- wlug - list.wlug.org.nz

To Fight Spectre-Like Attacks, Intel Suggests a New Kind of Memory
by Peter Reutemann 06 Oct '19

06 Oct '19

'Intel researchers published a paper last week suggesting a new kind of CPU memory to block side-channel attacks like Meltdown and Spectre, according to ZDNet: SAPM -- or Speculative-Access Protected Memory -- is the work of Intel STORM (STrategic Offensive Research & Mitigations), a team of elite security researchers that Intel assembled since 2017 to work on creating mitigations for all the speculative-execution attacks that have impacted the CPU maker's products. SAPM is only an idea for the moment, and there are no silicon prototypes. Intel STORM engineers only released "the theory and possible implementation options," to provide "a ground base for other researchers to improve upon and also for the industry to consider...." Intel STORM researchers say SAPM will implement protections at the hardware level and will work with both physical and virtual memory addresses. "SAPM can be applied to specific memory ranges, with the attribute that any memory access to such memory type will be instruction-level serialized, meaning that any speculative execution beyond the SAPM-accessing instruction will be stopped pending the successful retirement of this SAPM-accessing instruction," Intel STORM developers said in their short description of SAPM's basic principles... Intel STORM researchers say the second part (backend) of most speculative execution attacks performs the same actions. SAPM was designed to introduce hardware-based protections against the backend part of most attacks. It's because of this concept that Intel's research team believes that SAPM will also future-proof the next generations of Intel CPUs against other -- currently undiscovered -- speculative execution attacks. "Intel STORM researchers don't deny that there's a performance hit," the article adds. "However, this impact is low and could be mitigated further by dropping other existing protections."' -- source: https://hardware.slashdot.org/story/19/10/05/0315201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

COSMO and Psions
by tom butz 06 Oct '19

06 Oct '19

The Psions were good as long as there was still a dial-up Internet around: they could even generate the DTMF-tones out of telephone-numbers and use them to dial using your phone's microphone. I've kept a 3c-model because of its database program. None of the Psions actually were phones. As they only supported dial-up Internet, I had a look for ISP's that still supported that, and found one (serving the Australian Outback). Unfortunately they didn't accept new customers. As far as second screens are concerned, a while ago there was a Finnish/Russian phone/PDA that had a black and white additional screen on its back. That one drew very little power and could be used for notes and - checking who called. Typing, however, was as clumsy as on any phone. The COSMO features a colour-screen on its back - coloured LEDs instead obviously would've been as user-friendly as Morse-code (for telling you who was calling, if you didn't want to open your phone). In a perfect world, developers would have come up with a Psion keyboard, Internet/WiFi/Bluetooth capability and a black and white screen at the back. Today's cameras are good at taking/watching photos/videos, and they are a lot less chunky.

1 0

Psion Reborn
by Lawrence D'Oliveiro 05 Oct '19

05 Oct '19

The Cosmo Communicator should be shipping to its backers next week <https://www.theregister.co.uk/2019/10/04/planet_launches_cosmo_communicator…>. It has more than a passing resemblance to the Psion clamshell pocket PCs of the 1990s, except this one has an open design, intended to allow it to run a choice of open-source operating systems. This looks to be a niche market, compared to the millions of units shipped by all the usual big-name vendors. But if they can make enough money--and keep enough customers happy--to stay in business, why not?

1 0

Award For “Most Spectacular Misuse Of Microsoft Excel”?
by Lawrence D'Oliveiro 04 Oct '19

04 Oct '19

Astronaut Tim Peake blames the spreadsheet for his dialling a wrong number during his stint on the International Space Station <https://www.theregister.co.uk/2019/10/02/future_decoded_peake/>: "I'm still blaming that on the software, I imported my contacts address book in Excel and all the 9s got rounded up to 0s…" Will people never learn <https://www.youtube.com/watch?v=S8wO4ppE9L8> ...

1 0

Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook's Apps
by Peter Reutemann 03 Oct '19

03 Oct '19

'Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety. From a report: A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication. Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook's plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling. "Security enhancements to the virtual world should not make us more vulnerable in the physical world," the letter reads. "Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes." The letter calls on Facebook to prioritize public safety in designing its encryption by enabling law enforcement to gain access to illegal content in a manageable format and by consulting with governments ahead of time to ensure the changes will allow this access. While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children."' -- source: https://it.slashdot.org/story/19/10/03/1847213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MorphOS 3.12 Released
by Peter Reutemann 03 Oct '19

