- wlug - list.wlug.org.nz

Native Americans Ask Apache Foundation To Change Name
by Peter Reutemann 12 Jan '23

12 Jan '23

'Natives in Tech, a US-based non-profit organization, has called upon the Apache Software Foundation (ASF) to change its name, out of respect for indigenous American peoples and to live up to its own code of conduct. The Register reports: In a blog post, Natives in Tech members Adam Recvlohe, Holly Grimm, and Desiree Kane have accused the ASF of appropriating Indigenous culture for branding purposes. Citing ASF founding member Brian Behlendorf's description in the documentary "Trillions and Trillions Served" of how he wanted something more romantic than a tech term like "spider" and came up with "Apache" after seeing a documentary about Geronimo, the group said: "This frankly outdated spaghetti-Western 'romantic' presentation of a living and vibrant community as dead and gone in order to build a technology company 'for the greater good' is as ignorant as it is offensive." And the aggrieved trio challenged the ASF to make good on its code of conduct commitment to "be careful in the words that [they] choose" by choosing a new name. The group took issue with what they said was the suggestion that the Apache tribe exists only in a past historical context, citing eight federally recognized Native American tribes that bear the name. In a statement emailed to The Register, an ASF spokesperson said, "We hear the concerns from the Native American people and are listening. As a non-profit run by volunteers, changes will need time to be carefully weighed with members, the board, and our legal team. Our members are exploring alternative ways to address it, but we don't have anything to share at this time."' -- source: https://apache.slashdot.org/story/23/01/11/2159256 Changing all the URLs, library names etc (and how that affects everyone downstream) sounds like a massive undertaking... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers discover that vulnerabilities are rife in the auto industry
by Peter Reutemann 12 Jan '23

12 Jan '23

'If you purchased a new car in the past few years, chances are good that it contains at least one embedded modem, which it uses to offer some connected services. The benefits, we've been told, are numerous and include convenience features like interior preheating on a cold morning, diagnostics that warn of failures before they happen, and safety features like teen driver monitoring. In some regions, connected cars are even mandatory, as in the European Union's eCall system. But if these systems sound like a potential security nightmare, that's because they often are. Ars has been covering car hacks for more than a decade now, but the problem really cemented itself in the public consciousness in 2015 with the infamous Jeep hacking incident, when a pair of researchers proved they could remotely disable a Jeep Cherokee while it was being driven, via an exploit in the SUV's infotainment system. Since then, security flaws have been found in some cars' Wi-Fi networks, NFC keys and Bluetooth, and in third-party telematics systems. Toward the end of 2022, a researcher named Sam Curry tested the security of various automakers and telematics systems and discovered security holes and vulnerabilities seemingly wherever he looked. Curry decided to explore the potential holes in the auto industry's digital infrastructure when he was visiting the University of Maryland last fall after playing around with an electric scooter's app and discovering that he could turn on the horns and headlights across the entire fleet. After reporting the vulnerability to the scooter company, Curry and his colleagues turned their attention to larger vehicles. [...] The researchers found extensive problems with 16 OEMs, telematics services like LoJack, new digital license plates, and even Sirius XM radio.' -- source: https://arstechnica.com/cars/2023/01/hackers-discover-that-vulnerabilities-… -- blog: https://samcurry.net/web-hackers-vs-the-auto-industry/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Messenger billed as better than Signal is riddled with vulnerabilities
by Peter Reutemann 11 Jan '23

11 Jan '23

'Academic researchers have discovered serious vulnerabilities in the core of Threema, an instant messenger that its Switzerland-based developer says provides a level of security and privacy “no other chat service” can offer. Despite the unusually strong claims and two independent security audits Threema has received, the researchers said the flaws completely undermine assurances of confidentiality and authentication that are the cornerstone of any program sold as providing end-to-end encryption, typically abbreviated as E2EE. Threema has more than 10 million users, which include the Swiss government, the Swiss army, German Chancellor Olaf Scholz, and other politicians in that country. Threema developers advertise it as a more secure alternative to Meta’s WhatsApp messenger. It’s among the top Android apps for a fee-based category in Switzerland, Germany, Austria, Canada, and Australia. The app uses a custom-designed encryption protocol in contravention of established cryptographic norms. Researchers from the Zurich-based ETH research university reported on Monday that they found seven vulnerabilities in Threema that seriously call into question the true level of security the app has offered over the years. Two of the vulnerabilities require no special access to a Threema server or app to cryptographically impersonate a user. Three vulnerabilities require an attacker to gain access to a Threema server. The remaining two can be exploited when an attacker gains access to an unlocked phone, such as at a border crossing.' -- source: https://arstechnica.com/information-technology/2023/01/messenger-billed-as-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Fairphone 2 Will Hit End-of-Life After 7 Years of Updates
by Peter Reutemann 11 Jan '23

11 Jan '23

'Ars Technica: It can be done. Android manufacturers can actually support a phone for a sizable amount of time. Fairphone has announced the end of life for the Fairphone 2, which will be March 2023. That phone was released in October 2015, so that's almost seven-and-a-half years of updates. Fairphone is a very small Dutch company with nowhere near as many resources as Google, Samsung, BBK, and the other Big-Tech juggernauts, yet it managed to outlast them with its support program. The whole goal of the company is sustainability, with easily repairable phones, available spare parts, and long update promises. The Fairphone 4 has a five-year hardware warranty and six years of updates, and the company's reputation says it can provide that. Sadly, the phones only ship in the UK and Europe. The Fairphone 2 only promised "three to five years" of updates, and it blew that out of the water. The Fairphone 2 features the Qualcomm Snapdragon 801 SoC, a chip that Qualcomm ended support for with Android 6.0. In what is probably an Android ecosystem first, that lack of chipset support didn't stop Fairphone, which teamed up with LineageOS and today ships Android 10 on the 7-year-old device. That's not the newest OS in the world, but it passes all of Google's Android compatibility tests. I'm sure there are newer amateur releases in the Android ROM community, but Fairphone's Android 10 build is up to the standard of an official release, as opposed to the "tell me what doesn't work" standard of many amateur ROM releases. Fairphone doesn't say why support is ending in March, but if it's staying on Android 10, it was going to have to kill support sometime this year. Google only supports security patches for the last four versions of Android, so even Google will be shutting down Android 10 support soon.' -- source: https://mobile.slashdot.org/story/23/01/10/2148222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ChatGPT is enabling script kiddies to write functional malware
by Peter Reutemann 10 Jan '23

10 Jan '23

'Since its beta launch in November, AI chatbot ChatGPT has been used for a wide range of tasks, including writing poetry, technical papers, novels, and essays and planning parties and learning about new topics. Now we can add malware development and the pursuit of other types of cybercrime to the list. Researchers at security firm Check Point Research reported Friday that within a few weeks of ChatGPT going live, participants in cybercrime forums—some with little or no coding experience—were using it to write software and emails that could be used for espionage, ransomware, malicious spam, and other malicious tasks. “It’s still too early to decide whether or not ChatGPT capabilities will become the new favorite tool for participants in the Dark Web,” company researchers wrote. “However, the cybercriminal community has already shown significant interest and are jumping into this latest trend to generate malicious code.” Last month, one forum participant posted what they claimed was the first script they had written and credited the AI chatbot with providing a “nice [helping] hand to finish the script with a nice scope.” The Python code combined various cryptographic functions, including code signing, encryption, and decryption. One part of the script generated a key using elliptic curve cryptography and the curve ed25519 for signing files. Another part used a hard-coded password to encrypt system files using the Blowfish and Twofish algorithms. A third used RSA keys and digital signatures, message signing, and the blake2 hash function to compare various files. The result was a script that could be used to (1) decrypt a single file and append a message authentication code (MAC) to the end of the file and (2) encrypt a hardcoded path and decrypt a list of files that it receives as an argument. Not bad for someone with limited technical skill.' -- source: https://arstechnica.com/information-technology/2023/01/chatgpt-is-enabling-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

