- wlug - list.wlug.org.nz

Microsoft's Edge Browser for Linux is Now Available for All Users
by Peter Reutemann 03 Nov '21

03 Nov '21

'A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.' -- source: https://linux.slashdot.org/story/21/11/02/1627250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Trojan Source' Bug Threatens the Security of All Code
by Peter Reutemann 02 Nov '21

02 Nov '21

'"Virtually all compilers -- programs that transform human-readable source code into computer-executable machine code -- are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected," warns cybersecurity expert Brian Krebs in a new report. An anonymous reader shares an excerpt: Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis). Specifically, the weakness involves Unicode's bi-directional or "Bidi" algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic -- which is read right to left -- and English (left to right). But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the "Bidi override," which can be used to make left-to-right text read right-to-left, and vice versa. "In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient," the Cambridge researchers wrote. "For these cases, Bidi override control characters enable switching the display ordering of groups of characters." Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email. Here's the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text -- including control characters -- is ignored by compilers and interpreters. Also, it's bad because most programming languages allow string literals that may contain arbitrary characters, including control characters. "So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty," said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. "That's bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything." The research paper, which dubbed the vulnerability "Trojan Source," notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. [...] Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable. "If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected," he said. Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.' -- source: https://it.slashdot.org/story/21/11/01/2147254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Zero 2 W: 5x faster than the original for $5 more
by Peter Reutemann 01 Nov '21

01 Nov '21

'The diminutive Raspberry Pi Zero is getting its first upgrade in nearly five years. Today, Raspberry Pi founder Eben Upton announced the Raspberry Pi Zero 2 W, a new $15 product that puts the processor from the Raspberry Pi 3 into a board the exact same size as the original Zero. The new board swaps the old Zero's 1 GHz single-core ARM11 processor for a quad-core Cortex A53-based Broadcom BCM2710A1 processor, also clocked at 1 GHz—the same processor used in the original Raspberry Pi 3 released back in 2016, albeit clocked slightly lower. This is a substantial increase in power and capability for the Pi Zero, going from one core to four and from 32 bits to 64. Upton said that the performance increase over the original Zero "varies across workloads" but that for multithreaded tasks like those simulated by sysbench, "it is almost exactly five times faster." Heat dissipation is provided by "thick internal copper layers" in the board, which should help prevent thermal throttling without the use of additional fans or heatsinks.' -- source: https://arstechnica.com/gadgets/2021/10/raspberry-pi-zero-2-w-crams-pi-3-pa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Newly-Discovered 'AbstractEmu' Malware Rooted Android Devices, Evaded Detection
by Peter Reutemann 01 Nov '21

01 Nov '21

'"New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks," reports BleepingComputer. Cybersecurity company Lookout said on its blog that they'd spotted the malware on Google Play "and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store.... To protect Android users, Google promptly removed the app as soon as we notified them of the malware." We named the malware "AbstractEmu" after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads... This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors... By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances... AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading... By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device. "Apps bundling the malware included password managers and tools like data savers and app launchers," reports BleepingComputer, "all of them providing the functionality they promised to avoid raising suspicions..." Lookout's blog post said they'd spotted people affected by the malware in 17 different countries.' -- source: https://it.slashdot.org/story/21/10/31/1253225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sprite Fright: Not Your Father’s Blender Open Movie
by Lawrence D'Oliveiro 31 Oct '21

31 Oct '21

The latest short feature from the Blender Studio is now out <https://www.blender.org/>. While past efforts have had the occasional sombre, not to say dark, elements, this one just takes the darkness to the next level. It’s an out-and-out horror story, with overtones of environmental retribution in its plot. Carnage, gore, deaths, and just plain ickiness in full measure, packed into a mere 10 minutes. I just hope the script writer is getting therapy ...

1 0

Protonmail Celebrates Swiss Court Victory Exempting it From Telco Data Retention Laws
by Peter Reutemann 28 Oct '21

28 Oct '21

'Encrypted email provider Protonmail has hailed a recent Swiss legal ruling as a "victory for privacy," after winning a lawsuit that sees it exempted from data retention laws in the mountainous realm. From a report: Referring to a previous ruling that exempted instant messaging services from data capture and storage laws, the Protonmail team said this week: "Together, these two rulings are a victory for privacy in Switzerland as many Swiss companies are now exempted from handing over certain user information in response to Swiss legal orders." Switzerland's Federal Administrative Court ruled on October 22 that email providers in Switzerland are not considered telecommunications providers under Swiss law, thereby removing them from the scope of data retention requirements imposed on telcos. The victory comes after controversy over a previous (and not directly related) Swiss court order that forced the company to collect mobile device push notification identifiers from a specified user's account. That user was later arrested by French police, who had asked their Swiss counterparts to obtain the surveillance order. Protonmail chief exec Andy Yen told The Register his business doesn't routinely collect such data on its users.' -- source: https://yro.slashdot.org/story/21/10/27/147224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Core i9 11900K: Five Linux Distros Show Sizable Lead Over Windows 11
by Peter Reutemann 28 Oct '21

28 Oct '21

'Phoronix: Now that Windows 11 has been out as stable and the initial round of updates coming out, I've been running fresh Windows 11 vs. Linux benchmarks for seeing how Microsoft's latest operating system release compares to the fresh batch of Linux distributions. First up is the fresh look at the Windows 11 vs. Linux performance on an Intel Core i9 11900K Rocket Lake system. Microsoft Windows 11 Pro with all stable updates as of 18 October was used for this round of benchmarking on Intel Rocket Lake. The Windows 11 performance was being compared to all of the latest prominent Linux distributions, including: Ubuntu 20.04.3 LTS, Ubuntu 21.10, Arch Linux (latest rolling), Fedora Workstation 35, Clear Linux 35150. All the testing was done on the same Intel Core i9 11900K test system at stock speeds (any frequency differences reported in the system table come down to how the information is exposed by the OS, i.e. base or turbo reporting) with 2 x 16GB DDR4-3200 memory, 2TB Corsair Force MP600 NVMe solid-state drive, and an AMD Radeon VII graphics card. Each operating system was cleanly installed and then run at its OS default settings for seeing how the out-of-the-box OS performance compares for these five Linux distributions to Microsoft Windows 11 Pro. But for the TLDR version... Out of 44 tests run across all six operating systems, Windows 11 had just three wins on this Core i9 11900K system. Meanwhile Intel's own Clear Linux platform easily dominated with coming in first place 75% of the time followed by Fedora Workstation 35 in second place with first place finishes 9% of the time. The geometric mean for all 44 tests showed Linux clearly in front of Windows 11 for this current-generation Intel platform. Ubuntu / Arch / Fedora were about 11% faster overall than Windows 11 Pro on this system. Meanwhile, Clear Linux was about 18% faster than Windows 11 and enjoyed about 5% better performance overall than the other Linux distributions.' -- source: https://linux.slashdot.org/story/21/10/27/1625217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Setback for Nvidia's $54 Billion ARM Bid as EU Regulators Open Probe
by Peter Reutemann 28 Oct '21

