- wlug - list.wlug.org.nz

NFC Flaws Let Researchers Hack an ATM By Waving a Phone
by Peter Reutemann 27 Jun '21

27 Jun '21

'Ars Technica reports: For years, security researchers and cybercriminals have hacked ATMs by using all possible avenues to their innards, from opening a front panel and sticking a thumb drive into a USB port to drilling a hole that exposes internal wiring. Now, one researcher has found a collection of bugs that allow him to hack ATMs -- along with a wide variety of point-of-sale terminals -- in a new way: with a wave of his phone over a contactless credit card reader. Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader -- rather than swipe or insert it -- to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe. Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems' firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash -- though that "jackpotting" hack only works in combination with additional bugs he says he has found in the ATMs' software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors. "You can modify the firmware and change the price to one dollar, for instance, even when the screen shows that you're paying 50 dollars. You can make the device useless, or install a kind of ransomware. There are a lot of possibilities here," says Rodriguez of the point-of-sale attacks he discovered. "If you chain the attack and also send a special payload to an ATM's computer, you can jackpot the ATM -- like cash out, just by tapping your phone." Rodriguez says he alerted the affected vendors -- which include ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and the unnamed ATM vendor -- to his findings between seven months and a year ago. Even so, he warns that the sheer number of affected systems and the fact that many point-of-sale terminals and ATMs don't regularly receive software updates -- and in many cases require physical access to update -- mean that many of those devices likely remain vulnerable. "Patching so many hundreds of thousands of ATMs physically, it's something that would require a lot of time," Rodriguez says.' -- source: https://it.slashdot.org/story/21/06/25/2049217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Admits to Mistakenly Signing a Malicious Malware Rootkit
by Peter Reutemann 27 Jun '21

27 Jun '21

'Bleeping Computer reports: Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control IPs. G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec community in tracing and analyzing the malicious drivers bearing the seal of Microsoft... This incident has once again exposed threats to software supply-chain security, except this time it stemmed from a weakness in Microsoft's code-signing process. G Data writes: We forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation. At the time of writing it is still unknown how the driver could pass the signing process. In a Friday blog post, Microsoft said it was contacting other antivirus software vendors "so they can proactively deploy detections," but also emphasized the attack's limited scope: The actor's activity is limited to the gaming sector specifically in China and does not appear to target enterprise environments. We are not attributing this to a nation-state actor at this time. The actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere. The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers. It's important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf. We will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections. There are no actions customers should take other than follow security best practices and deploy Antivirus software such as Windows Defender for Endpoint.' -- source: https://it.slashdot.org/story/21/06/26/1918225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Photos is so 2020—welcome to the world of self-hosted photo management
by Peter Reutemann 26 Jun '21

26 Jun '21

'We take more photos now than ever before. Growth in this segment is explosive, with over 1.4 trillion photos taken last year, according to InfoTrends. That's up from 1 trillion in 2017. Video is much the same, with YouTube saying in recent years that about 500 hours of video are uploaded to the platform every minute. Finding a solution to organizing and safely storing these precious memories is more important than ever, and it's becoming an increasingly large problem to solve. Photos depict a special moment in time, a memory or event that can't be recreated. They are irreplaceable and largely only exist digitally. Because of this, there are few categories of data that suit a free and open self-hosted solution better.' -- source: https://arstechnica.com/gadgets/2021/06/the-big-alternatives-to-google-phot… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

A quick-start guide to OpenZFS native encryption
by Peter Reutemann 25 Jun '21

25 Jun '21

'One of the many features OpenZFS brings to the table is ZFS native encryption. First introduced in OpenZFS 0.8, native encryption allows a system administrator to transparently encrypt data at rest within ZFS itself. This obviates the need for separate tools like LUKS, VeraCrypt, or BitLocker.' -- source: https://arstechnica.com/gadgets/2021/06/a-quick-start-guide-to-openzfs-nati… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Peter Reutemann 25 Jun '21

25 Jun '21

'Network device maker Zyxel is warning customers of active and ongoing attacks that are targeting a range of the company’s firewalls and other types of security appliances. In an email, the company said that targeted devices included security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. The language in the email is terse, but it appears to say that the attacks target devices that are exposed to the Internet. When the attackers succeed in accessing the device, the email further appears to say, they are then able to connect to previously unknown accounts hardwired into the devices.' -- source: https://arstechnica.com/gadgets/2021/06/zyxel-scrambles-to-thwart-active-ha… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“I’m totally screwed.” WD My Book Live users wake up to find their data deleted
by Peter Reutemann 25 Jun '21