New Linux Malware Downloader for Compromised Servers Spotted in the Wild
by Peter Reutemann 10 Jan '23

10 Jan '23

'"A new Linux malware downloader created using SHC (Shell Script Compiler) has been spotted in the wild," reports the site Bleeping Computer, "infecting systems with Monero cryptocurrency miners and DDoS IRC bots... "The analysts say the attacks likely rely on brute-forcing weak administrator account credentials over SSH on Linux servers.... " According to ASEC researchers, who discovered the attack, the SHC loader was uploaded to VirusTotal by Korean users, with attacks generally focused on Linux systems in the same country.... When the SHC malware downloader is executed, it will fetch multiple other malware payloads and install them on the device. One of the payloads is an XMRig miner that is downloaded as a TAR archive from a remote URL and extracted to "/usr/local/games/" and executed.... The second payload retrieved, dropped, and loaded by the SHC malware downloader is a Perl-based DDoS IRC bot. The malware connects to the designated IRC server using configuration data and goes through a username-based verification process. If successful, the malware awaits commands from the IRC server, including DDoS-related actions such as TCP Flood, UDP Flood, and HTTP Flood, port scanning, Nmap scanning, sendmail commands, process killing, log cleaning, and more. ASEC warns that attacks like these are typically caused by using weak passwords on exposed Linux servers. ' -- source: https://linux.slashdot.org/story/23/01/07/0427247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Launches Higher Resolution Camera Module, Now With Autofocus
by Peter Reutemann 10 Jan '23

10 Jan '23

'Raspberry Pi is launching a new camera module for use with its diminutive DIY computers -- the Camera Module 3. Its upgraded Sony IMX708 sensor is higher resolution, but perhaps more important is that the new module supports high dynamic range photography and autofocus. Alongside it, Raspberry Pi is also releasing a new camera board for use with M12-mount lenses. From a report: Combined, the new features mean the Camera Module 3 should be able to take more detailed photographs (especially in low light), and can focus on objects as little as 5cm away. The autofocus uses a Phase Detection Autofocus (PDAF) system, with Contrast Detection Autofocus used as a backup. In contrast, previous versions of the camera module had fixed-focus lenses, which Raspberry Pi CEO Eben Upton writes were "optimized to focus at infinity" and could only take a "reasonably sharp image" of objects around a meter away. The new module's sensor has a resolution of 11.9 megapixels (compared to 8.1 megapixels for the last version), and has a higher horizontal resolution that should allow it to film HD video. HDR support means the Camera Module 3 can take several exposures of the same scene, and combine them so that both darker and lighter parts of an image are properly exposed (at the expense of some resolution) -- a trick commonly performed by just about every smartphone. Prices start at $25 for the Camera Module 3 with a standard field-of-view, while the ultra-wide angle version with a 102-degree field of view is $35.' -- source: https://tech.slashdot.org/story/23/01/09/1647247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google wants RISC-V to be a “tier-1” Android architecture
by Peter Reutemann 04 Jan '23

04 Jan '23

'Over the holiday break, the footage from the recent "RISC-V Summit" was posted for the world to see, and would you believe that Google showed up to profess its love for the up-and-coming CPU architecture? We've been trying to nail down how the Android team feels about RISC-V (reduced instruction set computer) for a while. We last heard a comment from the team six months ago, where our Google I/O question about RISC-V was answered only with "we're watching, but it would be a big change for us." Some external RISC-V porting projects exist, and various RISC-V commits have been landing in the Android Open Source Project (AOSP), but since anyone can submit code to AOSP, it has been hard to make any bold proclamations about RISC-V's Android status. Google's keynote at the RISC-V Summit was all about bold proclamations, though. Lars Bergstrom, Android's director of engineering, wants RISC-V to be seen as a "tier-1 platform" in Android, which would put it on par with Arm. That's a big change from just six months ago. Bergstrom says getting optimized Android builds on RISC-V will take "a lot of work" and outlined a roadmap that will take "a few years" to come to fruition, but AOSP started to land official RISC-V patches back in September. The build system is up and running, and anyone can grab the latest "riscv64" branch whenever they want—and yes, in line with its recent Arm work, Google wants RISC-V on Android to be 64-bit only. For now, the most you can get is a command line, and Bergstrom's slide promised "initial emulator support by the start of 2023, with Android RunTime (ART) support for Java workloads following during Q1."' -- source: https://arstechnica.com/gadgets/2023/01/google-announces-official-android-s… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

X11 Server Development Pace Hits a Two Decade Low
by Peter Reutemann 04 Jan '23

04 Jan '23

'Michael Larabel writes via Phoronix: While Mesa's development has been very vibrant this year, the X.Org Server development pace has continued pulling back greatly from its late 00's and early 10's highs. This year saw just 156 commits to the xserver Git master branch, down from 331 last year and well off the highs of 2,114 as the most ever back in 2008. This jives with the downward pace over the past decade of the number of new commits continuing to slide. But it's not just on a commit basis but in overall code churn, 2022 was another low for the X.Org Server. With the 156 commits this year, there were just 3,618 lines of new code added and 888 lines removed.... Compared to last year with its 331 commits seeing 31.4k new lines and 179k lines removed. The X.Org Server development this year on a commit basis hasn't been as low since 2003 when there were just 125 commits under their old development model and even back then meant there was +865k lines /680k lines removed across that span of commits. There hasn't been so little code churn to the X Server since 2002. [...] This year saw commits from just 32 different email addresses, down from 48 in prior years and that number of different authors hasn't been so low since 2003 when there were just 10 recorded. Olivier Fourdan of Red Hat was the most prolific committer to the X.Org Server this year with nearly a quarter of the commits. Following Olivier was Jeremy Huddleston Sequoia, Peter Hutterer, Michel DÃnzer, Alan Coopersmith, and Sultan Alsawaf. ' -- source: https://tech.slashdot.org/story/23/01/03/2248209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HandBrake video transcoder adds official AV1 codec support in latest release
by Peter Reutemann 03 Jan '23

03 Jan '23

'Hardware and software support for the royalty-free AV1 video codec has been steadily building over the last couple years. Hardware-accelerated encoding and decoding is becoming standard in more GPUs, phone SoCs, and other hardware, while streaming video services like YouTube and Netflix have begun serving AV1-encoded video to devices that support it. Open-source software projects are beginning to follow suit, too. The Open Broadcaster Software (OBS) package has been expanding its AV1 capabilities in recent releases, and now the HandBrake video transcoding app has added AV1 support as well. Version 1.6.0, released yesterday, has added support for encoding AV1 video using both CPU-based SVT-AV1 software encoding as well as via Intel's AV1-capable QuickSync video encoder included in its Arc GPUs.' -- source: https://arstechnica.com/gadgets/2022/12/handbrake-video-transcoder-adds-off… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ellen Ullman: “The Dumbing Down Of Programming”
by Lawrence D'Oliveiro 24 Dec '22

24 Dec '22

Found this two-part article from Salon magazine of 1998 <https://www.salon.com/1998/05/12/feature_321/>, <https://www.salon.com/1998/05/13/feature_320/>. Choice quotes: My intention had been to buy an upgrade to Windows NT Server, which was a completely sensible thing for me to be doing. ... But somehow I left the store carrying a box of Linux from a company called Slackware. ... In six clicks of a wizard, the Microsoft C++ AppWizard steps me through the creation of an application skeleton. ... Of course, I could look at the code that the Wizard has generated. ... But everything in the environment urges me not to. ... In this programming world, the writing of my code has moved away from being the central task to become a set of appendages to the entire Microsoft system structure. I'm a scrivener here, a filler-in of forms, a setter of properties. ... I once worked on a project in which a software product originally written for UNIX was being redesigned and implemented on Windows NT. Most of the programming team consisted of programmers who had great facility with Windows, Microsoft Visual C++ and the Foundation Classes. In no time at all, it seemed, they had generated many screenfuls of windows and toolbars and dialogs, all with connections to networks and data sources, thousands and thousands of lines of code. But when the inevitable difficulties of debugging came, they seemed at sea. In the face of the usual weird and unexplainable outcomes, they stood a bit agog. It was left to the UNIX-trained programmers to fix things. ... In an ideal world, I would not have to choose between the extreme polarities of dialog box and source code. My dream system interface would allow me to start hesitantly, unschooled. Then, as I used the facility that distinguishes me from the machine -- the still-mysterious capacity to learn, the ability to do something the second time in a way quite different from the first -- I could descend a level to a smarter, quicker kind of "talk." I would want the interface to scale with me, to follow me as my interest deepened or waned.