28 Oct '21

'Nvidia suffered a setback on Wednesday as EU antitrust regulators opened a full-scale investigation into its $54 billion bid for British chip designer ARM on concerns the deal could lead to higher prices, less choice and reduced innovation. From a report: Britain's competition agency is also probing the deal for the country's most important technology company, warning that it could damage competition and weaken rivals. Reuters reported the European Commission viewed as insufficient concessions offered by the world's biggest maker of graphics and artificial intelligence (AI) chips during its preliminary review. Nvidia has not disclosed what these are but it has previously said it would maintain ARM as a neutral technology supplier to sooth concerns from customers such as Qualcomm, Samsung and Apple. The Commission said it would decide by March 15 whether to clear or block the deal. "Whilst Arm and Nvidia do not directly compete, Arm's IP is an important input in products competing with those of Nvidia, for example in datacentres, automotive and in Internet of Things," EU competition chief Margrethe Vestager said in a statement.' -- source: https://slashdot.org/story/21/10/27/1648229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's 12L Feature Drop Aims To Be a Big Improvement for Folding Phones
by Peter Reutemann 28 Oct '21

28 Oct '21

'At this year's Android Dev Summit, Google announced an upcoming update for devices with larger screens, which includes tablets, foldables, and devices that run ChromeOS. From a report: Google is calling the update 12L, and it's supposed to make Android 12 run smoother on big screens. We first heard the possibility of a "12.1" update in late September, and it looks like many of the rumored features are true. 12L optimizes the layout of a device's UI, adjusting the placement of the home screen, lock screen, notifications, Quick Settings, and more. Google notes that any screen 600 density-independent pixels (dp) and above will display a two-column layout that makes use of the entire screen. In the example Google shows, the Quick Settings menu is pushed towards the left side of the screen, while the notifications panel is locked to the right, giving you the ability to access both simultaneously -- all without opening one app and closing another. 12L also introduces a new taskbar that makes it easier for users to quickly switch between different apps. Dragging and dropping an app from the taskbar opens it up in split-screen mode, which Google notes it has enabled for all apps, whether they're resizable or not.' -- source: https://tech.slashdot.org/story/21/10/27/1821200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Trying To Cripple Its Own Open-Source Project
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Microsoft is trying to remove a feature called “Hot Reload” from Dotnet, saying it is something that should only be available through Visual Studio <https://www.theregister.com/2021/10/22/microsoft_net_hot_reload_visual_stud…>. Trouble is, this is the (supposedly) Open-Source version of Dotnet. And you do not take away useful features from Open-Source projects. You can do that to proprietary products, where the users have no choice but to put up with it. As of this writing, the commit that removes the feature has already been merged, but a follow up request to revert that change, while gathering a lot of support, has not been accepted into the official code base yet. As one of the commenters says: “This is the PR that is truly going to decide .NET is really an OSS or not!”. This is just one in a long line of incidents <https://www.theregister.com/2021/10/18/net_foundation_gnome/> casting doubt on the independence of Dotnet as an Open-Source project.

1 0

App Telemetry For Developers
by Lawrence D'Oliveiro 23 Oct '21

23 Oct '21

Here’s an interesting idea <https://www.theregister.com/2021/10/22/new_relic_codestream/>: if an app should crash during a production run, it can send telemetry data back to the developer providing some program state and pinpointing exact locations in the source code. This is done using eBPF (Extended Berkeley Packet Filter), which is able to collect information about running applications with minimal impact. You thought packet-filtering was only about managing network activity, but no, it is more useful than that. Yes, there is potential for this sort of thing to be misused, if it is not correctly managed. With great power comes great responsibility etc. By the way, while eBPF may have its roots in the older BPF as found in the BSDs, it is nevertheless a Linux-only technology <https://ebpf.io/>. Though Microsoft is trying to port some parts of it to Windows <https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-…>.

1 0

GPSD Bug Will Switch Your Time-Keeping Systems To March 2002 This Weekend, Unless You Update
by Peter Reutemann 22 Oct '21

22 Oct '21

'"Apparently a bug in GPSD, the daemon responsible for deriving time from the GPS system, is going to trigger on October 24, 2021, jumping the time back to March of 2002," writes Slashdot reader suutar. "There's a fix that's been committed since August, but of course not everything is up to date." ZDNet's Steven J. Vaughan-Nichols writes: This will be ugly. Or, as Stephen Williams, who uncovered the bug put it, "I have a feeling that there will be some 'interesting moments' in the early morning when a bunch of the world's stratum 1 NTP servers using GPSD take the long strange trip back to 2002." GPSD maintainer Gary E. Miller has acknowledged the problem, and a fix has been made to the code. To be exact, the fix is in August 2021's GPSD 3.23 release. So, what's the problem if the fix is already in? Well, there are two problems. First, it won't be backported to previous releases. If you're still using an older version, you may be out of luck. Second, as Miller observed, not all distros "pick up GPSD updates or upstream their patches. [This] is a very sore spot with me." So, just because your operating system is up to date does not mean that it will have the necessary GPSD fix. Miller suggests that you check it and do it yourself: "I [am] gonna fall back on Greg K_H's dictum: All users must update." Oh, wondering what the mysterious root cause of all this commotion GPS Week Rollover? It's a legacy GPS problem. The GPS signal GPS week number uses a 10-bit code with a maximum value of 1,023. This means every 19.7 years; the GPS week number rolls over to zero. Or, as Miller noted, "This code is a 1024 week time warp waiting to happen." So, check your systems now for this problem. And, if, like most of us, you're relying on someone upstream from you for the correct time, check with them to make sure they've taken care of this forthcoming trouble.' -- source: https://it.slashdot.org/story/21/10/21/2053248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Sues Vizio for GPL Violations
by Peter Reutemann 21 Oct '21

21 Oct '21

'Jeremy Allison - Sam writes: Software Freedom Conservancy, a non-profit organization that promotes open-source software and defends the free software General Public License (GPL), announced today it has filed a lawsuit against Vizio for what it calls repeated failures to fulfill even the basic requirements of the GPL. The lawsuit alleges that Vizio's TV products, built on its SmartCast system, contain software that Vizio unfairly appropriated from a community of developers who intended consumers to have very specific rights to modify, improve, share, and reinstall modified versions of the software.' -- source: https://yro.slashdot.org/story/21/10/19/2043203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Intel Versus The Chip Foundries
by Lawrence D'Oliveiro 21 Oct '21

21 Oct '21

Nice backgrounder <https://arstechnica.com/tech-policy/2021/10/intel-slipped-and-its-future-no…> on how Intel (and American chipmakers generally) slipped from their leadership position by overlooking an important new business: manufacturing chips according to other people’s designs. We’ve all heard of Taiwan-based TSMC, which is the world leader in this area; when it was founded way back in 1987 (with help from the Taiwanese Government and from Philips), none of the US companies would take such an idea seriously. They didn’t think it would amount to a very profitable business, and anyway they wanted to control their own Intellectual Property. Plus, a company that made chips both for its own internal businesses and for others could never be seen to be entirely above accusations of conflict of interest. Note also the role played by Carver Mead, basically the father of the whole concept of RISC. He wanted a place to go to, where his students (and those of other teachers) could get their designs turned into actual working chips. He had special personal connections with Intel to get access to their fabs, but he knew others were not so lucky. So he played an influential part in getting TSMC started.