25 Jun '21

'Western Digital, maker of the popular My Disk external hard drives, is recommending customers unplug My Disk Live storage devices from the Internet until further notice while company engineers investigate unexplained compromises that have completely wiped data from devices around the world. The mass incidents of disk wiping came to light in this thread on Western Digital’s support forum. So far, there are no reports of deleted data later being restored.' -- source: https://arstechnica.com/gadgets/2021/06/mass-data-wipe-in-my-book-devices-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu-maker Canonical Will Support Open Source Blender on Windows, Mac, and Linux
by Peter Reutemann 24 Jun '21

24 Jun '21

'Blender is one of the most important open source projects, as the 3D graphics application suite is used by countless people at home, for business, and in education. The software can be used on many platforms, such as Windows, Mac, and of course, Linux. Today, Ubuntu-maker Canonical announces it will offer paid enterprise support for Blender LTS. Surprisingly, this support will not only be for Ubuntu users. Heck, it isn't even limited to Linux installations. Actually, Canonical will offer this support to Blender LTS users on Windows, Mac, and Linux.' -- source: https://news.slashdot.org/story/21/06/23/1950222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Open Source AMD FidelityFX Super Resolution Impresses In PC Game Tests
by Peter Reutemann 24 Jun '21

24 Jun '21

'AMD's FidelityFX Super Resolution (FSR) PC graphics up-scaling technology is ready for prime-time and the company has allowed members of the press to showcase performance and visuals of the tech in action with a number of game engines. AMD FidelityFX Super Resolution is vendor-agnostic and doesn't require specialized hardware to function like NVIDIA DLSS, which relies on Tensor cores on-board NVIDIA Turing or Ampere GPUs to accelerate neural network models that have been specifically trained on game engines. In contrast, AMD FSR utilizes more traditional spatial upscaling to create a super resolution image from a single input frame, not multiple frames. AMD FSR then employs a library of open-source algorithms that work on sharpening both image edge and texture detail. In game testing at HotHardware, frame rates can jump dramatically with little to no perceptible reduction in image quality, and the technology even works on many NVIDIA GPUs as well. There are currently 19 titles that are available or planned with support for AMD FSR, but with the open nature of the technology and cross-GPU compatibility, game developers theoretically should have significant incentive for adoption to breath new performance into their game titles.' -- source: https://tech.slashdot.org/story/21/06/22/217251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS replacement distro Rocky Linux’s first general release is out
by Peter Reutemann 22 Jun '21

22 Jun '21

'Rocky Linux—one of at least two new distributions created to fill the void left when CentOS Linux was discontinued by parent corporation Red Hat—announced general availability of Rocky Linux 8.4 today. Rocky Linux 8.4 is binary-compatible with Red Hat Enterprise Linux 8.4, making it possible to run apps designed and tested only for RHEL without RHEL itself.' -- source: https://arstechnica.com/gadgets/2021/06/centos-replacement-distro-rocky-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Begins Testing Sponsors on Some Users' Default Home Page/New Tab Pages
by Peter Reutemann 21 Jun '21

21 Jun '21

'Earlier this year a new support page appeared at support.Mozilla.org describing sponsored shortcuts (or sponsored tiles), "an experimental feature currently being tested by a small percentage of Firefox users in a limited number of markets." Mozilla works with advertising partners to place sponsored tiles on the Firefox default home page (or New Tab page) that would be useful to Firefox users. Mozilla is paid when users click on sponsored tiles.... [W]e only work with advertising partners that meet our privacy standards for Firefox. When you click on a sponsored tile, Firefox sends anonymized technical data to our partner through a Mozilla-owned proxy service. The code for this proxy service is available on GitHub for interested technical audiences. This data does not include any personally identifying information and is only shared when you click on a Sponsored shortcut.... You can disable a specific Sponsored tile... You can also disable Sponsored shortcuts altogether. Describing the as-yet-experimental feature, Engadget wrote a story headlined "Don't freak out: Firefox is testing advertisements in new tabs." These are just the tests, still mainly aimed at fresh installs of the Firefox web browser and always to beta users, before the rollout of sponsored tiles. It does sound like adverts are in the pipe, but it depends on the reaction to Mozilla's initial tests. Mozilla's Jonathan Nightingale says that, last time around, the reaction wasn't as positive as his company hoped. "It didn't go over well," he states. Further, he insists that Firefox won't become "a mess of logos sold to the highest bidder; without user control, without user benefit." Long-time Slashdot reader angryargus says they spotted the feature when they noticed an Ebay advertisement, but appreciated the ability to opt out, and suggested the feature is "an annoying tradeoff off using a browser that's not as directly funded by a search engine."' -- source: https://news.slashdot.org/story/21/06/20/0153218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 21 Jun '21