2 2

Visual Effects Society 2021 Studio Platform Report
by Lawrence D'Oliveiro 23 Dec '22

23 Dec '22

Came across this interesting survey report <https://drive.google.com/file/d/15b-4GMTSEE9tyqeQdBfy_LZnxQIdp38Y/view> (Google Drive link to a downloadable PDF file), linked from this opinion piece <https://arstechnica.com/gadgets/2022/12/it-might-be-time-for-apple-to-throw…>. The report was released early this year from the Visual Effects Society Technology Committee, and looks at how companies working in the VFX industry are using different computing platforms. Interesting fact: three-fifths of the workstations at these companies run Linux, and this share looks to increase in the future. There is a mix of distros, but the largest share are running CentOS. This seems to be dictated by the vendors of the proprietary apps, who will only support certain distros and not others. And of course this leads to worries like where do they go after the end of CentOS. By the way, the “VFX Reference Platform” is a set of baseline technical specs which gets updated every year <https://vfxplatform.com/>, hence designations like “CY2021”. Some interesting comments are recorded in the report: Windows continues to be seen as “working out of the box”, yet the comments describe many ongoing headaches with managing Windows systems, including technical limitations like “character limits, limitations of Active Directory management”. Sometimes it looks like the users can be part of the problem: All our artists refuse to work with Linux and we chose to keep on Windows for their comfort. But sometimes it's hard to manage. (Not a peep about the famous brand loyalty of Mac users?) Seems like there is a definite long-term preference for greater Linux adoption, with pleas like Support for Enterprise Software (Video and Chat Platforms) on Linux. Support for realtime tech (NVIDIA, Epic) on Linux. and We could have only Linux if it was not for Adobe After Effects and a couple of other Adobe Creative Cloud Apps.

1 0

Microsoft discovers Windows/Linux botnet used in DDoS attacks
by Peter Reutemann 16 Dec '22

16 Dec '22

'Microsoft researchers have discovered a hybrid Windows-Linux botnet that uses a highly efficient technique to take down Minecraft servers and performs distributed denial-of-service attacks on other platforms. Dubbed MCCrash, the botnet infects Windows machines and devices running various distributions of Linux for use in DDoS attacks. Among the commands the botnet software accepts is one called ATTACK_MCCRASH. This command populates the user name in a Minecraft server login page with ${env:random payload of specific size:-a}. The string exhausts the resources of the server and makes it crash. “The usage of the env variable triggers the use of Log4j 2 library, which causes abnormal consumption of system resources (not related to Log4Shell vulnerability), demonstrating a specific and highly efficient DDoS method,” Microsoft researchers wrote. “A wide range of Minecraft server versions can be affected.”' -- source: https://arstechnica.com/information-technology/2022/12/microsoft-discovers-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next month
by Peter Reutemann 15 Dec '22

15 Dec '22

Hi everyone Our AGM (Annual General Meeting) is scheduled for next month on January 23rd with the following agenda: • President's Report • Treasurer's Report • Election of 2023 Committee • Retirement of WLUG servers • General business • Consumption of pizza (if not online) Details: https://www.meetup.com/waikatolinuxusersgroup/events/290343641/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Hook Your MIDI Keyboard Up To a Website With Firefox 108
by Peter Reutemann 15 Dec '22

15 Dec '22

'A new feature in Firefox version 108 that may please musicians is the improved support for the Web MIDI API. "The MIDI standard is very close to a remarkable 40 years old, and Web MIDI does just what the name implies: it allows web apps to send and receive MIDI signals to and from musical instruments," reports The Register. "In principle this will allow sequencer apps to be implemented in Javascript." From the report: Amusingly, the last time The Reg mentioned Web MIDI, it was because Apple was taking it off Safari users, allegedly because of security concerns. Firefox 108 addresses that with a new security mechanism for preventing, and optionally permitting, apps inside browser tabs to access hardware resources -- in this instance, your MIDI ports. No, this does not mean that you can listen to CANYON.MID directly within Firefox. .MID files are not the same as General MIDI. But if you are nostalgic for that for some reason, help is at hand. ' -- source: https://news.slashdot.org/story/22/12/14/2133258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: What Should Mozilla Do To Boost Firefox's Market Share?
by Peter Reutemann 15 Dec '22

15 Dec '22

'Mozilla's Firefox once commanded a large chunk of the browser market share, but now it stands under a pitiful 5 percent. Google money removes need to compete from a management POV as they'll get paid either way but they're still leaving money on the table. What should Mozilla do to help Firefox regain its lost market share? Not so long ago Internet Explorer was only used to download Firefox when geeks reloaded Windows machines for others. Today, Edge, however pathetic, still outranks Firefox. Were FF not arguably the best available browser for Linux, share would be even less. Were you the king for a day what would you do to make Firefox great again? If you dropped or deprecated Firefox what shooed you off? This is not about Firefox being good or bad but about regaining casually discarded market share. ' -- source: https://ask.slashdot.org/story/22/12/14/1626235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Z-Wave Alliance Says Z-Wave Source Code Project Is Complete, Now Open And Widely Available To Members
by Peter Reutemann 15 Dec '22

15 Dec '22

'The Z-Wave Alliance, the Standards Development Organization (SDO) dedicated to advancing the smart home and Z-Wave technology, today announced the completion of the Z-Wave Source Code project, which has been published and made available on GitHub to Alliance members. From a report: The Z-Wave Source Code Project opens development of Z-Wave and enables members to contribute code to shape the future of the protocol under the supervision of the new OS Work Group (OSWG). The goal of the project is to provide a rich development environment that contains the relevant source code and sample applications to those seeking to play a direct role in the advancement of the Z-Wave standard. The quality and interoperability of products utilizing Z-Wave Source Code will also be enforced by a new mandatory Silicon & Stack Certification program. Full Z-Wave certification will continue to test and certify for Z-Wave S2 security, network connectivity, range, battery life, and interoperability including backwards and forwards compatibility. "The Z-Wave Alliance is deeply committed to the global smart home market," said Mitch Klein, Executive Director of the Z-Wave Alliance. "This year the smart home conversations have focused largely on Matter. Shiny and new, and with big brands supporting the initiative, Matter is bringing a lot of attention to the smart home. This makes it easy to overlook Z-Wave as the most established, trusted, and secure smart home protocol, that also happens to have the largest certified interoperable ecosystem in the market. We firmly expect that Z-Wave will play a key role in connecting devices and delivering the experience users really want."' -- source: https://tech.slashdot.org/story/22/12/14/1712247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Driver-Signing Doesn’t Work
by Lawrence D'Oliveiro 14 Dec '22

14 Dec '22

Having Microsoft verify third-party drivers with a digital signature, so that Windows will block the loading of unsigned drivers, seemed like a good idea when it came in with Windows Vista. Enforcing quality control would remove a big source of crashes, as well as security loopholes. But it seems the execution falls somewhat short <https://arstechnica.com/information-technology/2022/10/no-fix-in-sight-for-…>. The system for revoking signatures for old, obsolete drivers that are discovered to have security vulnerabilities in them doesn’t seem to work very well, allowing miscreants to exploit this old code to gain control of Windows systems. This has been dubbed a “Bring Your Own Vulnerable Device/Driver” (BYOVD) attack. Microsoft’s own Vice President of “OS Security and Enterprise” continues to claim that “Windows has everything you need to block” buggy signed drivers. Yet the article’s author was unable to get the mechanism to work. And Microsoft itself appeared to have no interest in helping to fix that. It seems to me, one thing missing from the mechanism is a time limit on signature validity. By contrast, when you get SSL/TLS certs for your website, they are only valid for some fixed interval (e.g. a year for certs from traditional certificate authorities, 90 days for ones from Let’s Encrypt). This means that clients using such certificates do not need to maintain an ever-growing list of revoked ones to check against, since ones that are past their expiry date can be rejected anyway. If the cert for a Windows driver has expired, but the driver itself is still valid, Microsoft should be able to simply renew the certificate. But I guess if Microsoft’s servers are struggling just to distribute certificate revocations, having to push out renewals as well will likely just make things worse.