1 0

Google Removes Support for FTP and Old-gen U2F Security Keys in Chrome 95
by Peter Reutemann 21 Oct '21

21 Oct '21

'Google today released Chrome v95, the latest version of its popular web browser and a version that contains several changes that will likely cause problems for a considerable part of its users. The problematic changes include: removing support for File Transfer Protocol (FTP) URLs -- ftp:// removing support for the Universal 2nd Factor (U2F) standard, used in old-generation security keys (Chrome will only support FIDO2/WebAuth security keys going forward) adding file size limits for browser cookies removing support for URLs with non-IPv4 hostnames ending in numbers, such as http://example.0.1 In addition to breaking changes, Chrome 95 also comes with a new UI component called the "Side Panel," which can be used to view the Chrome browser's Reading List and Bookmarks.' -- source: https://tech.slashdot.org/story/21/10/20/206210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Supply chain woes lead to a “temporary” Raspberry Pi 4 price hike
by Peter Reutemann 21 Oct '21

21 Oct '21

'Pandemic-driven supply chain problems have prompted the first-ever price increase for a Raspberry Pi product, according to Raspberry Pi founder Eben Upton. Acknowledging that the 2GB configuration of the Raspberry Pi 4 and the Raspberry Pi Zero had been particularly hard-hit by shortages, Upton announced that the price of the 2GB Pi 4 would increase from $35 to $45 and that a previously discontinued version of the Pi 4 with 1GB of RAM would be reintroduced at $35.' -- source: https://arstechnica.com/gadgets/2021/10/supply-chain-woes-lead-to-a-tempora… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Linux laptop offers RTX 3080 and 144 Hz 17-inch screen
by Peter Reutemann 20 Oct '21

20 Oct '21

'Linux users like to game, too, and the Juno Neptune 17-inch V3 laptop announced this week ensures that people on Ubuntu can play their favorite titles on the go. Keeping up with the Alienwares, Asus ROGs, and other Windows-focused gaming brands, the new portable packs up to an RTX 3080 discrete graphics card and the 8-core Intel Core i7-11800H. And it lets you experience all the action on a spacious, 17.3-inch screen with a 144 Hz refresh rate. A colorfully backlit keyboard completes the package.' -- source: https://arstechnica.com/gadgets/2021/10/new-linux-laptop-offers-rtx-3080-an… Well, if you have a spare USD3,699, then the maxed out version can be yours... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Brave Removes Google as its Default Search Engine
by Peter Reutemann 20 Oct '21

20 Oct '21

'As Paul Thurrott reports, Brave is removing Google Search as its default search engine. From the report: Going forward, the Brave web browser will default to Brave Search. "Brave Search has grown significantly since its release last June, with nearly 80 million queries per month," Brave CEO and co-founder Brendan Eich says. "Our users are pleased with the comprehensive privacy solution that Brave Search provides against Big Tech by being integrated into our browser. As we know from experience in many browsers, the default setting is crucial for adoption, and Brave Search has reached the quality and critical mass needed to become our default search option, and to offer our users a seamless privacy-by-default online experience." Brave Search is built on top of an independent index, and doesn't track users, their searches, or their clicks, the firm says. And starting with Brave 1.3 on desktop and Android, and Brave 1.32 on iOS, it will be the default search engine in the browser, instead of Google, in the United States, Canada, and the United Kingdom. It is also replacing Qwant in France and DuckDuckGo in Germany, and Brave says that more locales will be added in the next several months. Existing users can keep their chosen search engine default, of course, and new users who prefer other search engines can configure as needed. Brave Search doesn't display ads today, but the free version of the service will soon be ad-supported. An ad-free Premium version is coming "in the near future," Brave says. Along with this search engine news, Brave announced the Web Discovery Project (WDP), "which it describes as a privacy-preserving system for users to anonymously contribute data to improve Brave Search results," writes Thurrott. "The WDP is an opt-in feature that protects user privacy and anonymity by ensuring that contributed data is not linked to individuals, their devices, or any set of users." It has a GitHub repo available to help you learn more about this system.' -- source: https://tech.slashdot.org/story/21/10/19/2121251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

(virtual) meeting next Monday
by Peter Reutemann 19 Oct '21

19 Oct '21

Hi everyone We have a meeting coming up next week. Due to the small venue size, we will still hold it in a virtual manner, even if Hamilton should go back to level 2 (though we will record it): 'Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861093/ You will get access to the meeting link when RSVPing on meetup. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Quote Of The Week
by Lawrence D'Oliveiro 18 Oct '21

18 Oct '21

From <https://arstechnica.com/gadgets/2021/10/fixes-for-amd-ryzen-performance-oth…>: Now that Windows 11 is out, the arduous process of fixing the new operating system's bugs can begin. So goodbye Windows 10, no PrintNightmare fix for you...

1 0

PowerPC Fork of Firefox Reaches End of the Road
by Peter Reutemann 15 Oct '21

15 Oct '21

'Ars Technica: It has been well over a decade since PowerPC Macs roamed the earth -- so long that the Intel Macs that replaced them are themselves being replaced by something else. But to this day, there's a small community of people still developing software for PowerPC Macs and Mac OS 9. One of those projects was TenFourFox, a fork of the Firefox browser for G3, G4, and G5-based PowerPC Macs running Mac OS X 10.4 or 10.5. Maintained primarily by Cameron Kaiser, the TenFourFox project sprang up in late 2010 after Mozilla pulled PowerPC support from Firefox 4 during its development. And amazingly, the browser has continued to trundle on ever since. But continuing to backport Firefox features to aging, stuck-in-time PowerPC processors only got more difficult as time went on. And in March of this year, Kaiser announced that TenFourFox updates would be ending after over a decade of development. The final planned release of TenFourFox was earlier this month. Kaiser's full post is long, but it's worth a read for vintage-computer enthusiasts or anyone who works on software -- Kaiser expresses frustration with the realities of developing and supporting a niche app, but he also highlights TenFourFox's impressive technical achievements and ruminates on the nature of the modern Internet and open source software development [...]. Kaiser doesn't intend to fully halt work on the browser, but he is downshifting it into what he calls "hobby mode." He will continue to backport security patches from newer ESR releases of Firefox and post them to the TenFourFox Github page, but anyone who wants to use these will need to build the app themselves. Kaiser also won't commit to providing support for these additions or providing them on any kind of schedule. Other developers are also welcome to continue to release TenFourFox builds on their own. ' -- source: https://news.slashdot.org/story/21/10/14/2116255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Modular Framework Laptop Gets Marketplace For All Those Modules
by Peter Reutemann 15 Oct '21

