- wlug - list.wlug.org.nz

Mozilla Kills Its Experimental Firefox Test Pilot Program 3 Years After Launch
by Peter Reutemann 16 Jan '19

16 Jan '19

'Mozilla has announced that it is closing Firefox Test Pilot, an experimental program it launched three years ago. Firefox Test Pilot allowed users to try out potential new built-in Firefox features to understand if they are popular with users. The company says the program was used by an average of 100,000 daily users. A report adds: It's worth noting here that Test Pilot is separate from the various beta versions of Firefox, which are early iterations designed to fine-tune features intended for the prime-time Firefox. Test Pilot, on the other hand, is more about Mozilla dipping its toes in the water to see whether a new feature is worth pursuing at all in the main version of the app, or even as a standalone product. Ultimately, it allows Firefox developers to take bigger risks with their ideas.' -- source: https://news.slashdot.org/story/19/01/16/1752250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Guy Made a Computer Mouse That is Also a Functional Laptop
by Peter Reutemann 14 Jan '19

14 Jan '19

'A YouTube user who goes by Electronic Grenade has designed a computer mouse that is also a functional laptop. From a report: As detailed in a video published on Sunday, the computer mouse computer consists of a 3d-printed mouse, a Raspberry Pi microcontroller, a small keyboard, and a handful of components that were taken from a normal computer mouse. "Even though the screen is attached to the mouse, the sensitivity of the mouse makes it not that hard to follow along with what is happening on the screen," Electronic Grenade said in the video. Nevertheless, the mouse does have its faults. According to Electronic Grenade, a few resource intensive applications will occasionally cause the mouse computer to crash.' -- source: https://it.slashdot.org/story/19/01/14/1656224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gimp presentation
by John 14 Jan '19

14 Jan '19

Hi All, Is anyone prepared to share their knowledge on some of the aspects of Gimp at one of the meetings. My particular interests are: Working with layers. Creating and editing animations. Quick and dirty brush tips Air brush settings etc. Cheers John..

2 2

GNOME Internet Radio Locator 1.6.0 Released
by Peter Reutemann 14 Jan '19

14 Jan '19

'GNOME Internet Radio Locator 1.6.0 is now freely available for GNOME systems. The 1.6.0 release is a stable release with Internet radio stations from Norway, Sweden, Denmark, England, Scotland, France and Belgium, as well as U.S.A., Canada, Mexico and Guatemala, mapped for GNOME Maps and city text search interface with auto-completion for 76 world cities that are featured in this release. You may download the 1.6.0 release of GNOME Internet Radio Locator here and download packages for Fedora 28 and 29 on x86_64 here' -- source: https://tech.slashdot.org/story/19/01/13/209247 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vga..
by John 12 Jan '19

12 Jan '19

Hi All, If anyone has a VGA cable that they do not love anymore could you please bring to the meeting for me as I just gave my one to my neighbor. Dumb I know but that is what I do all the time... Cheers John..

2 1

Robocall -- New Kind Of Scammer?
by Lawrence D'Oliveiro 12 Jan '19

12 Jan '19

I just received an odd phone call which just played a (somewhat muffled and over-compressed) recorded message saying something like “This is Spark NZ informing you that your internet service is going to be terminated. For further information press 1, or press 2 for other queries.” After a few seconds, during which I did nothing, it hung up. I think I may have received a similar call maybe 2-3 weeks ago, because I heard a voice speaking on top of my recorded voice telling the caller to leave a message, but I was too far away at the time to make out what was being said.

3 4

Malware Found Preinstalled On Some Alcatel Smartphones
by Peter Reutemann 11 Jan '19

11 Jan '19

'A weather app that comes preinstalled on Alcatel smartphones contained malware that surreptitiously subscribed device owners to premium phone numbers behind their backs. The app, named "Weather Forecast-World Weather Accurate Radar," was developed by TCL Corporation, a Chinese electronics company that among other things owns the Alcatel, BlackBerry, and Palm brands. The app is one of the default apps that TCL installs on Alcatel smartphones, but it was also made available on the Play Store for all Android users --where it had been downloaded and installed more than ten million times. But at one point last year, both the app included on some Alcatel devices and the one that was available on the Play Store were compromised with malware. How the malware was added to the app is unclear. TCL has not responded to phone calls requesting comment made by ZDNet this week. The app reportedly harvested users' data and sent it to China. It collected geographic locations, email addresses, and IMEI codes, which it sent back to TCL. Upstream, a UK-based mobile security firm, also found that "the malicious code hidden inside the app would also attempt to subscribe users to premium phone numbers that incurred large charges on users' phone bills," reports ZDNet. "All in all, the company says it detected and blocked over 27 million transaction attempts across seven markets, which would have created losses of around $1.5 million to phone owners if they hadn't been blocked." Upstream notes that most of the behavior they've seen originated only from two types of smartphones: Pixi 4 and A3 Max models.' -- source: https://it.slashdot.org/story/19/01/10/2117234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet
by Peter Reutemann 10 Jan '19

10 Jan '19

'Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws.' -- source: https://linux.slashdot.org/story/19/01/10/1759253 BTW This is an FYI, not a reason to start a flame war again... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tool Automates Phishing Attacks That Bypass 2FA
by Peter Reutemann 09 Jan '19

09 Jan '19

'A new penetration testing tool published at the start of the year by a security researcher can automate phishing attacks with an ease never seen before and can even blow through login operations for accounts protected by two-factor authentication (2FA). From a report: Named Modlishka --the English pronunciation of the Polish word for mantis -- this new tool was created by Polish researcher Piotr Duszynski. Modlishka is what IT professionals call a reverse proxy, but modified for handling traffic meant for login pages and phishing operations. It sits between a user and a target website -- like Gmail, Yahoo, or ProtonMail. Phishing victims connect to the Modlishka server (hosting a phishing domain), and the reverse proxy component behind it makes requests to the site it wants to impersonate. The victim receives authentic content from the legitimate site --let's say for example Google -- but all traffic and all the victim's interactions with the legitimate site passes through and is recorded on the Modlishka server.' -- source: https://it.slashdot.org/story/19/01/09/1817234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash-5.0 release available
by Peter Reutemann 08 Jan '19

08 Jan '19

'This release fixes several outstanding bugs in bash-4.4 and introduces several new features. The most significant bug fixes are an overhaul of how nameref variables resolve and a number of potential out-of-bounds memory errors discovered via fuzzing. There are a number of changes to the expansion of $@ and $* in various contexts where word splitting is not performed to conform to a Posix standard interpretation, and additional changes to resolve corner cases for Posix conformance. The most notable new features are several new shell variables: BASH_ARGV0, EPOCHSECONDS, and EPOCHREALTIME. The `history' builtin can remove ranges of history entries and understands negative arguments as offsets from the end of the history list. There is an option to allow local variables to inherit the value of a variable with the same name at a preceding scope. There is a new shell option that, when enabled, causes the shell to attempt to expand associative array subscripts only once (this is an issue when they are used in arithmetic expressions). The `globasciiranges' shell option is now enabled by default; it can be set to off by default at configuration time. There are a few incompatible changes between bash-4.4 and bash-5.0. The changes to how nameref variables are resolved means that some uses of namerefs will behave differently, though I have tried to minimize the compatibility issues. By default, the shell only sets BASH_ARGC and BASH_ARGV at startup if extended debugging mode is enabled; it was an oversight that it was set unconditionally and caused performance issues when scripts were passed large numbers of arguments.' -- source: http://lists.gnu.org/archive/html/bug-bash/2019-01/msg00063.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1