1 2

Term Of The Week: “Electronic Suppression Software”
by Lawrence D'Oliveiro 13 Dec '22

13 Dec '22

What is “Electronic Suppression Software” (ESS)? It’s the computer equivalent of the old accounting scam of keeping two sets of books -- the one where you record the real profits of the business, and the one you show to the tax department <https://www.nzherald.co.nz/business/ird-warns-businesses-of-severe-conseque…>. This software seems to work at retail point-of-sale (tills). There have been some international raids lately on those suspected of supplying or using such tools.

1 0

Xnspy Stalkerware Spied on Thousands of iPhones and Android Devices
by Peter Reutemann 13 Dec '22

13 Dec '22

'A little-known phone monitoring app called Xnspy has stolen data from tens of thousands of iPhones and Android devices, the majority whose owners are unaware that their data has been compromised. From a report: Xnspy is one of many so-called stalkerware apps sold under the guise of allowing a parent to monitor their child's activities, but are explicitly marketed for spying on a spouse or domestic partner's devices without their permission. Its website boasts, "to catch a cheating spouse, you need Xnspy on your side," and, "Xnspy makes reporting and data extraction simple for you." Stalkerware apps, also known as spouseware, are surreptitiously planted by someone with physical access to a person's phone, bypassing the on-device security protections, and are designed to stay hidden from home screens, which makes them difficult to detect. Once installed, these apps will silently and continually upload the contents of a person's phone, including their call records, text messages, photos, browsing history and precise location data, allowing the person who planted the app near-complete access to their victim's data. But new findings show many stalkerware apps are riddled with security flaws and are exposing the data stolen from victims' phones. Xnspy is no different.' -- source: https://yro.slashdot.org/story/22/12/12/1658208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Inventory Improving, Could Reach Pre-Pandemic Levels In 2023
by Peter Reutemann 13 Dec '22

13 Dec '22

'According to CEO Eben Upton, "hundreds of thousands" of Raspberry Pi Zero, 3A+, and 4 models should show up next year. Ars Technica reports: In a "Supply chain update" blog post ("It's good news!"), CEO Eben Upton wrote that Raspberry Pi has "set aside a little over a hundred thousand units, split across Zero W, 3A+, and the 2GB and 4GB variants of Raspberry Pi 4, for single-unit sales." During the pandemic-spurred component shortage, most of the Pis produced every month were going to businesses, leaving those in need of one or two for a project refreshing rpilocator and cursing their timing. Zeros will start showing up first, then 3A+, then different models of 4. Upton acknowledged this reality (and even linked the locator) and asked that people buy only from approved resellers and consider the Pico and Pico W lines for projects that might fit, as those lines remain strong. As of this morning, a few 3A+ and CM4 models showed an optimistic green on the rpilocator spreadsheet. Raspberry Pi will continue to serve its commercial and industrial customers, Upton wrote, but will "make sure that inventory-building behavior which would otherwise prolong the shortage for everybody else can't take place." Meanwhile, Raspberry Pi will increase the percentage of boards designated for single-unit sales. With that change and future chip allocations, Upton expects that by the end of the third quarter of 2023, things will be back to how they were before the Great Pi Shortage, with "hundreds of thousands of units available at any given time." ' -- source: https://hardware.slashdot.org/story/22/12/12/2242236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OSnews Decries 'The Mass Extinction of Unix Workstations'
by Peter Reutemann 12 Dec '22

12 Dec '22

'Anyone remember the high-end commercial UNIX workstations from a few decades ago — like from companies like IBM, DEC, SGI, and Sun Microsystems? Today OSnews looked back — but also explored what happens when you try to buy one today> : As x86 became ever more powerful and versatile, and with the rise of Linux as a capable UNIX replacement and the adoption of the NT-based versions of Windows, the days of the UNIX workstations were numbered. A few years into the new millennium, virtually all traditional UNIX vendors had ended production of their workstations and in some cases even their associated architectures, with a lacklustre collective effort to move over to Intel's Itanium — which didn't exactly go anywhere and is now nothing more than a sour footnote in computing history. Approaching roughly 2010, all the UNIX workstations had disappeared.... and by now, they're all pretty much dead (save for Solaris). Users and industries moved on to x86 on the hardware side, and Linux, Windows, and in some cases, Mac OS X on the software side.... Over the past few years, I have come to learn that If you want to get into buying, using, and learning from UNIX workstations today, you'll run into various problems which can roughly be filed into three main categories: hardware availability, operating system availability, and third party software availability. Their article details their own attempts to buy one over the years, ultimately concluding the experience "left me bitter and frustrated that so much knowledge — in the form of documentation, software, tutorials, drivers, and so on — is disappearing before our very eyes." Shortsightedness and disinterest in their own heritage by corporations, big and small, is destroying entire swaths of software, and as more years pass by, it will get ever harder to get any of these things back up and running.... As for all the third-party software — well, I'm afraid it's too late for that already. Chasing down the rightsholders is already an incredibly difficult task, and even if you do find them, they are probably not interested in helping you, and even if by some miracle they are, they most likely no longer even have the ability to generate the required licenses or release versions with the licensing ripped out. Stuff like Pro/ENGINEER and SoftWindows for UNIX are most likely gone forever.... Software is dying off at an alarming rate, and I fear there's no turning the tide of this mass extinction. The article also wonders why companies like HPE don't just "dump some ISO files" onto an FTP server, along with patch depots and documentation. "This stuff has no commercial value, they're not losing any sales, and it will barely affect their bottom line.' -- source: https://tech.slashdot.org/story/22/12/12/0116206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Fixes Longstanding Bug in Its Handling of Floppy Disks
by Peter Reutemann 12 Dec '22

12 Dec '22

'"Linux kernel 6.2 should contain fixes for some problems handling floppy disks," reports the Register, "a move which shows that someone somewhere is still using them." This isn't the only such fix in recent years. As a series of articles on Phoronix details, there has been a slow but steady flow of fixes for the kernel's handling of floppy drives since at least kernel 5.17, as The Register mentioned when it came out.... Back in July 2016, SUSE kernel developer Jiri Kosina submitted a patch. The problem arose because this change broke something else and later got reverted, and so the problem hung around. In July last year, he sent in a new patch that fixed it again for the 5.12 kernel, and was later back-ported to 5.10, an LTS version, and again into kernel 5.15 — another an LTS version, and the one you're running today if you're on the current Ubuntu LTS release, or something built from it such as Linux Mint 21.... Now, in December 2022, a new patch for the forthcoming kernel 6.2 fixes a memory leak that dates back to 5.11 or before.' -- source: https://linux.slashdot.org/story/22/12/11/0711207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Reports Decline In Android Memory Safety Vulnerabilities As Rust Usage Grows
by Peter Reutemann 10 Dec '22