15 Oct '21

'Framework, makers of the modular 13.5-inch Framework laptop that's designed to be easily repaired and upgraded, has launched a dedicated marketplace filled with replacement parts and upgrades for its portable computer. The Verge reports: Writing in a blog post, the company said the marketplace is currently focused on replacement parts and expansion cards, but that it hopes to add more customization modules like additional language keyboards later this year, as well as third-party and community developed modules in 2022. The marketplace already includes a range of expansion cards for the laptop, which are designed to slot into its four modular compartments to add everything from extra storage to features like MicroSD card slots or more USB ports. There's also user upgradeable RAM and storage for sale. But the store is clearly a work in progress, and lists a host of other items like replacement CPU-equipped mainboards, keyboards, and spare parts like batteries and displays as "coming soon." ' -- source: https://hardware.slashdot.org/story/21/10/14/2110258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 7.0 Released
by Peter Reutemann 15 Oct '21

15 Oct '21

'Everyone's favorite security-focused operating system, OpenBSD, released version 7.0 today. In addition to the usual bug fixes and performance enhancements, support for RISC-V processors has been added. The changelog and mirrors can be found at their respective links.' -- source: https://bsd.slashdot.org/story/21/10/14/217206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Releases Ubuntu Linux 21.10 Impish Indri
by Peter Reutemann 15 Oct '21

15 Oct '21

'Following a brief beta-testing period, Ubuntu 21.10 has finally become available to download in the "final" stable form. BetaNews: Code-named "Impish Indri," this version of Ubuntu is not a Long Term Support (LTS) version, so it is only supported for nine months. Ubuntu 21.10 features Linux kernel 5.13 and a Snap variant of the Mozilla Firefox browser. "Ubuntu 21.10 brings the all-new PHP 8 and GCC 11 including full support for static analysis, greatly improving everyday developer security awareness in low-level programming. With Gnome 40 desktop users gain dynamic workspaces and touchpad gestures. The new Firefox snap, published by Mozilla, improves security and guarantees access to both the latest and the extended support release versions of the browser. The exact same versions of the browser are available on multiple different versions of Ubuntu, simplifying enterprise developer platform management," says Canonical.' -- source: https://linux.slashdot.org/story/21/10/14/2013235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice, OpenOffice Bug Allows Hackers To Spoof Signed Docs
by Peter Reutemann 12 Oct '21

12 Oct '21

'LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source. Although the severity of the flaw is classified as moderate, the implications could be dire. BleepingComputer reports: The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. If you're using either of the open-source office suites, you're advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers -- LibreOffice, OpenOffice. If you're using Linux and the aforementioned versions aren't available on your distribution's package manager yet, you are advised to download the "deb", or "rpm" package from the Download center or build LibreOffice from source. If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros. ' -- source: https://it.slashdot.org/story/21/10/11/212215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'FontOnLake' Malware Family Can Target Linux Systems
by Peter Reutemann 11 Oct '21

11 Oct '21

'Security Week reports: A previously unknown, modular malware family that targets Linux systems has been used in targeted attacks to collect credentials and gain access to victim systems, ESET reported on Thursday. Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile. What's more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed to work together, namely trojanized applications, backdoors, and rootkits. Evidence suggests that FontOnLake has been used in attacks aimed at organizations in Southeast Asia. The first malware samples related to this family emerged last May. The malware was previously described by Avast and Lacework as the HCRootkit / Sutersu Linux rootkit, as well as by Tencent Security Response Center in a February report. The various trojanized applications that ESET's researchers have identified during their investigation are used to load custom backdoor or rootkit modules, but also to collect sensitive data when needed. Posing as standard Linux utilities, these files were also designed to achieve persistence on the compromised systems. What the researchers haven't figured out yet is the manner in which the trojanized applications are delivered to the victims. ESET's analysis of FontOnLake has revealed the use of three different backdoors, all written in C++, all using the same Asio library from Boost, and all capable of exfiltrating sshd credentials and bash command history. The simplest of the three was designed to launch and mediate access to a local SSH server, update itself, and transmit collected credentials. The malware appears to be under development. The second backdoor was also capable of file manipulation, updating itself, and uploading and downloading files, according to the article, while the third backdoor "accepts remote connections, serves as a proxy and can download and run Python scripts, in addition to exfiltrating credentials."' -- source: https://linux.slashdot.org/story/21/10/10/000240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

All Linux and Mac Computers Get Their Time Zones From the Same Database
by Peter Reutemann 11 Oct '21

11 Oct '21

'"All Linux and Mac-based computers pull their time zones from a massively important database — the time zone database," explains Medium's tech site OneZero. And this vastly crucial project is ultimately overseen by one man who Medium calls "The Time Zone King." The process of defining time zones is centralized. This is actually quite a big deal in its own right because people tend to grossly underestimate how pivotal Linux is to ... the entire internet and technology as we know it... The time zone database — which is sometimes called the Olson data or zoneinfo database — has a fascinating history... Not only are time zones apparently a longstanding menace for computer developers, but the time zone maintenance community is currently, it seems, mired among some procedural dispute regarding how this essential database should best be maintained. Of course that's an interesting fact in its own right: there is a world time zone data community. In fact, The Register recently described them as being no less than " up in arms " about the direction the project was proceeding down... A difference of vision among time zone enthusiasts might be the neatest summary anybody can advance.... Not only can't the time zone titans currently agree on the best way to carry the timezone database forward, it seems. But the entire process of codifying and standardizing time zones is also decidedly contentious political business with a long and tumultuous history to go with it. Those who enter the fray need to be therefore not only technical heavyweights but also prepared to have the occasional audacity to stand up to countries like the Hashemite Republic of Jordan and tell them that their attempt to prematurely end DST is unacceptable and will not be promulgated in the database... Weary time zone mavericks are bursting to the seams with horror stories of African states who made rash time zone decisions on only four days' notice... Time zone data insiders say that every single one of these high stakes deliberations represents a near Y2K disaster that must be averted... At the helm of this project is one individual. One guy. Paul Eggert, a computer scientist who teaches at the Department of Computer Science at the University of California's LA Campus... This is a man, after all, whose codebase helps hundreds of millions of users know what time zone they're in and who — for the past ten years — has gone to bed knowing that hundreds of millions of computers are using his code to know what time zone they're in. He's lived under that pressure for over a decade. And by all accounts thrived... Untold millions have been made by startups announcing dubious advents upon existing technologies heralded with the breathless fanaticism of companies announcing that they have found a way to turn air water into oil. Many of these will vanish into oblivion within a few short years. The time zone database won't. Because it can't. And those at the very bottom of the tech stack — those tirelessly and thanklessly maintaining open source projects upon which so much of the world's computing derives — languish in comparable obscurity... In recent years, the project has fallen under the purview of ICANN [through its Internet Assigned Numbers Authority]. Its code reads like a cross between a JSON file and a historical novel. And while I'm sure the project has many noteworthy contributors, there's ultimately one guy who's responsible for maintaining it. The Time Zone King. His name is Paul Eggert. And he's a computer scientist based out of UCLA. We probably all owe him a 'thank you'.' -- source: https://tech.slashdot.org/story/21/10/10/1950239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