21 Jun '21

Hi everyone 'New to the version control system git or wanting to share some handy tricks? Lawrence D'Oliveiro will give an introduction to the git command-line and how to manage files with it. After the intro, we will look into how to use github (e.g., forks, pull requests) and github alternatives.' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861060/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Standard But Not Open Access: Schematron Author Complains About ISO Paywall
by Lawrence D'Oliveiro 19 Jun '21

19 Jun '21

Not the first time this has happened <https://www.theregister.com/2021/06/18/schematron_standard_paywall/>: a group volunteers to create an open standard, giving freely of their time, get it widely adopted, hand it over to a standards body like ISO to make it “official”, and the latter starts charging for copies of the spec. Note this response from ISO: "Unfortunately, the ISO Central Secretariat does not provide free copies of standards. All ISO Publications derive from the work and contributions of ISO and ISO Members that contain intellectual property of demonstrable economic value.” And how much did ISO pay those contributors for that “intellectual property”? Not a penny.

1 0

Microsoft’s Linux repositories were down for 18+ hours
by Peter Reutemann 19 Jun '21

19 Jun '21

'Yesterday, packages.microsoft.com—the repository from which Microsoft serves software installers for Linux distributions including CentOS, Debian, Fedora, OpenSUSE, and more—went down hard, and it stayed down for around 18 hours. The outage impacted users trying to install .NET Core, Microsoft Teams, Microsoft SQL Server for Linux (yes, that's a thing) and more—as well as Azure's own devops pipelines. We first became aware of the problem Wednesday evening when we saw 404 errors in the output of apt update on an Ubuntu workstation with Microsoft Teams installed. The outage is somewhat better-documented at this .NET Core issue report on Github, with many users from all around the world sharing their experiences and theories. The short version is that the entire repository cluster that serves all Linux packages for Microsoft was completely down—issuing a range of HTTP 404 (content not found) and 500 (Internal Server Error) messages for any URL—for roughly 18 hours. Microsoft engineer Rahul Bhandari confirmed the outage roughly five hours after it was initially reported, with a cryptic comment about the infrastructure team "running into some space issues." Eighteen hours after the issue was detailed, Bhandari said that the mirrors were once again available—although with temporarily degraded performance, likely due to cold caches. In this update, Bhandari said that the original cause of the outage was "a regression in [apt repositories] during some feature migration work that resulted in those packages becoming unavailable on the mirrors." We're still waiting for a comprehensive incident report, since Bhandari's status updates provide clues but no real explanations. The good news: We can confirm that packages.microsoft.com is indeed up once again, and it is serving packages as it should.' -- source: https://arstechnica.com/gadgets/2021/06/microsofts-linux-repositories-were-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Code Trainspotting
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

The item on One News this evening about difficulties bringing in families of skilled workers showed some brief screenshots of some source code. I noticed the identifier “nsown_capable”, and doing a search for this reveals it’s from the Linux kernel <https://elixir.bootlin.com/linux/v3.7/ident/nsown_capable>. Apologies to those bored to tears by this ...

1 0

Smart Contract: Computer Says No
by Lawrence D'Oliveiro 18 Jun '21

18 Jun '21

Another day, another tale of cryptocurrency failure <https://www.theregister.com/2021/06/17/iron_cryptocoin_titan/>. What’s different about this one is that it involved a “stablecoin”, which is some kind of attempt to reduce the volatility of a cryptocurrency by tying it in part to an actual currency. Note this linkage was only partial, and also involved a “smart contract”. This is a piece of autonomous code that, once let loose, makes its own decisions on what actions are and aren’t allowed. There is a suspicion that the smart contract involved had this line in it: require(_share_price > 0, "Invalid share price"); when it should have been require(_share_price >= 0, "Invalid share price"); and, depending on rounding errors, this could have caused all attempts at redemption to fail if the price fell too low to be distinguished from zero. And unlike regular legal contracts between carbon-based life forms, no court can overrule the operation of a smart contract†. Once it is put into effect, there is no reining it in. If the code is bug-free, you are fine (Do I hear sardonic laughter?). How many dozens of sci-fi stories and movies (both good and bad) have gone over this basic scenario? Do people learn nothing from pulp fiction!? But then again, the company did say "We already queued the fix for this, so people can redeem again at 5pm UTC." so maybe this wasn’t the issue at all. †Probably. None has yet tried.