10 Dec '22

'Last year, Google announced Android Open Source Project (AOSP) support for Rust, and today the company provided an update, while highlighting the decline in memory safety vulnerabilities. 9to5Google reports: Google says the "number of memory safety vulnerabilities have dropped considerably over the past few years/releases."; Specifically, the number of annual memory safety vulnerabilities fell from 223 to 85 between 2019 and 2022. They are now 35% of Android's total vulnerabilities versus 76% four years ago. In fact, "2022 is the first year where memory safety vulnerabilities do not represent a majority of Android's vulnerabilities." That count is for "vulnerabilities reported in the Android security bulletin, which includes critical/high severity vulnerabilities reported through our vulnerability rewards program (VRP) and vulnerabilities reported internally." During that period, the amount of new memory-unsafe code entering Android has decreased: "Android 13 is the first Android release where a majority of new code added to the release is in a memory safe language. " Rust makes up 21% of all new native code in Android 13, including the Ultra-wideband (UWB) stack, DNS-over-HTTP3, Keystore2, Android's Virtualization framework (AVF), and "various other components and their open source dependencies." Google considers it significant that there have been "zero memory safety vulnerabilities discovered in Android's Rust code" so far across Android 12 and 13. Google's blog post today also talks about non-memory-safety vulnerabilities, and its future plans: "... We're implementing userspace HALs in Rust. We're adding support for Rust in Trusted Applications. We've migrated VM firmware in the Android Virtualization Framework to Rust. With support for Rust landing in Linux 6.1 we're excited to bring memory-safety to the kernel, starting with kernel drivers.' -- source: https://tech.slashdot.org/story/22/12/01/2124259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vivaldi Integrates Mastodon In Its Desktop Browser
by Peter Reutemann 09 Dec '22

09 Dec '22

'Vivaldi recently became the first browser to have its own Mastodon instance, Vivaldi Social. Now, the new version on the desktop is the first to integrate Mastodon into the browser itself, along with the ability to pin tab groups and other UI improvements. From a blog post: We believe in providing alternatives to Big Tech while putting your privacy first and launched Vivaldi Social, our Mastodon instance. And today we are integrating Vivaldi Social into the sidebar of our desktop browser becoming the first browser to offer this functionality. The new version -- Vivaldi 5.6 -- also allows you to pin your tab stacks. We've added a new private search engine You.com for select countries, helping to broaden your choices for searching the web. Vivaldi's sidebar of icons links to a number of utility functions. And now it integrates Vivaldi Social, our Mastodon instance. ' -- source: https://tech.slashdot.org/story/22/12/08/2151222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xfce dialog buttons in header
by Peter Reutemann 09 Dec '22

09 Dec '22

Hi everyone Since moving to Xfce, I've been a bit annoyed at my muscle memory as I now have to click on Save/Load/Cancel buttons in the header of save/load dialogs instead of the bottom right. Apparently, I'm not the only dinosaur unhappy about this change, having to move the mouse so far between file format combobox and save button... With the following command, you can move the buttons back to the bottom: xfconf-query -c xsettings -p /Gtk/DialogsUseHeader -s false Found here: https://forums.linuxmint.com/viewtopic.php?p=2039043&sid=a6eeaaa02b60fe9ddd… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Gets Memory and Energy Saver Modes
by Peter Reutemann 09 Dec '22

09 Dec '22

'Google today announced two new performance settings in its Chrome browser: Memory Saver and Energy Saver. From a report: The Memory Saver mode promises to reduce Chrome's memory usage by up to 30% by putting inactive tabs to sleep. The tabs will simply reload when you need them again. The Energy Saver mode, meanwhile, limits background activity and visual effects for sites with animations and videos when your laptop's battery level drops below 20%.' -- source: https://tech.slashdot.org/story/22/12/08/1723207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Joins Open Invention Network
by Peter Reutemann 08 Dec '22

08 Dec '22

'Amazon and Amazon Web Services (AWS) have joined the Open Invention Network (OIN) -- the world's largest patent non-aggression consortium. ZDNet reports: OIN has long protected Linux and Linux-related software from patent aggression by rival companies. With the recent increase in patent troll attacks, the OIN is also defending companies from these assaults. This is a natural move for Amazon. Besides relying on Linux and open-source software both for its retail and cloud businesses, Amazon has a strict policy against patent infringement, and users who engage in this behavior can have their listings removed or accounts deleted. Nevertheless, like all large companies, Amazon has also been sued for patent violations. Joining the OIN simply makes good business sense. Nithya Ruff, the Amazon Open Source Program Office director, added: "Linux and open source are essential to many of our customers and a key driver of innovation across Amazon. We are proud to support a broad range of open-source projects, foundations, and partners, and we are committed to the long-term success and sustainability of open source as a whole. By joining OIN, we are continuing to strengthen open source communities and helping to ensure technologies like Linux remain thriving and accessible to everyone."' -- source: https://news.slashdot.org/story/22/12/07/2224237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Four-Person Dev Team Gets Apple's M-Series GPU Working On Linux
by Peter Reutemann 08 Dec '22

08 Dec '22

'Ars Technica: For the brave people running Linux on Apple Silicon, their patience has paid off. GPU drivers that provide desktop hardware acceleration are now available in Asahi Linux, unleashing more of the M-series chips' power. It has taken roughly two years to reach this alpha-stage OpenGL driver, but the foundational groundwork should result in faster progress ahead, writes project leads Alyssa Rosenzweig and Asahi Lina. In the meantime, the drivers are "good enough to run a smooth desktop experience and some games." The drivers offer non-conformance-tested OpenGL 2.1 and OpenGL ES 2.0 support for all M-series Apple devices. That's enough for desktop environments and older games running at 60 frames per second at 4K. But the next target is Vulkan support. OpenGL work is being done "with Vulkan in mind," Lina writes, but some OpenGL support was needed to get desktops working first. There's a lot more you can read about the interplay between OpenGL, Vulkan, and Zink in Asahi's blog post.' -- source: https://tech.slashdot.org/story/22/12/07/2138241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mercury IT Hit By Ransomware
by Lawrence D'Oliveiro 07 Dec '22

07 Dec '22

No mention of this <https://www.theregister.com/2022/12/07/nz_vanuatu_cyberattacks/> in local news that I can recall, even though the attack happened a week ago and has impacted a number of NZ organizations.

1 0

Syntax Errors Are the Doom of Us All, Including Botnet Authors
by Peter Reutemann 07 Dec '22

07 Dec '22

'KmsdBot, a cryptomining botnet that could also be used for denial-of-service (DDOS) attacks, broke into systems through weak secure shell credentials. It could remotely control a system, it was hard to reverse-engineer, didn't stay persistent, and could target multiple architectures. KmsdBot was a complex malware with no easy fix. That was the case until researchers at Akamai Security Research witnessed a novel solution: forgetting to put a space between an IP address and a port in a command. And it came from whoever was controlling the botnet. With no error-checking built in, sending KmsdBot a malformed command -- like its controllers did one day while Akamai was watching -- created a panic crash with an "index out of range" error. Because there's no persistence, the bot stays down, and malicious agents would need to reinfect a machine and rebuild the bot's functions. It is, as Akamai notes, "a nice story" and "a strong example of the fickle nature of technology." KmsdBot is an intriguing modern malware. It's written in Golang, partly because Golang is difficult to reverse-engineer. When Akamai's honeypot caught the malware, it defaulted to targeting a company that created private Grand Theft Auto Online servers. It has a cryptomining ability, though it was latent while the DDOS activity was running. At times, it wanted to attack other security companies or luxury car brands.' -- source: https://it.slashdot.org/story/22/12/06/1552228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Company 'Hijacks' Blender's CC BY-Licensed Film, YouTube Strikes User
by Peter Reutemann 06 Dec '22