I can't log into trademe and entering an URL dosen't work
by Michelle 10 Oct '21

10 Oct '21

Hi, I bought on disc the new version of Manjaro Plasma 64 bit KDE because the old Manjaro Illyria 18.0 64 bit I was using stopped working with various things. The new one won't allow me to log into tradme. I enter my email and password and it won't work just like the old one wouldn't. Plasma allows me to see pictures on tumblr whereas the old one stopped allowing that about 2 months ago. And youtube still works. But the new one has another big problem. For security issues I run a computer off a DVD and have no hard drive. When I want to go into any site that requires a password like email or trademe, this is what I do. I boot up, I pull up firefox, I type in the URL for trademe or what have you, and press enter, then and only then do I connect to the internet and click to 'retry' that site and then once at the site the first thing I do is log in. But this new Plasma won't allow me to do that. So could I please have some suggestions for two things: How to make this new one work in those two circumstances AND/OR Some specific names of Operating Systems that will actually allow logging into trademe and will allow URL's to be typed in. Thanks for any help.

3 11

Firefox Now Sends Your Address Bar Keystrokes To Mozilla
by Peter Reutemann 10 Oct '21

10 Oct '21

'How-To Geek reports: Firefox now sends more data than you might think to Mozilla. To power Firefox Suggest, Firefox sends the keystrokes you type into your address bar, your location information, and more to Mozilla's servers. Here's exactly what Firefox is sharing and how to control it. This change was made as part of the introduction of Firefox Suggest in Firefox 93, released on October 5, 2021. As part of Firefox Suggest, Firefox is getting ads in your search bar -- but that's not the only thing that will be news to longtime Firefox users. According to Mozilla, "Firefox Suggest acts as a trustworthy guide to the better web, surfacing relevant information and sites to help people accomplish their goals." In reality, what that means is, when you start typing in your address bar, you won't just see the standard search suggestions from Google or your current search default engine. You'll also see "Firefox Suggest" results pointing to web pages. Some of them are sponsored ads, but you can disable the ads. Firefox Suggest is on by default. Mozilla's blog post on the subject says Firefox Suggest is an "opt-in experience," which was the case in September 2021 -- but it's now enabled by default in Firefox 93. However, as of Firefox 93's release in October 2021, Firefox Suggest is only enabled in the USA -- for now. It's worth noting that, for many years, Firefox and other web browsers have had search suggestions in their address bar. So, when you start typing "win" in your address bar, you may see suggestions for "Windows 11" and "Window repair." This is accomplished by sending keystrokes to your default search engine as you type in the search bar, as Mozilla's support site explains. Mozilla is also providing contextual suggestions, for which it needs more data, including the city you're located in and whether you're clicking its suggestions. You can disable Firefox's suggested results, if you like. This will stop Mozilla from collecting the data you type in your search bar, and it will also disable the suggested results and ads. To do so, open Firefox and click menu [and then] Settings. Select "Privacy [and] Security" in the left pane, and scroll down to "Address Bar -- Firefox Suggest." Disable "Contextual suggestions" and "Include occasional sponsored suggestions" to stop Firefox from sending data to Mozilla.' -- source: https://news.slashdot.org/story/21/10/08/2225217 I saw that "Firefox suggest" popping up with the latest 93 as well and, when I tried to turn it off, didn't find the "Firefox suggest" option in the settings dialog that got mentioned in various articles. Something that p...ed me off somewhat... However, looking through the slashdot comments, I came across this github gist called "Silent Firefox": https://gist.github.com/AetherEternity/5a6bb6e493a3d34988fc7342013f2ea6 The top of the file lists where to place this "user.js" file. NB: You might already have such a file, so check before you overwrite it... Personally, I like suggestions from my history (which is turned off in this gist, key: "browser.urlbar.suggest.history"), so I forked the gist and enabled it: https://gist.github.com/fracpete/408ce83d3ce48f9f95b2fea30ddf5403 I'm not particularly fond of this move by Mozilla, but at least you can still tweak its browser (though it's become harder for non-technical people). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Now Shows Ads As Sponsored Address Bar Suggestions
by Peter Reutemann 08 Oct '21

08 Oct '21

'Mozilla is now showing ads in the form of sponsored Firefox contextual suggestions when U.S. users type in the URL address bar. Mozilla says the feature was introduced with Firefox 92 in September to fund development and optimization. Mozilla describes Firefox Suggest contextual suggestions as opt-in, in BleepingComputer's tests and from what users have reported, the feature is on by default. Furthermore, Firefox doesn't tag the ads displayed via Firefox Suggest. There is no clear way to identify what a sponsored suggestion and what a regular unsponsored suggestion should look like. The only way Firefox users will know whether a sponsored suggestion is an ad would be by looking at the URL, but, in many cases, the URL is not clearly visible.' -- source: https://news.slashdot.org/story/21/10/07/1844254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache Fixes Actively Exploited Web Server Zero-day
by Peter Reutemann 06 Oct '21

06 Oct '21

'The Apache Software Foundation has released a security patch to address a vulnerability in its HTTP Web Server project that has been actively exploited in the wild. From a report: Tracked as CVE-2021-41773, the vulnerability affects only Apache web servers running version 2.4.49 and occurs because of a bug in how the Apache server converts between different URL path schemes (a process called path or URI normalization). "An attacker could use a path traversal attack to map URLs to files outside the expected document root," the ASF team said in the Apache HTTP Server 2.4.50 changelog. "If files outside of the document root are not protected by 'require all denied' these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts," Apache engineers added. More than 120,000 servers currently exposed online to attacks.' -- source: https://apache.slashdot.org/story/21/10/05/1538213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Company That Routes Billions of Text Messages Quietly Discloses It Was Hacked
by Peter Reutemann 05 Oct '21

