEO Ginni] Rometty has no real choice. IBM is, at this point, smoke, mirrors, and buybacks. The GTS windfall will land in Ginni's final quarter, juicing her payout, which might be the major point of the deal... IBM's new CEO is Arvind Krishna, formerly head of the Cognitive Computing unit — IBM's cloud guy. Except Cognitive Computing was never really cloud. Cognitive has been a mishmash of cloud, supported by revenue streams that are anything but cloud. It's cloud in name only and will be the part that goes next summer, possibly with Mr. Krishna still at its head. The next chairman of IBM after Rometty will be current Red Hat CEO Jim Whitehurst. If Whitehurst is as smart as I think he is, he started yesterday looking for a new job. It's not that he really intends to leave, but as the next savior of IBM, Ginni et al will pay anything to keep him. Cut your new deal now, Jim, while demand is greatest....Whitehurst will turn IBM into Red Hat, which will take HQ to North Carolina and mean most of the remaining GBS staff will be gone in a year... It still won't save IBM. They'll go down in the coming year or two along with the rest of the industry we used to call IT... Let's just say that IBM's loss is AWS's gain.' -- source: https://linux.slashdot.org/story/20/02/02/0448233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MIT Numerical Courses Moving From MATLAB To Julia
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Came across this <https://github.com/mitmath/julia-mit> repo, which is an intro to the Julia language. Apparently this is increasingly being used in place of MATLAB in numerical-computation courses at MIT. Why not Python? Because it is fine as long as you can use existing computational kernels, but as soon as you need custom ones, it gets slow if you do them in Python, or requires special skills to write them in C or Fortran, and make them callable from Python. Julia incorporates a “just-in-time” compiler using LLVM to achieve speed close to that of C in this case. Why not MATLAB? Because it is proprietary: Unlike Matlab, [Julia] is free/open-source software, which eliminates licensing headaches and allows you to look inside the Julia implementation to see how it works (since Julia is mostly written in Julia, its code is much more readable than a language like Python that is largely implemented in low-level C). They do like using Julia in Jupyter notebooks. I see a few .ipynb files in the repos for other courses (along with a few .pptx ones as well, unfortunately). Also several “.jmd” files, which look like some variety of markdown.

2 1

The State Of Video Streaming In NZ
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Apple’s TV+ streaming service is coming soon, followed by Disney’s one <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122666…>. Note: Disney+ will break Sky's longtime near-monopoly on Disney content in these parts. Disney says that, ultimately, Disney+ will be the exclusive home of its content. So to get a comparable range of TV content to that you currently have free-to-air, you are going to have to subscribe to two or three or maybe more different streaming services. The increasing multitude of things to pay for isn’t about choice, but about no choice at all.

1 2

Should Huawei Just Abandon Android?
by Peter Reutemann 03 Feb '20

03 Feb '20

'Due to a U.S. government ban on sales to Huawei, Google revoked its license for popular apps last spring (including Gmail and the Play Store). But this week Huawei executive Fred Wangfei suggested that even if that ban is lifted, Huawei would continue developing its own app ecosystem instead to avoid the possibility of future political complications. The vice president of risk management and partner relations at Huawei later called those remarks "incorrect," while elsewhere Huawei issued a slightly different statement -- that "An open Android ecosystem is still our first choice, but if we are not able to continue to use it, we have the ability to develop our own." But BGR was already noting that Huawei "is ready to invest $3 billion this year to incentivize more than 4,000 developers to improve its Huawei Mobile Services system. Another billion is reserved for marketing purposes." And Android Authority suggests Huawei should stick to its original statement. "Maybe it's time for Huawei to go all-in on Harmony OS and do what it can to bring a viable alternative to Android and iOS..." If there's any company today that has the financial resources and raw talent necessary to bring in a viable third choice for smartphone operating systems, it's Huawei... Sure, it would be a long-term investment and there would inevitably be short-term losses as the company tries to find its footing and develop Harmony OS to have its own identity. But it would prevent something like the Huawei ban from happening to the company again as well as further the company's ambitions as not only a smartphone manufacturer but as a technology creator.... Huawei would have major difficulties in encouraging wide adoption of Harmony OS for one major reason: it's Huawei. The Huawei ban exists because the United States government doesn't trust Huawei and there are numerous (as yet unproven) accusations against the company related to espionage, IP theft, fraud, and even violations of international treaties... Huawei is already in a bad situation. It's going to need to dig itself out of the hole it's in regardless, so why not use this opportunity to turn lemons into lemonade and develop Harmony OS as a viable third option on the way? Maybe the industry needs a shake-up... Maybe a new operating system is just the kind of fire OEMs need to turn the market around. Maybe a real, potent threat that the billions of people who use Android and iOS just might jump ship to something else would scare companies into taking some real risks. As I said earlier, there aren't too many companies out there right now that could do this, but Huawei could. ' -- source: https://tech.slashdot.org/story/20/02/01/0152225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Pulls WireGuard VPN into Linux 5.6 Kernel Source Tree
by Peter Reutemann 02 Feb '20

02 Feb '20

'"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar: While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities. While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android. Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration. Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.' -- source: https://it.slashdot.org/story/20/02/01/1846256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0