06 Dec '22

'TorrentFreak: The Blender Institute develops Blender, a free and open source 3D graphics tool used to create animated films. Sintel and Big Buck Bunny are among Blender's most recognizable titles and due to Creative Commons licensing (CC BY), they are widely shared, used, remixed and reshared. According to original Blender creator Ton Roosendaal, "Open licenses are essential for sharing our films and their source material." Right now, a company is claiming that Blender's free content is actually their content and as a result, must be immediately removed from the internet. We're talking about content that was created with Blender's explicit blessing but even after multiple appeals, not even YouTube will see reason. Bruno Fernandez-Ruiz is the co-founder and CTO at AI-focused driver safety company, Nexar. On Sunday he informed TorrentFreak that he's also an independent film composer and producer, working with music production libraries, and distributing to the main music platforms. TorrentFreak contacted Bruno after noticing a post he made on a music production forum. He wrote that after uploading a video containing a clip from the Blender movie Caminandes 3 -- Llamigos, YouTube notified him that a rightsholder had filed a copyright complaint, his video had been taken down, and a copyright strike had been issued to his account. The complaint, sent by Uzbekistan-based media/news company ZO'R TV, was not the result of automatic matching under Content ID. It was filed as a formal DMCA notice, meaning that someone probably reviewed the details before sending the complaint. The notice claimed that Bruno had infringed ZO'R TV's copyrights by reproducing content (6:21 to 8:26) from this YouTube video published in 2018. Since the content in question is obviously from Blender's film Caminandes 3, ZO'R TV was in no position to issue a DMCA notice. On that basis, Bruno followed the recognized procedure by sending a DMCA counternotice to YouTube. It didn't go well. After filing his counternotice with YouTube, Bruno was informed that since he'd provided insufficient information, YouTube could not process it. However, YouTube did inform Bruno of the risks of filing a counternotice, including that his name could be sent to the claimant, ZO'R TV in this case. Determined to have his video restored, Bruno accepted the risks and sent another counternotice to YouTube. This time there was no indication that the counternotice was deficient. YouTube thanked him for filing it -- but still declined to process it. YouTube's email advised Bruno that counternotices should only be filed in case of a mistake or misidentification. Consulting with a lawyer first might be helpful, YouTube added. After three attempts to restore the video and have the copyright strike removed, YouTube responded once again. The message contained yet more disappointment for Bruno. "Based on the information that you have provided, it appears that you do not have the necessary rights to post the content on YouTube. Therefore, we regretfully cannot honor your request," it advised. This signaled the end of the debate as far as YouTube was concerned and by rejecting Bruno's right to send a counternotice, the platform denied him an opportunity to have the video restored, stand up for Blender's rights, and get the strike removed. After notifying Blender of the situation, Blender developed Ton Roosendaal replied, saying the company has "no staff here available to go after situations like this" but suggested they could "escalate it to the Creative Commons organization." "After all, it's their mission," he added.' -- source: https://news.slashdot.org/story/22/12/05/2212216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint 20.2: Mate / GTK issue?
by Peter Reutemann 05 Dec '22

05 Dec '22

Hi everyone Just in case some one else encounters this problem... Last Friday, I installed the latest kernel update on my Linux Mint 20.2 MATE edition and rebooted the first time in a few weeks. After logging back in, I noticed that the Xorg process was using almost one core on my laptop. This wasn't the case when waiting at the login prompt (i.e., lightdm). Starting my file browser of choice, GTK version of double-command, (package: doublecmd-gtk), seemed to grab another core. Downgrading of Xorg or using an older kernel had no impact, unfortunately. When switching to XFCE4 for my session today, I didn't experience that high CPU load problem anymore. I also switched to the QT version of double-commander (package: doublecmd-qt). Not really solving the problem, more like side-stepping it, but at least I get can work done again, without my laptop fan going hard out all day... And I've used XFCE in the past. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Today’s New Word: “Cyberdeck”
by Lawrence D'Oliveiro 04 Dec '22

04 Dec '22

What is a “cyberdeck”? According to <https://hackaday.com/tag/cyberdeck/>, it’s basically a style of home-built computer with futuristic/sci-fi/cyberpunk overtones. The name comes from (what else) a William Gibson novel. It seems common to use a Raspberry π as the beating heart, with a custom 3D-printed case around it plus other suitably interesting-looking parts. Angles seem preferable to curves, with asymmetrically-inset polygons very popular. Weird and wacky keyboard layouts are a bonus. The diminutive size of the Raspberry π leaves plenty of room for experimentation. We can build the future-that-never-was! We have the technology now.

1 0

Web Browsers Drop Mysterious Company With Ties To US Military Contractor
by Peter Reutemann 02 Dec '22

02 Dec '22

'Washington Post: Major web browsers moved Wednesday to stop using a mysterious software company that certified websites were secure, three weeks after The Washington Post reported its connections to a U.S. military contractor. Mozilla's Firefox and Microsoft's Edge said they would stop trusting new certificates from TrustCor Systems that vouched for the legitimacy of sites reached by their users, capping weeks of online arguments among their technology experts, outside researchers and TrustCor, which said it had no ongoing ties of concern. Other tech companies are expected to follow suit. The Post reported on Nov. 8 that TrustCor's Panamanian registration records showed the same slate of officers, agents and partners as a spyware-maker identified this year as an affiliate of Arizona-based Packet Forensics, which has sold communication interception services to U.S. government agencies for more than a decade. One of those contracts listed the "place of performance" as Fort Meade, Md., the home of the National Security Agency and the Pentagon's Cyber Command. The case has put a new spotlight on the obscure systems of trust and checks that allow people to rely on the internet for most purposes. Browsers typically have more than a hundred authorities approved by default, including government-owned ones and small companies, to seamlessly attest that secure websites are what they purport to be. "Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware," Mozilla's Kathleen Wilson wrote to a mailing list for browser security experts. "Trustcor's responses via their Vice President of CA operations further substantiates the factual basis for Mozilla's concerns."' -- source: https://tech.slashdot.org/story/22/12/01/2113209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mozilla Acquires Team Behind Pulse, an Automated Status Updater for Slack
by Peter Reutemann 02 Dec '22

02 Dec '22

'Firefox developer Mozilla is making a rare foray into the world of mergers and acquisitions, with news that it has snapped up recently-shuttered California-based productivity startup Pulse. From a report: Terms of the deal haven't been disclosed, but the deal is tantamount to an "acqui-hire," with Mozilla looking to deploy the Pulse team across an array of machine learning (ML) projects. "We're acquiring Pulse for the incredible team they have built," Mozilla chief product officer Steve Teixeira told TechCrunch. "As we look to continue to improve user experiences across all of our products, ML will be a core part of that." Founded out of Menlo Park in 2019, Pulse in its initial guise was a "virtual office" platform called Loop Team, but after honing the idea for a couple of years it pivoted and rebranded last November. Pulse, essentially, was an automated status-updating tool that used signals based on pre-configured integrations and preferences set by the user. For example, users could synchronize Pulse with their calendar and Slack, setting rules to stipulate what their status and corresponding emoji should be based on keywords in their calendar event title. If their schedule for a particular time says "hair appointment" from 12-1pm, then the person's Slack status update might display a scissors emoji alongside the word "haircut." Or, it might say "birthday" alongside a cake emoji if that's what is in their calendar.' -- source: https://tech.slashdot.org/story/22/12/01/1644245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LastPass: Notice of Recent Security Incident
by Peter Reutemann 01 Dec '22

01 Dec '22

'We recently detected unusual activity within a third-party cloud storage service, which is currently shared by both LastPass and its affiliate, GoTo. We immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. We have determined that an unauthorized party, using information obtained in the August 2022 incident, was able to gain access to certain elements of our customers’ information. Our customers’ passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture. We are working diligently to understand the scope of the incident and identify what specific information has been accessed. In the meantime, we can confirm that LastPass products and services remain fully functional.' -- source: https://blog.lastpass.com/2022/11/notice-of-recent-security-incident/ -- via: https://infosec.exchange/@dennisf/109434660011163159 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Used thin client PCs are an unsexy, readily available Raspberry Pi alternative
by Peter Reutemann 30 Nov '22