05 Oct '21

'A company that is a critical part of the global telecommunications infrastructure used by AT&T, T-Mobile, Verizon and several others around the world such as Vodafone and China Mobile, quietly disclosed that hackers were inside its systems for years, impacting more than 200 of its clients and potentially millions of cellphone users worldwide. From a report: The company, Syniverse, revealed in a filing dated September 27 with the U.S. Security and Exchange Commission that an unknown "individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers." A former Syniverse employee who worked on the EDT systems told Motherboard that those systems have information on all types of call records. [...] The company wrote that it discovered the breach in May 2021, but that the hack began in May of 2016.' -- source: https://tech.slashdot.org/story/21/10/04/1827246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds On Community, Rust and Linux's Longevity
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week saw the annual check-in with Linux creator Linus Torvalds at the Open Source Summit North America, this year held in Seattle (as well as virtually). Torvalds took the stage for the event's traditional half-hour of questions from Dirk Hohndel, an early Linux contributor (now also the chief open source officer and vice president at VMware) in an afternoon keynote session.... And the theme of community seemed to keep coming up — notably about what that community has ultimately taught Linus Torvalds. (For example, while Torvalds said he'd originally planned on naming the operating system Freax, "I am eternally grateful for two other people for having more taste than I did.") But even then Linux was a project that "I probably would've left behind," Torvalds remembered, "if it was only up to me." Torvalds credits the larger community for its interest (and patches) "that just kept the motivation going. And here we are 30 years later, and it's still what keeps the motivation going. Because as far as I'm concerned, it's been done for 29 of those 30 years, and every single feature ever since has been about things that other people needed or wanted or were interested in." Torvalds also says "I'm very proud of the fact that there's actually a fair number of people still involved with the kernel that came in in 1991 — I mean, literally 30 years ago.... I think that's a testament to how good the community, on the whole, has been, and how much fun it's been." And Torvalds says you can see that sense of fun in discussions about writing some Linux kernel modules using Rust. "From a technical angle, does that make sense?" Torvalds asked. "Who knows. That's not the point. The point is for a project to stay interesting — and to stay fun — you have to play with it.... "Probably next year, we'll start seeing some first intrepid modules being written in Rust, and maybe being integrated in the mainline kernel." "I really love C," Torvalds said at one point. "I think C is a great language, and C is, to me, is really a way to control the hardware at a fairly low level..." Yet Torvalds also saw Hohndel's analogy that it can be like juggling chainsaws. As a long-time watcher of C, Torvalds knows that C's subtle type interactions "are not always logical" and "are pitfalls for pretty much anybody. And they're easy to overlook, and in the kernel that's not always a good thing." Torvalds called Rust "the first language I saw which looked like this might actually be a solution"' -- source: https://linux.slashdot.org/story/21/10/02/004213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions Experience Browser Problems After Long-Anticipated Expiration of 'Let's Encrypt' Certificate
by Peter Reutemann 04 Oct '21

04 Oct '21

'"The expiration of a key digital encryption service on Thursday sent major tech companies nationwide scrambling to deal with internet outages that affected millions of online users," reports the Washington Examiner. The expiring certificate was issued by Let's Encrypt — though ZDNet notes there's been lots of warnings about its pending expiration: Digital Shadows senior cyber threat analyst Sean Nikkel told ZDNet that Let's Encrypt put everyone on notice back in May about the expiration of the Root CA Thursday and offered alternatives and workarounds to ensure that devices would not be affected during the changeover. They have also kept a running forum thread open on this issue with fairly quick responses, Nikkel added. Thursday night the Washington Examiner describes what happened when the big day arrived: Tech giants — such as Amazon, Google, Microsoft, and Cisco, as well as many smaller tech companies — were still battling with an endless array of issues by the end of the night... At least 2 million people have seen an error message on their phones, computers, or smart gadgets in the past 24 hours detailing some internet connectivity problems due to the certificate issue, according to Scott Helme, an internet security researcher and well-known cybersecurity expert. "So many people have been affected, even if it's only the inconvenience of not being able to visit certain websites or some of their apps not working," Helme said. "This issue has been going on for many hours, and some companies are only just getting around to fixing it, even big companies with a lot of resources. It's clearly not going smoothly," he added. There was an expectation before the certificate expired, Helme said, that the problem would be limited to gadgets and devices bought before 2017 that use the Let's Encrypt digital certificate and haven't updated their software. However, many users faced issues on Thursday despite having the most cutting-edge devices and software on hand. Dozens of major tech products and services have been significantly affected by the certificate expiration, such as cloud computing services for Amazon, Google, and Microsoft; IT and cloud security services for Cisco; sellers unable to log in on Shopify; games on RocketLeague; and workflows on Monday.com. Security researcher Scott Helme also told ZDNet he'd also confirmed issues at many other companies, including Guardian Firewall, Auth0, QuickBooks, and Heroku — but there might be many more beyond that: "For the affected companies, it's not like everything is down, but they're certainly having service issues and have incidents open with staff working to resolve. In many ways, I've been talking about this for over a year since it last happened, but it's a difficult problem to identify. it's like looking for something that could cause a fire: it's really obvious when you can see the smoke...!" Digital certificates expert Tim Callan added that the popularity of DevOps-friendly architectures like containerization, virtualization and cloud has greatly increased the number of certificates the enterprise needs while radically decreasing their average lifespan. "That means many more expiration events, much more administration time required, and greatly increased risk of a failed renewal," he said. ' -- source: https://it.slashdot.org/story/21/10/02/2318202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Announces 'JShelter' Browser Privacy Extension to Block Fingerprinting, Tracking, and Malware
by Peter Reutemann 04 Oct '21

04 Oct '21

'This week the Free Software Foundation (FSF) announced JShelter, "an anti-malware Web browser extension to mitigate potential threats from JavaScript, including fingerprinting, tracking, and data collection." The browser add-on — supported by NLnet Foundation's Next Generation Internet (NGI) Zero Privacy & Trust Enhancing Technologies fund — is currently "in development and the first release is available." This browser add-on will limit the potential for JavaScript programs to do harmful actions by restricting default behavior and adding a layer of control... Accessing cookies, performing fingerprinting to track users across multiple sites, revealing the local network address, or capturing the user's input before they submit a form are some examples of JavaScript's capabilities that can be used in harmful ways. JShelter adds a safety layer that allows the user to choose if a certain action should be forbidden on a site, or if it should be allowed with restrictions, such as reducing the accuracy of geolocation to the city area. This layer can also aid as a countermeasure against attacks targeting the browser, operating system, or hardware levels... [The extension] will ask — globally or per site — if specific native functions provided by the JavaScript engine and the Document Object Model (DOM) are allowed by the user. It will also link to an explanatory page for each function, to raise awareness of related threats. Depending on the function being addressed, the user will have the option to allow it, block it, or have it return a custom value... "Our browsers have become perhaps the most critical of tools we depend on, and yet the browser environment is far from healthy," says Michiel Leenaars, director of strategy at NLnet Foundation and coordinator of NGI Zero. "Dominant corporate behavior from a small amount of actors has been aggressively reshaping the evolution of the Web, and that is starting to wreak havoc. Despite an enormous systemic dependency, we as users have very little control over what browsers allow and share — leading to significant risk as the most powerful tools in the shed are essentially left unprotected for every casual Web site to abuse. JShelter is a great initiative to help empower us all, to help us gain better understanding and to better safeguard ourselves from obvious and otherwise unavoidable harm." The effort is part of a larger, multi-year campaign from FSF on JavaScript on the Web started in 2013, which among others includes the development of GNU LibreJS and outreach to users and developers about nonfree software inside the browser. The GNU LibreJS extension detects JavaScript web labels and assists users with running only JavaScript distributed under a free software license, according to their ethical convictions and individual preferences. "JShelter will help protect users from critical threats now, and contribute significantly to progress on the necessary longer-term cultural shift of moving away from nonfree JavaScript," said Ruben Rodriguez, former FSF chief technology officer. "This is a project I've been looking forward to for years, tired of dealing with all kinds of potential antifeatures in the browsers I use and distribute, and having to figure out some countermeasure for them with configuration changes, patches or extensions. Being able to wrap the JavaScript engine in a layer of protection is a game changer."' -- source: https://news.slashdot.org/story/21/10/03/0150251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Let's Encrypt's Root Certificate is expiring!
by Peter Reutemann 01 Oct '21