1 0

Newly discovered Vigilante malware outs software pirates and blocks them
by Peter Reutemann 18 Jun '21

18 Jun '21

'A researcher has uncovered one of the more unusual finds in the annals of malware: booby-trapped files that rat out downloaders and try to prevent unauthorized downloading in the future. The files are available on sites frequented by software pirates. Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server, along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access thepiratebay.com and as many as 1,000 other pirate sites.' -- source: https://arstechnica.com/gadgets/2021/06/newly-discovered-vigilante-malware-… Didn't see that one coming... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Backs Linux Project To Make Android, Chrome OS Harder To Hack
by Peter Reutemann 18 Jun '21

18 Jun '21

'Google said Thursday it's funding a project to increase Linux security by writing parts of the operating system's core in the Rust programming language, a modernization effort that could bolster the security of the internet and smartphones. From a report: If the project succeeds, it'll be possible to add new elements written in Rust into the heart of Linux, called the kernel. Such a change would mark a major technological and cultural shift for an open-source software project that's become foundational to Google's Android and Chrome operating systems as well as vast swaths of the internet. Miguel Ojeda, who's written software used by the Large Hadron Collider particle accelerator and worked on programming language security, is being contracted to write software in Rust for the Linux kernel. Google is paying for the contract, which is being extended through the Internet Security Research Group, a nonprofit that's also made it easier to secure website communications through the Let's Encrypt effort. Adding Rust modules to the Linux kernel would improve security by closing some avenues for hackers can use to attack phones, computers or servers. Since it was launched in 1991, Linux has been written solely in the powerful but old C programming language. The language was developed in 1972 and is more vulnerable to hacks than contemporary programming languages.' -- source: https://linux.slashdot.org/story/21/06/17/185239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Report Finds Phone Network Encryption Was Deliberately Weakened
by Peter Reutemann 18 Jun '21

18 Jun '21

'A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to a new research paper. Motherboard: The paper has sent shockwaves through the encryption community because of what it implies: The researchers believe that the mathematical probability of the weakness being introduced on accident is extremely low. Thus, they speculate that a weakness was intentionally put into the algorithm. After the paper was published, the group that designed the algorithm confirmed this was the case. Researchers from several universities in Europe found that the encryption algorithm GEA-1, which was used in cellphones when the industry adopted GPRS standards in 2G networks, was intentionally designed to include a weakness that at least one cryptography expert sees as a backdoor. The researchers said they obtained two encryption algorithms, GEA-1 and GEA-2, which are proprietary and thus not public, "from a source." They then analyzed them and realized they were vulnerable to attacks that allowed for decryption of all traffic. When trying to reverse-engineer the algorithm, the researchers wrote that (to simplify), they tried to design a similar encryption algorithm using a random number generator often used in cryptography and never came close to creating an encryption scheme as weak as the one actually used: "In a million tries we never even got close to such a weak instance," they wrote. "This implies that the weakness in GEA-1 is unlikely to occur by chance, indicating that the security level of 40 bits is due to export regulations." Researchers dubbed the attack "divide-and-conquer," and said it was "rather straightforward." In short, the attack allows someone who can intercept cellphone data traffic to recover the key used to encrypt the data and then decrypt all traffic. The weakness in GEA-1, the oldest algorithm developed in 1998, is that it provides only 40-bit security. That's what allows an attacker to get the key and decrypt all traffic, according to the researchers.' -- source: https://it.slashdot.org/story/21/06/17/206213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS fans, rejoice—RAIDz expansion will be a thing very soon
by Peter Reutemann 16 Jun '21

16 Jun '21

'OpenZFS founding developer Matthew Ahrens opened a PR for one of the most sought-after features in ZFS history—RAIDz expansion—last week. The new feature allows a ZFS user to expand the size of a single RAIDz vdev. For example, you can use the new feature to turn a three-disk RAIDz1 into a four, five, or six RAIDz1.' -- source: https://arstechnica.com/gadgets/2021/06/raidz-expansion-code-lands-in-openz… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting June 28th
by Peter Reutemann 15 Jun '21

15 Jun '21

Hi everyone I'm still looking for a topic for the next WLUG meeting (June 28). After chatting with Lawrence and Ian last night, we were thinking of having a "git" (as in version control) theme: - git basics - Lawrence? - using github (forking, pull requests, etc) - github alternatives How does that sound? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

MySQL 101: Installation, care, and feeding on Ubuntu
by Peter Reutemann 14 Jun '21