03 Oct '19

'Mike Bouma shares a post from MorphZone, detailing the latest update to the AmigaOS-like computer operating system known as MorphOS: The MorphOS development team is proud to announce the public release of MorphOS 3.12. This new version introduces brand new dual-monitor capabilities to various Powerbook laptops as well as G5 desktop systems, and features improved thermal management, fan control and dynamic CPU frequency switching, which provide increased energy efficiency and reduced noise levels. Additionally, the Helios Firewire stack has been fully integrated into the core OS and we added support for hundreds of modern printers and scanners. The installation and troubleshooting guides should be carefully read prior to installation. You can download MorphOS 3.12 here.' -- source: https://tech.slashdot.org/story/19/10/02/219220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Ryzen Pro 3000 series desktop CPUs will offer full RAM encryption
by Peter Reutemann 02 Oct '19

02 Oct '19

'Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them. >From a more technical perspective, the answer is that the Ryzen Pro line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard—"a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory"—matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.' -- source: https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most mobile browsers display the Web, that’s it—Vivaldi Mobile can change that
by Peter Reutemann 01 Oct '19

01 Oct '19

'Vivaldi—makers of the power user's favorite Web browser—has finally released a mobile version. Vivaldi for Android (sorry iOS users, it's Android-only for now) brings most of what's great about Vivaldi to your phone, and thanks to Vivaldi's sync service, you can even have all your desktop data on your mobile device. Web browsers are perhaps the most important piece of software we use in 2019. Our devices are often little more than small windows onto the Web, and the browser is what we use to see and explore what's in that window. For all its importance though, the modern browser, especially the mobile Web browser, offers precious little in the way of features. It displays the Web and... that's about it. Want to interact with what you see? You're mostly out of luck. Most people probably like their browser this way. Google, maker of the most widely used mobile browser, rarely does anything without extensive user testing. If Chrome is minimalist, it's safe to assume it's that way because Google has determined that's what its users want. And since most other browsers copy whatever Google Chrome does, most mobile Web browsers end up as minimalistic pieces of software. On the desktop, of course, there has long been an exception to the uniformly dumbed-down offerings of Chrome, Firefox, and Safari—Vivaldi. Led by CEO Jon S. von Tetzchner, co-founder and former CEO of Opera, Vivaldi's primary goal is to build a useful browser, a tool you can bend to your will rather than the other way around. You can customize Vivaldi the way you like. Its preferences may be overwhelming at first glance, but if you dig in, you can make Vivaldi do just about whatever you want it to do. For this reason, Vivaldi is often called a "power user's browser" (as opposed to, I guess, the powerless user's browser). For all that, there was always one big problem with Vivaldi: it was desktop only. The company said it was working on a mobile version from the beginning, and von Tetzchner told me several times he was already using it. But there was nothing for the rest of us. Now Vivaldi Mobile is here (again, for Android users at least). Technically, it's a beta release and all the common cautions regarding beta software apply, but I've been using it for over a month now and have had no problems. Or, I should say, I have had problems, but updates prior to the public release eliminated all of them. And even if there were still bugs, Vivaldi would still be more useful than any other browser on my phone based on this recent testing—and yes, I've tried nearly all of today's mobile browsers, even the small, cottage efforts.' -- source: https://arstechnica.com/information-technology/2019/10/vivaldi-mobile-revie… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's DNS-Over-TLS Plans Scrutinized By US Congress
by Peter Reutemann 01 Oct '19

01 Oct '19

'Google's plans to implement DNS over TLS in Chrome are being investigated by a committee in the U.S. House of Representatives, while the Justice Department has "recently received complaints" about the practice, according to the Wall Street Journal. An anonymous reader quotes Engadget: While Google says it's pushing for adoption of the technology to prevent spying and spoofing, House investigators are worried this would give the internet giant an unfair advantage by denying access to users' data. The House sent a letter on September 13th asking if Google would use data handled through the process for commercial purposes... Internet service providers are worried that they may be shut out of the data and won't know as much about their customers' traffic patterns. This could "foreclose competition in advertising and other industries," an alliance of ISPs told Congress in a September 19th letter... Mozilla also wants to use the format to secure DNS in Firefox, and the company's Marshall Erwin told the WSJ that the antitrust gripes are "fundamentally misleading." ISPs are trying to undermine the standard simply because they want continued access to users' data, Erwin said. Unencrypted DNS helps them target ads by tracking your web habits, and it's harder to thwart DNS tracking than cookies and other typical approaches. ' -- source: https://tech.slashdot.org/story/19/09/29/2033247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

UK Court Rules That E-Mail Sig Blocks Can Sign Contracts
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

An e-mail exchange has been ruled to be a binding contract <https://www.theregister.co.uk/2019/09/30/email_signature_legally_binding_co…> because the senders included their names at the end, as people commonly do.

1 0