01 Oct '21

'On 30th September 2021, the root certificate that Let's Encrypt are currently using, the IdentTrust DST Root CA X3 certificate, will expire. You may or may not need to do anything about this Root CA expiring, but I'm betting a few things will probably break on that day so here's what you need to know!' -- source: https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

People Will Pay For Privacy, And Take Rewards To Give It Up
by Lawrence D'Oliveiro 01 Oct '21

01 Oct '21

British consumer magazine “Which?” has published the results of a survey <https://www.theregister.com/2021/09/30/which_data_survey/> which found that people would pay companies like Google and Facebook an average of £1.09 a month to avoid collection of their personal data and its use for targeted advertising. On the other hand, while a quarter of people were happy to receive targeted advertising to begin with, that proportion went up quite substantially if a basic reward like an Amazon voucher were offered.

1 0

Social Media Companies Can’t Be Trusted To Police Themselves -- Who Knew?
by Lawrence D'Oliveiro 29 Sep '21

29 Sep '21

>From a hearing at the US House of Representatives <https://www.theregister.com/2021/09/29/facebook_research_congress/> which received submissions from academics trying to study Facebook’s effect on its users in the face of active hostility from the company: “Tobacco companies don't get to decide who does research on smoking and the idea that social media companies get to decide who studies them is perverse.” -- Laura Edelson

1 0

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension
by Peter Reutemann 27 Sep '21

27 Sep '21

'The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development. No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever. Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections. >From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode. With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition. The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."' -- source: https://it.slashdot.org/story/21/09/27/008226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Recognizes Linux's 'True' 30th Anniversary Date
by Peter Reutemann 26 Sep '21

26 Sep '21

'While it's been argued that Linux has four different "birthdays," last Friday saw the 30th anniversary of Linux's very, very first release — version 0.01. That special first release "was never publicly announced, and I only emailed a handful of people in private about the upload," Torvalds remembered on the Linux kernel mailing list. He no longer has copies of those announcement emails, "so there's no real record of that. The only record of the date is in the Linux-0.01 tar-file itself, I suspect." "Alas, the dates in that tar-file are for the last modification dates, not the actual creation of the tar-file," Torvalds wrote, "but it does seem to have happened around 7:30pm (Finnish time), so the exact anniversary was technically a couple of hours ago." So when the exact moment arrived for its 30th anniversary, Torvalds couldn't resist sharing the moment on the Linux kernel mailing list. "Just thought I'd mention it, since while unannounced, in many ways this is the true 30th anniversary date of the actual code."' -- source: https://linux.slashdot.org/story/21/09/25/0333233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting tomorrow
by Peter Reutemann 26 Sep '21

26 Sep '21

Hi everyone Apologies for the late reminder, things have been a bit hectic at my end... We have a "virtual" meeting tomorrow: "Peter Reutemann will demo Syncthing (https://syncthing.net/) a continuous file synchronization program. It synchronizes files between two or more computers in real time, respecting your privacy. Runs on Linux, Windows, Mac and Android among other platforms." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861089/ Meeting link will be available to people that RSVP on meetup.com. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First RISC-V Computer Chip Lands At the European Processor Initiative
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Register reports: The European Processor Initiative (EPI) has run the successful first test of its RISC-V-based European Processor Accelerator (EPAC), touting it as the initial step towards homegrown supercomputing hardware. EPI, launched back in 2018, aims to increase the independence of Europe's supercomputing industry from foreign technology companies. At its heart is the adoption of the free and open-source RISC-V instruction set architecture for the development and production of high-performance chips within Europe's borders. The project's latest milestone is the delivery of 143 samples of EPAC chips, accelerators designed for high-performance computing applications and built around the free and open-source RISC-V instruction set architecture. Designed to prove the processor's design, the 22nm test chips -- fabbed at GlobalFoundries, the not-terribly-European semiconductor manufacturer spun out of AMD back in 2009 -- have passed initial testing, running a bare-metal "hello, world" program as proof of life. It's a rapid turnaround. The EPAC design was proven on FPGA in March and the project announced silicon tape-out for the test chips in June -- hitting a 26.97mm2 area with 14 million placeable instances, equivalent to 93 million gates, including 991 memory instances. While the FPGA variant, which implemented a subset of the functions of the full EPAC design, was shown booting a Linux operating system, the physical test chips have so far only been tested with basic bare-metal workloads -- leaving plenty of work to be done. Earlier today, the UK government released its 10-year plan to make the country a global "artificial intelligence superpower," seeking to rival the likes of the U.S. and China. "The so-called 'National Artificial Intelligence Strategy' is designed to boost the use of AI among the nation's businesses, attract international investment into British AI companies and develop the next generation of homegrown tech talent," reports CNBC.' -- source: https://hardware.slashdot.org/story/21/09/22/2057258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security audit raises severe warnings on Chinese smartphone model
by Peter Reutemann 23 Sep '21

23 Sep '21

'The Lithuanian National Cyber Security Centre (NCSC) recently published a security assessment of three recent-model Chinese-made smartphones—Huawei's P40 5G, Xiaomi's Mi 10T 5G, and OnePlus' 8T 5G. Sufficiently determined US shoppers can find the P40 5G on Amazon and the Mi 10T 5G on Walmart.com—but we will not be providing direct links to those phones, given the results of the NCSC's security audit. The Xiaomi phone includes software modules specifically designed to leak data to Chinese authorities and to censor media related to topics the Chinese government considers sensitive. The Huawei phone replaces the standard Google Play application store with third-party substitutes the NCSC found to harbor sketchy, potentially malicious repackaging of common applications. The OnePlus 8T 5G—arguably, the best-known and most widely marketed phone of the three—was the only one to escape the NCSC's scrutiny without any red flags raised.' -- source: https://arstechnica.com/information-technology/2021/09/security-audit-raise… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Finally Shifting To 'Upstream First' Linux Kernel Approach For Android Features
by Peter Reutemann 23 Sep '21

23 Sep '21

'Phoronix reports: Google's Android had been notorious for all of its downstream patches carried by the mobile operating system as well as various vendor/device kernel trees while in recent years more of that code has been upstreamed. Google has also been shifting to the Android Generic Kernel Image (GKI) as the basis for all their product kernels to further reduce the fragmentation. Looking ahead, Google is now talking of an "upstream first" approach for pushing new kernel features into mainline Linux before deploying them on Android. Google's Todd Kjos talked today during Linux Plumbers Conference (LPC2021) around their Generic Kernel Image initiative. With Android 12 and their Linux 5.10 based GKI image they have further cut down the fragmentation to the extent that it's "nearly eliminated." With the Android 12 GKI, most of the vendor/OEM kernel features have now either been upstreamed into the Linux kernel, isolated to vendor modules/hooks, or merged into the Android Common Kernel. They are making good progress on the GKI front and also ensuring vendors adapt to the new approach to cut down on the kernel mess. But perhaps most exciting is their outlook for 2023 to 2024 for further reducing technical debt. They are going to pursue an "upstream first development model for new features" in making sure new code first lands into the mainline Linux kernel rather than aiming straight for lodging within the Android source tree. ' -- source: https://tech.slashdot.org/story/21/09/22/1920258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming NAS workshop
by 51miked 22 Sep '21