14 Jun '21

'One of the tasks nearly any sysadmin frequently encounters is the care and feeding of the MySQL database server. You can build an entire career around nothing but this topic—making you a DB admin, not a humble sysadmin like yours truly—but for today, we're just going to cover the basics. For this guide, we're going to be using Ubuntu Linux as the underlying operating system—but most of these steps and tips will be either the same, or broadly similar, across nearly any OS or distribution you might install MySQL on.' -- source: https://arstechnica.com/gadgets/2021/06/mysql-101-installation-care-and-fee… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Announces Bold New Changes To Chrome OS Release Cycle
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post this morning, Google announced plans to increase its update cadence for Chromebooks. Like Chrome, its operating system will now also follow a four-week Stable channel before moving to the next major milestone release. Android Police reports: Google will deliver fresh features more rapidly to Chromebooks starting with Chrome OS 96 -- all while keeping it stable, secure, and speedy. To adapt to the rigorous update release schedule, Google will skip Chrome OS 95, which will help it bridge the gap between M94 and Chrome's new four-week rollout strategy. Enterprise and education folks can opt enroll in an Extended Stable option for Chromebooks, which will update every 6 months. In light of the new rollout strategy, Google updated its documentation and pushed an update to its release calendar. The company will share plans about the choices Chrome OS administrators will have for milestone updates "in the coming months." ' -- source: https://tech.slashdot.org/story/21/06/11/2012215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patch Released for 7-Year-Old Privilege Escalation Bug In Linux Service Polkit
by Peter Reutemann 14 Jun '21

14 Jun '21

'In a blog post on Thursday, GitHub security researcher Kevin Backhouse announced that Polkit, a Linux system service included in several modern Linux distros that provides an organized way for non-privileged processes to communicate with privileged ones, has been harbouring a major security bug for seven years. The bug, assigned (CVE-2021-3560) allows a non-privileged user to gain administrative shell access with a handful of standard command line tools. The bug was fixed on June 3, 2021 in a coordinated disclosure. "It's used by systemd," GitHub's blog post points out, "so any Linux distribution that uses systemd also uses polkit..." "It's very simple and quick to exploit, so it's important that you update your Linux installations as soon as possible. Any system that has polkit version 0.113 (or later) installed is vulnerable. That includes popular distributions such as RHEL 8 and Ubuntu 20.04."' -- source: https://linux.slashdot.org/story/21/06/12/174231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Tells Anti-Vaxxer To Shut Up On Linux Mailing List
by Peter Reutemann 14 Jun '21

14 Jun '21

'Linus Torvalds was "clearly unamused" by a "humanoid conspiracy theory, and also on its discussion in a Linux kernel topic thread," reports Neowin. They add that Torvalds "weighed in quite heavily with some very strong language, mixed with some biology lessons..." Here's an excerpt from Torvalds' response (as shared by Slashdot reader Hmmmmmm): Please keep your insane and technically incorrect anti-vax comments to yourself. You don't know what you are talking about, you don't know what mRNA is, and you're spreading idiotic lies. Maybe you do so unwittingly, because of bad education. Maybe you do so because you've talked to "experts" or watched youtube videos by charlatans that don't know what they are talking about. But dammit, regardless of where you have gotten your mis-information from, any Linux kernel discussion list isn't going to have your idiotic drivel pass uncontested from me. Vaccines have saved the lives of literally tens of millions of people. Just for your edification in case you are actually willing to be educated: mRNA doesn't change your genetic sequence in any way. It is the exact same intermediate - and temporary - kind of material that your cells generate internally all the time as part of your normal cell processes, and all that the mRNA vaccines do is to add a dose their own specialized sequence that then makes your normal cell machinery generate that spike protein so that your body learns how to recognize it. The half-life of mRNA is a few hours. Any injected mRNA will be all gone from your body in a day or two. It doesn't change anything long-term, except for that natural "your body now knows how to recognize and fight off a new foreign protein" (which then tends to fade over time too, but lasts a lot longer than a few days). And yes, while your body learns to fight off that foreign material, you may feel like shit for a while. That's normal, and it's your natural response to your cells spending resources on learning how to deal with the new threat. And of the vaccines, the mRNA ones are the most modern, and the most targeted - exactly because they do *not* need to have any of the other genetic material that you traditionally have in a vaccine (ie no need for basically the whole - if weakened - bacterial or virus genetic material). So the mRNA vaccines actually have *less* of that foreign material in them than traditional vaccines do. And a *lot* less than the very real and actual COVID-19 virus that is spreading in your neighborhood. Honestly, anybody who has told you differently, and who has told you that it changes your genetic material, is simply uneducated. You need to stop believing the anti-vax lies, and you need to start protecting your family and the people around you. Get vaccinated... Get vaccinated. Stop believing the anti-vax lies. And if you insist on believing in the crazy conspiracy theories, at least SHUT THE HELL UP about it on Linux kernel discussion lists. ' -- source: https://science.slashdot.org/story/21/06/12/2210219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Also Leaving Freenode: FSF, GNU, plus Linux and Python support channels
by Peter Reutemann 14 Jun '21