30 Nov '22

'"Raspberry Pi boards are hard to get, probably also next year," says Andreas Spiess, single-board enthusiast and YouTuber, in his distinctive Swiss accent. He's not wrong. Spiess says he and his fellow Pi devotees need "a strategy to survive" without new boards, so he suggests looking in one of the least captivating, most overlooked areas of computing: used, corporate-minded thin client PCs. Spiess' Pi replacements, suggested and refined by many of his YouTube commenters and Patreon subscribers, are Fujitsu Futros, Lenovo ThinkCentres, and other small systems (some or all of which could be semantically considered "thick clients" or simply "mini PCs," depending on your tastes and retro-grouch sensibilities). They're the kind of systems you can easily find used on eBay, refurbished on Amazon Renewed, or through other enterprise and IT asset disposition sources. They're typically in good shape, given their use and environment. And compared to single-board enthusiast systems, many more are being made and replaced each year.' -- source: https://arstechnica.com/gadgets/2022/11/used-thin-client-pcs-are-an-unsexy-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Anker's Eufy Cameras Caught Uploading Content To the Cloud Without User Consent
by Peter Reutemann 30 Nov '22

30 Nov '22

'Anker's popular Eufy-branded security cameras appear to be sending some data to the cloud, even when cloud storage is disabled and local only storage settings are turned on. MacRumors reports: The information comes from security consultant Paul Moore, who last week published a video outlining the issue. According to Moore, he purchased a Eufy Doorbell Dual, which was meant to be a device that stored video recording on device. He found that Eufy is uploading thumbnail images of faces and user information to its cloud service when cloud functionality is not enabled. Moore demonstrates the unauthorized cloud uploading by allowing his camera to capture his image and turning off the Eufy HomeBase. The website is still able to access the content through cloud integration, though he had not signed up for cloud service, and it remains accessible even when the footage is removed from the Eufy app. It's important to note that Eufy does not appear to be automatically uploading full streaming video to the cloud, but rather taking captures of the video as thumbnails. The thumbnails are used in the Eufy app to activate streaming video from the Eufy base station, allowing Eufy users to watch their videos when away from home, as well as for sending rich notifications. The problem is the thumbnails are uploaded to the cloud automatically even when the cloud functionality is not active, and Eufy also seems to be using facial recognition on the uploads. Some users have taken issue with the unauthorized cloud uploads because Eufy advertises local-only service and has been popular among those who want a more private camera solution. "No Clouds or Costs," reads the Eufy website. Moore suggests that Eufy is also able to link facial recognition data collected from two separate cameras and two separate apps to users, all without camera owners being aware. Moore received a response from Eufy in which Eufy confirmed that it is uploading event lists and thumbnails to AWS, but said the data is not able to "leak to the public" because the URL is restricted, time limited, and requires account login. There is also another issue that Moore has highlighted, suggesting Eufy camera streams can be watched live using an app like VLC, but little information on the exploit is available at this time. Moore said that unencrypted Eufy camera content can be accessed without authentication, which is alarming for Eufy users. There's a dedicated Reddit thread where other Eufy users are reporting the same thing happening.' -- source: https://yro.slashdot.org/story/22/11/29/2148250 Eufy products are for sale here in NZ as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon's New Chip Moves AWS Into High-Performance Computing
by Peter Reutemann 30 Nov '22

30 Nov '22

'Amazon's cloud-computing unit is rolling out new chips designed to power the highest-end of computing, supporting tasks such as weather forecasting and gene sequencing. From a report: Amazon Web Services, the largest provider of over-the-internet computing, on Monday said it would let customers rent computing power that relies on a new version of its Graviton chips. Peter DeSantis, a senior vice president who oversees most of AWS's engineering teams, said in an interview that the product is a springboard for making what the industry calls high-performance computing more readily available. The newest chip is the latest piece of Amazon's effort to build more of the hardware that fills the massive data centers that power AWS. Amazon says making its own chips will give customers more cost-effective computing power than they could get by renting time on processors built by the likes of Intel Corp., Nvidia Corp. or Advanced Micro Devices. The move has put AWS in direct competition with those companies, which are also among its biggest suppliers. DeSantis said the chipmakers remain "great partners," and that AWS plans to continue to offer high-performance computing services based on chips made by other companies. On Tuesday, AWS Chief Executive Officer Adam Selipsky announced a new version of the Inferentia chip, which is designed to draw inferences from vast amounts of data. Inferentia2 is built to handle bigger sets of data than its predecessor, enabling things like software-generated images or detecting and interpreting human speech, Amazon said. [...] The latest version of AWS's line of Graviton processors, the Graviton3E, will have twice the ability of current versions in one type of calculations needed by high-performance computers, DeSantis said. When combined with other AWS technology, the new offering will be 20% better than the previous one. Amazon didn't say when services based on the new chip would be available' -- source: https://tech.slashdot.org/story/22/11/29/192229 According to this site, the Graviton2 chip is supported by several Linux distros (specific kernel flags?): https://aws.amazon.com/ec2/graviton/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIP Fred “Mythical Man-Month” Brooks
by Lawrence D'Oliveiro 29 Nov '22

29 Nov '22

“The Mythical Man-Month” was a classic book on the nature of computer programming, written by Fred Brooks after (among other things) his experience heading up the OS/360 project back in the 1960s. The man himself has now passed away at the age of 91 <https://www.theregister.com/2022/11/28/fred_mythical_man_month_brooks/>. OS/360 was the most ambitious of several operating systems developed by IBM for its System/360 line of computers. It provided conclusive proof that, if a project was running late, adding more people to work on it could actually make things worse. I have a copy of the 25th-Anniversary edition of the book, which includes his “No Silver Bullet” essay and also a detailed retrospective on how the original text stood up (or not) to the state of the programming art in the 1990s.

1 0

Linux Kernel Gets More Infrastructure for Rust, Increasing Interest in the Language
by Peter Reutemann 28 Nov '22

28 Nov '22

'Linux 6.1 (released last month) included what Linus Torvalds described as "initial Rust scaffolding," remembers this update from SD Times But now, "work has already been done since the 6.1 release to add more infrastructure for Rust in the kernel, though still none of the code interacts with any C code." And there's still no actual Rust code in Linux: "You need to get all those things that can make sure that Rust can compile, and you can do the debugging and all these things," explained Joel Marcey, director of advocacy and operations for the Rust Foundation, "and make sure that the memory safety is there and all that sort of stuff. And that has to happen first before you can actually write any real code in Rust for the Linux kernel itself." Marcey explained that Linux is going to be doing this inclusion very piecemeal, with lots of little integrations here and there over time so they can see how it is working. "I would imagine that over the next year, you're going to see more small incremental changes to the kernel with Rust, but as people are seeing that it's actually kind of working out, you'll be able to maybe, for example, write Linux drivers or whatever with Rust," said Marcey.... According to Bec Rumbul, executive director of the Rust Foundation, Rust being added to the kernel is an "enormous vote of confidence in the Rust programming language." She explained that in the past other languages have been planned to make it into the kernel and ended up not getting put in. "I think having someone with the kind of intellectual gravity of Linus Torvalds saying 'No, it's going in there,' that kind of says an awful lot about how reliable Rust already is and how much potential there is for the future as well," she said. Rumbul believes that there will be an increased interest in the language, which is still relatively new (It first made its debut in 2010) compared to some of the other languages out there to choose from. "I suspect that because Rust is now in the kernel, and it's just being talked about much ... more widely, that it will seem like an attractive prospect to a lot of people that are looking to develop their skills and their knowledge," she said. Rumbul hopes people will also be inspired to participate in the language as contributors and maintainers, because those are some of the less popular roles within open source, but are extremely critical to the health of a language, she explained. The Rust Foundation also launched a new security team in September to ensure best practices (including a dedicated security engineer). Their first initiative will be a security audit and threat modeling exercises. "We want to basically shore up," Rust operations director Marcey tells SD Times, "to ensure that Rust itself is actually as secure as we always say it is." In this year's Stack Overflow Developer Survey, 86.73% of developers said they love Rust.' -- source: https://developers.slashdot.org/story/22/11/27/1853228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 28 Nov '22

28 Nov '22

Hi everyone We have a hybrid meeting next Monday with the following topic: 'Gnome, MATE, Cinnamon and KDE are the most common window managers for Linux desktops. But what about the lesser known ones? There are plenty of compositing, stacking or tiling window managers out there. Let's have a look at some (https://en.wikipedia.org/wiki/Comparison_of_X_window_managers) Maybe you'll find the one that you have been looking for all those years?' Details: https://www.meetup.com/waikatolinuxusersgroup/events/283776741/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Human Rights Commissioner Wants To See Regulation, Not Bans On Disinformation
by Lawrence D'Oliveiro 26 Nov '22

26 Nov '22

Paul Hunt, our Chief Human Rights Commissioner is not so keen on Justice Minister Kiri Allan’s proposals on hate speech legislation, saying “We do need controls, we do need checks, we do need independent accountability but not rendering the information unlawful, unless it reaches that far end of the spectrum.” according to <https://www.nzherald.co.nz/nz/politics/disinformation-should-be-regulated-b…>. Internal Affairs Minister Jan Tinetti has been looking at how Finland has had some success in keeping its young people aware of misinformation and disinformation online, to see if something similar could be done here.