22 Sep '21

Anyone interested in a NAS workshop can register at: https://www.qnap.com/static/landing/en-us/workshop/workshop-09.html. I’ve found these very informative. Michael -- Kind regards Michael

2 2

Ubuntu 14.04 and 16.04 Each Get a Decade of Support from Canonical
by Peter Reutemann 22 Sep '21

22 Sep '21

'Canonical has announced that it is extending the life of Ubuntu 14.04 and 16.04 to a decade. BetaNews: In other words, Ubuntu 14.04 and 16.04 are getting longer Extended Security Maintenance (ESM) periods as Canonical pushes back their End of Life (EoL) dates. The former will now get security updates until 2024, while the latter will receive them until 2026. "This lifecycle extension enables organizations to balance their infrastructure upgrade costs, by giving them additional time to implement their upgrade plan. The prolonged Extended Security Maintenance (ESM) phase of Ubuntu 14.04 LTS and 16.04 LTS enables a secure and low-maintenance infrastructure with security updates and kernel livepatches provided by Canonical. The announcement represents a significant opportunity for the organizations currently implementing their transition to new applications and technologies," says Canonical.' -- source: https://linux.slashdot.org/story/21/09/21/1443254 That could help IoT devices to stay up to date for longer (at least OS-wise). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over-Elaborate Shell Scripting
by Lawrence D'Oliveiro 21 Sep '21

21 Sep '21

When using a computer, laziness is a virtue. This is why we have command lines, to help automate the boring and repetitive tasks. This article <https://arstechnica.com/gadgets/2021/09/command-line-wizardry-part-two-vari…> continues the author’s intro to basic command-line concepts. But it repeats a failing I see all too often in shell scripting: doing complex parsing of the output of some command, when the command itself offers an option to produce something closer to the exact output you need. In this case, he is extracting the names of datasets from the “zfs list” command. And while I have zero experience with ZFS, I can look at documentation <https://docs.oracle.com/cd/E18752_01/html/819-5461/gazsu.html>, and discover that the command offers the “-o” option where you can select exactly that information you want it to output. It even has “-H” to simplify the output format right down, specifically to make it easier to parse. Sure, it’s fun to write code. But it can be even more fun to _avoid_ writing code. RTFM helps.

2 3

Linux Foundation Survey Shows Companies Desperate To Hire Open-Source Talent
by Peter Reutemann 21 Sep '21

21 Sep '21

'ZDNet reports: At the Open Source Summit in Seattle, The Linux Foundation, and edX, the leading massive open online course (MOOC) provider released the 2021 Open Source Jobs Report. In this survey of 200 technical hiring managers and 750 open-source pros, the organizations found more demand for top open-source workers than ever. On top of that, 92% of managers are having trouble finding enough talent and many of them are also having fits holding on to their existing senior open-source staffers. In short, if you've got open-source skills, whether you're a developer, a sysadmin, a DevOps expert, or a cloud-native pro, there's a good-paying job waiting for you out there. And, where before the Covid-19 pandemic, you might have been stuck with only jobs in your area, these days, thanks to the rise of working from home, you can still live at the old homestead instead of moving to Silicon Valley or Manhattan. On top of this 50% of employers surveyed stated they are increasing hires this year. The jobs are out there. The difficulty for companies is, as 92% of managers report, finding enough talent and hanging onto existing talent in the face of fierce competition. This is especially true for cloud-native application development and operations skills. Cloud-native tops the list of skills needed with over 46% of hiring managers looking for people with Kubernetes smarts. Indeed, for the first time in the survey's history, cloud and container technology skills are more in demand by hiring managers than Linux. Indeed, cloud and container skills rank far above Linux in this go around with 41% over 32%. [T]he survey also found that DevOps has become the standard method for developing software: Virtually all open-source professionals (88%) report using DevOps practices in their work, a 50% increase from three years ago. In other words, it's all DevOps all the time. "The survey also revealed that a majority of employers, 88%, now say that hiring certified professionals is a priority," the report adds. "That's an 87% increase in only three years, 57% in 2020, and 47% in 2018." Sadly, discrimination has also become more of an issue. "18% of open-source professionals now report they have been discriminated against or made to feel unwelcome in the community," the report says. "That's a 125% increase over the past three years."' -- source: https://news.slashdot.org/story/21/09/20/2031215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Home Computing Pioneer Sir Clive Sinclair Dies Aged 81
by Peter Reutemann 20 Sep '21

20 Sep '21

'Sir Clive Sinclair, the man behind the Sinclair Spectrum and the first computer to retail for under a hundred dollars (the Sinclair ZX-81, A.K.A. The Timex/Sinclair 1000), died September 15 after battling a long illness. His daughter, Belinda, said he died at home in London on Thursday morning after a long illness. Sinclair invented the pocket calculator but was best known for popularising the home computer, bringing it to British high-street stores at relatively affordable prices. Many modern-day titans of the games industry got their start on one of his ZX models. For a certain generation of gamer, the computer of choice was either the ZX Spectrum 48K or its rival, the Commodore 64. Belinda Sinclair, 57, told the Guardian: "He was a rather amazing person. Of course, he was so clever and he was always interested in everything. My daughter and her husband are engineers so he'd be chatting engineering with them." He left school at 17 and worked for four years as a technical journalist to raise funds to found Sinclair Radionics.' -- source: https://news.slashdot.org/story/21/09/16/1936235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Mozilla Experiment: Set Default Search Engine to Bing for 1% of Firefox Users
by Peter Reutemann 20 Sep '21

20 Sep '21

'"Mozilla is running an experiment on 1% of the Firefox desktop population currently, which sets the default search engine to Bing in the web browser," reports Ghacks: [I]n most regions, it is Google Search. Mozilla and Google extended the search deal in 2020 for another three years. Google is paying Mozilla "between $400 and $450 million per year" so that its search engine is the default in Firefox in most regions. Google has been Firefox's default search engine since 2017, when Mozilla ended its search deal with Yahoo early. Firefox users may change the default search engine to one of the other engines that are included by default, or an engine that is not included but can be added... The study started on September 6 and it will run until early 2022, likely January 2022. About 1% of Firefox desktop users may notice that the default search engine is changed when the installation of Firefox is picked for the experiment. Tip: load about:studies in the Firefox address bar to list the studies that the browser us currently taking part in and has completed already. Firefox users who don't want to participate in studies can disable the preference "Allow Firefox to install and run studies" on about:preferences#privacy. ' -- source: https://news.slashdot.org/story/21/09/18/1914227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0