14 Jun '21

'Freenode's Linux support channel has an official web page at freenode.linux.community, which now bears this announcement: 22+ year old ##linux on freenode has been seized by freenode staff The community's (multi-platform) site reminds visitors of the alternative channels #linux on Libera and Linux.Chat on Discord. But they're not the only ones making changes. "[T]he FSF and GNU have decided to relocate our IRC channels to Libera.Chat," reads an official announcement on the FSF blog. "Effective immediately, Libera is the official home of our channels, which include but are not limited to all those in the #fsf, #gnu, and #libreplanet namespaces." As we have had nearly twenty years of positive experiences with the Freenode staff, most of whom now comprise the staff of the Libera network, we are confident in their technical and interpersonal expertise, as well as their ability to make the network as long-lasting and integral to the free software community as they made Freenode. We look forward to joining the large number of free software and free culture projects who have already made Libera.Chat their home, and hope to stay there for many years to come. Also making a move: freenode's #Python channel. Software developer Ned Batchelder, one of the channel's operators (and also an architect at edX), shared a recent experience in a new blog post this morning. When they'd decided to move #python to the new Libera.chat network (run by former Freenode staffers), they also stayed in Freenode's channel "to let people know where everyone had gone." Yesterday, after a heated debate in the Freenode channel where I was accused of splitting the community, I got k-lined (banned entirely from Freenode). The reason given was "spamming", because of my recurring message about the move to Libera. Then the entire Freenode #python channel was closed... Was it malice or was it mistake? Does it matter? It's not a good way to run a network. After the channel was closed, people asking staff about what happened were banned from asking. That wasn't a mistake... [T]he new staff seems to be using force to silence people asking questions. It's clear that transparency is not a strong value for them. Setting aside network drama, the big picture here is that the Freenode #python community isn't split: it's alive and well. It's just not on Freenode anymore, it's on Libera. Freenode was a good thing. But the domain name of the server was the least important part of it, just a piece of technical trivia. There's no reason to stick with Freenode just because it is called Freenode. As with any way of bringing people together, the important part is the people. If all of the people go someplace else, follow them there, and continue. See you on Libera.' -- source: https://tech.slashdot.org/story/21/06/13/184251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Vivaldi Browser Now Has Mail, Calendar, and An RSS Reader Built-In
by Peter Reutemann 10 Jun '21

10 Jun '21

'The Vivaldi 4.0 release is launching today, and includes a built-in email, calendar, and RSS reader. The Verge reports: The email client supports IMAP and POP accounts, so you can connect the vast majority of email services to it, and you can easily have messages open up in tabs rather than taking over the current window -- handy if you're the type who often needs to bounce between emails. The search is also, in my experience, very quick. The calendar and RSS reader also include most of the features I'd expect, along with a few really cool bonuses. For example, the RSS reader also supports YouTube channels, which could be handy for those who are worried about an algorithm deciding not to show a creator's videos. The other headline feature of this Vivaldi update is built-in translation. The browser will be able to translate entire webpages (automatically, if you want) in 50 languages as of today, but the company says it'll be expanding to support 109 languages soon. While the Mail tools are desktop only, the translation is also available on Vivaldi for Android. Vivaldi has also come up with a solution for those who don't want these features taking up room in their browser: you'll be able to choose between three layouts, which will give you a basic web browser, one with a few power-user features, or the all-in-one experience with email, calendars, and RSS. All the features will still be available, even in the "Essentials" layout, but they won't be taking up space in the interface. ' -- source: https://tech.slashdot.org/story/21/06/09/2153249 Netscape anyone? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux X86/x86_64 Will Now Always Reserve the First 1MB of RAM
by Peter Reutemann 10 Jun '21

10 Jun '21

'Phoronix reports: The Linux x86/x86_64 kernel code already had logic in place for reserving portions of the first 1MB of RAM to avoid the BIOS or kernel potentially clobbering that space among other reasons while now Linux 5.13 is doing away with that 'wankery' and will just unconditionally always reserve the first 1MB of RAM. The Linux kernel was already catering to Intel Sandy Bridge graphics accessing memory below the 1MB mark, the first 64K of memory are known to be corrupted by some BIOSes, and similar problems coming up in that low area of memory. But rather than dealing with all that logic and other possible niche cases besides the EGA/VGA frame-buffer and BIOS, the kernel is playing it safe and just always reserving the first 1MB of RAM so it will not get clobbered by the kernel.' -- source: https://linux.slashdot.org/story/21/06/09/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Space: (Not) The Final Frontier ...
by Lawrence D'Oliveiro 09 Jun '21