1 0

Google Says Google and Other Android Manufacturers Haven't Patched Security Flaws
by Peter Reutemann 25 Nov '22

25 Nov '22

'Google has disclosed several security flaws for phones that have Mali GPUs, such as those with Exynos chipsets. From a report: The company's Project Zero team says it flagged the problems to ARM (which produces the GPUs) back in the summer. ARM resolved the issues on its end in July and August. However, smartphone manufacturers including Samsung, Xiaomi, Oppo and Google itself hadn't deployed patches to fix the vulnerabilities as of earlier this week, Project Zero said. Researchers identified five new issues in June and July and promptly flagged them to ARM. "One of these issues led to kernel memory corruption, one led to physical memory addresses being disclosed to userspace and the remaining three led to a physical page use-after-free condition," Project Zero's Ian Beer wrote in a blog post. "These would enable an attacker to continue to read and write physical pages after they had been returned to the system." Beer noted that it would be possible for a hacker to gain full access to a system as they'd be able to bypass the permissions model on Android and gain "broad access" to a user's data. The attacker could do so by forcing the kernel to reuse the afore-mentioned physical pages as page tables.' -- source: https://tech.slashdot.org/story/22/11/24/218212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DSA Slowly Going Away
by Lawrence D'Oliveiro 24 Nov '22

24 Nov '22

I notice that the new version of OpenSSH in Debian Unstable is taking another step toward dropping support for the DSA algorithm for key generation. I can remember back when DSA was introduced as an alternative to RSA. Unlike RSA, which is an encryption algorithm that can also be used for digital signatures, DSA was deliberately designed to be usable for signatures but not for encryption. This was back in the day when the US Government was still restricting exports of strong encryption products. Not long after that, I remember a research paper being published showing that DSA could in fact be used as an encryption algorithm. It wasn’t particularly efficient or even very practical, but it could theoretically be done. There was a time, in fact, when DSA was actually being preferred to RSA for generating SSH keys. Just checking the ssh-keygen man page, and the current default is RSA.

1 0

Windows Subsystem for Linux with GUI apps launches for Windows 10
by Peter Reutemann 24 Nov '22

24 Nov '22

'The Windows Subsystem for Linux (WSL), one of the best reasons to run Windows 11, is now available to Windows 10 users, in the latest version and with all its features. WSL dropped its "preview" label with this 1.0 release, and aims to simplify its installation from here on out. Getting the best version of WSL used to mean installing big, system-level Windows updates (including 11 itself). As part of its broader moving of key apps into its Store, Microsoft now offers the most feature-rich version of WSL there. "The in-Windows version of WSL will still receive critical bug fixes, but the Store version of WSL is where new features and functionality will be added," Windows Developer Platform Program Manager Craig Loewen noted in a blog post. Loewen noted that the "WSL community's requests" drove Microsoft to make the latest, GUI-ready framework version available to Windows 10 users. Now a Store installation is the default, even if you use the command line (PowerShell) to install and update WSL. Now anyone whose system is capable of running WSL has access to graphical apps and (optional) systemd support, and can hopefully spend less time wondering which WSL version they have, what they need, and what the differences are.' -- source: https://arstechnica.com/gadgets/2022/11/windows-subsystem-for-linux-with-gu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Network-crashing leap seconds to be abandoned by 2035, for at least a century
by Peter Reutemann 23 Nov '22

23 Nov '22

'There are not many things you can get Facebook, Google, the United States, France, and Linus Torvalds to agree on, but one of them has come to pass. A near-unanimous vote on Friday in Versailles, France, by parties to the International Bureau of Weights and Measures (BIPM in its native French) on Resolution 4 means that starting in 2035, the leap second, the remarkably complicated way of aligning the Earth's inconsistent rotation with atomic-precision timekeeping, will see its use discontinued. Coordinated Universal Time, or UTC, will run without them until 2135. It was unclear whether any leap seconds might occur before then, though it seems unlikely. The assumption is that within those 100 years, time-focused scientists (metrologists) will have found a way to synchronize time as measured by humans to time as experienced by our planet orbiting the Sun. But most people will not notice any difference at all, even as the time difference could reach up to one minute by the end of that 100 years.' -- source: https://arstechnica.com/science/2022/11/network-crashing-leap-seconds-to-be… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Tumblr To Add Support For ActivityPub, the Social Protocol Powering Mastodon and Other Apps
by Peter Reutemann 22 Nov '22

22 Nov '22

'TechCrunch: Tumblr will add support for ActivityPub, the open, decentralized social networking protocol that's today powering social networking software like Twitter alternative Mastodon, the Instagram-like Pixelfed, video streaming service PeerTube, and others. The news was revealed in a response to a Twitter user's complaint about Mastodon's complexities. Automattic CEO Matt Mullenweg -- whose company acquired Tumblr from Verizon in 2019 -- suggested the user "come to Tumblr" as the site would soon "add activitypub for interconnect." "Don't stress," he said, before clarifying that Tumblr first has to deal with the waves of new users coming in right now from Twitter, but that support for "interop and activitypub" were due to come "ASAP." In short, this announcement means Tumblr would move from being only a niche blogging platform to instead become a part of a larger, decentralized social network of sorts -- and one whose user base has grown in size in recent days as people flee Elon Musk's Twitter in search of new communities. The ActivityPub protocol, its website explains, provides a client-to-server API for creating, updating, and deleting content as well as a federal server-to-server API for delivering notifications and subscribing to content. In practice, this means that Mastodon users can interact and follow users on other instances (independently run nodes), as well as with users on other social apps (like PeerTube), which also support the implementation of ActivityPub. It makes for a web of social networks where users can find and follow each other without having to set up new accounts on each new service. This is the opposite approach to today's "walled garden" social networks, where a post on one platform can't be viewed by those on others, unless you re-upload or repost the content directly or share a link to the other site where the content can be found.' -- source: https://tech.slashdot.org/story/22/11/21/2320217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A History Of ARM, Part 2
by Lawrence D'Oliveiro 22 Nov '22

22 Nov '22

Quite a nice article <https://arstechnica.com/gadgets/2022/11/a-history-of-arm-part-2-everything-…> covering the founding of ARM Ltd as parent company Acorn was hitting financial headwinds. Apple played an absolutely crucial part in keeping the company viable in its early days by being among its biggest customers: the Newton PDA sold 60,000 units in its first year, which was a flop for Apple but, at $20 a unit for royalties, a big boost for ARM Ltd at the time. In those early days, the company found it an uphill struggle to be taken seriously by the bigger players. Companies like Motorola and TI had trouble appreciating why they could not create their own in-house designs instead of licensing one from ARM, even when the latter could be done for a fraction of the cost of the former. But the boss was canny and persistent enough to make the right sort of deals to build a sound basis for the company: For Robin Saxby, the idea of working with rival chip companies was always part of the strategy. “Turn your enemies into friends,” he would say. “Why should they fight you if they can make more money for themselves by collaborating with you?” Unfortunately, big companies don’t always act rationally ...

1 0