09 Jun '21

You may know that a cryptocurrency like Bitcoin gets its value from a concept known as “proof of work” -- namely that in order to “mine” (create new units of) the currency, you performed a computation with a commonly-accepted minimum complexity (with no known shortcuts). Now there is another kind of cryptocurrency, based on “proof of space”, where the (agreed) value comes from permanently setting aside some amount of storage space. Instead of consuming some increasing percentage of the world’s electricity (and GPU) supply, this one is going to consume some increasing percentage of the world’s hard drive supply. <https://www.theregister.com/2021/06/08/chia_cryptocurrency_creates_euro_hdd…>

1 0

KDE Plasma 5.22 Released
by Peter Reutemann 09 Jun '21

09 Jun '21

'KDE Plasma 5.22 is now available, bringing "hugely improved" Wayland support, better performance for gaming, adaptive panel transparency for the panel and widgets, and more. Phoronix reports: There is now support for variable rate refresh (VRR) / Adaptive-Sync on Wayland, vertical/horizontal maximization now working with KWin Wayland, global menu applet support under Wayland, support for activities, and a lot of other general improvements and fixes so the overall Wayland support is much more polished and nearly at par to the X.Org Server support. The performance for gaming with KDE Plasma on Wayland should also be better with now having direct scan-out support for full-screen windows. Rounding out the graphics fun with this release is also GPU hot-plugging support on Wayland for KWin, such as if using an external GPU or USB display adapter. KDE Plasma 5.22 also delivers on adaptive panel transparency for the panel and widgets, desktop notification improvements, Plasma System Monitor has replaced KSysGuard as the default system monitoring application, and a variety of other improvements. You can view the full changelog for Plasma 5.22 here.' -- source: https://tech.slashdot.org/story/21/06/08/1938202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESA’s Mars Express Orbiter Is 18 Years Old
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

<https://www.theregister.com/2021/06/02/mars_express/> In some industries, you really have to take the long view about your computing infrastructure: Wood recently shared a Twitter thread that began, much to the delight of retro-computing fans, with the recovery of data from two IDE drives from a long-dead PC and (spoiler alert) ended with the 25-year-old emulator for the Star Tracker software firing up on a 486-based machine running Windows for Workgroups 3.11 (after more modern Microsoft operating systems rejected it.) ... Alternatively, hardware on Earth could give up the ghost. The mission control systems for Mars Express originally ran on Solaris 8 machines (and some tools ran on Solaris 6.) A migration to Solaris 10 occurred in 2013 although, with a hat-tip to the Unix team working around failing ancient hardware, Wood observed: "We have Solaris 10, running a Solaris 8 zone and that zone is configured in Solaris 6 compatibility mode. (it really is turtles all the way down!)" Virtualization efforts have played their part in reducing the reliance on hard-to-obtain components. Should ESA keep the funding tap turned on and extend the mission past the end of 2022, an upgrade to Solaris 11 servers is also on the cards (a joint activity with other ESA missions XMM and Integral) that should last until the end of Mars Express.

2 2

Google Releases Dependency-Mapping Tool
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Report <https://www.theregister.com/2021/06/04/google_open_source_insights/> on a new service from Google where it examines millions of online source-code project repositories, and maps out their dependencies, letting you see information like licensing and security vulnerabilities. Because a vulnerability in a package you depend on could become a vulnerability in your code.

1 0

How Facebook Architects Around Silent Data Corruption
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Seems like Facebook’s computation facilities have become so massive that it is starting to see intermittent errors in places you wouldn’t expect <https://www.nextplatform.com/2021/03/01/facebook-architects-around-silent-d…>: Engineers found that many of the cascading errors are the result of CPUs in production but not always due to the “soft errors” of radiation or synthetic fault injection. Rather, they find these can happen randomly on CPUs in repeatable ways. Although ECC is useful, this is focused on problems in SRAM but other elements are susceptible. The Facebook engineering team that reported on these problems finds that CPU silent data corruptions are actually orders of magnitude higher than soft-errors due to a lack of error correction in other blocks. The article mentions examples like a computation of 2×3 sometimes returning an answer other than 6, or a file size intermittently (and incorrectly) being computed as zero, leading to the file data not being copied. Such occurrences may be extremely rare, but when you are doing things on the scale that Facebook does, they start to become all too common. Facebook has published a paper (linked in the report) on their research into the problem. They have worked out some techniques to try to mitigate these issues, but of course they come at a cost.

1 1

The Collective Code Construction Contract
by Lawrence D'Oliveiro 04 Jun '21

04 Jun '21

Came across this interesting document <https://rfc.zeromq.org/spec/42/> referenced from another project I was browsing. It is a set of guidelines for how Free Software projects should be managed. Some choice extracts: The project SHALL use the git distributed revision control system. The project SHALL use a share-alike license such as the MPLv2, or a GPLv3 variant thereof (GPL, LGPL, AGPL). All contributions to the project source code (“patches”) SHALL use the same license as the project. All patches are owned by their authors. There SHALL NOT be any copyright assignment process. Some specifics of how to use, and not to use, Git: The project SHALL have one branch (“master”) that always holds the latest in-progress version and SHOULD always build. The project SHALL NOT use topic branches for any reason. Personal forks MAY use topic branches. To make a stable release a Maintainer shall tag the repository. Stable releases SHALL always be released from the repository master. Actually that last one seems a bit questionable. For example, Blender does not structure its repos that way. Each stable release has its own branch, which may continue to accumulate bug fixes for as long as it is under support, while main development of the next version continues on the master branch. Plus there guidelines for handling people-management issues, of course: Administrators SHOULD block or ban “bad actors” who cause stress and pain to others in the project. This should be done after public discussion, with a chance for all parties to speak. A bad actor is someone who repeatedly ignores the rules and culture of the project, who is needlessly argumentative or hostile, or who is offensive, and who is unable to self-correct their behavior when asked to do so by others.

1 0

Google is Making it Harder for Android Apps To Track You Once You've Opted Out
by Peter Reutemann 04 Jun '21

04 Jun '21

'It's going to get harder for Android apps to track users who've opted out of receiving personalized ads, the Financial Times reports, after Google announced changes to how it'll handle the unique device identifiers that allow marketers to track them between apps. From a report: Starting later this year, Google is cutting off access to these "Advertising IDs" after a user opts out, and will show developers a "string of zeros" in its place. The news was announced in an email to Play Store developers, and Google has also updated its support page for Advertising IDs with the announcement. Google told developers the changes will "provide users with more control over their data, and help bolster security and privacy," the Financial Times reports. The change comes a few short months after Apple overhauled how advertising IDs work on iOS in an apparent attempt to compete with the new policy. ' -- source: https://yro.slashdot.org/story/21/06/03/140255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Package Manager Quality Issue
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

Microsoft has officially launched “Winget”, aka the Windows Package Manager <https://www.theregister.com/2021/06/02/microsoft_introduces_moderation_for_…>. Unfortunately, it’s run into a bit of a snag: anybody can submit packages to be included in the repo willy-nilly, leading to problems like duplicates, bad links and other misbehaviour. “What is wrong with this picture?” as they say: Look at any of the common Linux distros, and you will see that every package has an official maintainer who will take responsibility for its quality, handling of bug reports, updating from upstream and so on. Nobody can simply submit a package to be included and then forget about it. There is a proper QA system.

1 0

No More CLA For GCC
by Lawrence D'Oliveiro 03 Jun '21

03 Jun '21

The Free Software Foundation has long been one of those outfits that has refused to accept (significant) source contributions without the author signing a “Contributor Licence Agreement”. It’s not enough to release the code under the same licence as the project, you must also hand over the entire copyright to them. This is supposedly because they have received legal advice that it makes it easier to defend against copyright infringements if they own all the code. Quite a few other projects don’t agree <https://lwn.net/Articles/592503/>. For example, the Linux kernel project does not demand CLAs, only a “Certificate of Origin” (affirming that you have the right to contribute the code). And now the GNU Compiler Collection is joining them. <https://www.theregister.com/2021/06/02/gcc_fsf_code_copyright/>

2 2

Alibaba's Huge Browser Business Is Harvesting The 'Private' Web Activity Of Millions Of Android And iPhone Users
by Peter Reutemann 03 Jun '21

03 Jun '21

'Security researcher Gabi Cirlig's findings, verified for Forbes by two other independent researchers, reveal that on both Android and iOS versions of UC Browser, every website a user visits, regardless of whether they're in incognito mode or not, is sent to servers owned by UCWeb. From a report: Cirlig said IP addresses -- which could be used to get a user's rough location down to the town or neighborhood of the user -- were also being sent to Alibaba-controlled servers. Those servers were registered in China and carried the .cn Chinese domain name extension, but were hosted in the U.S. An ID number is also assigned to each user, meaning their activity across different websites could effectively be monitored by the Chinese company, though it's not currently clear just what Alibaba and its subsidiary are doing with the data. "This could easily fingerprint users and tie them back to their real personas," Cirlig wrote in a blog post handed to Forbes ahead of publication on Tuesday. Cirlig was able to uncover the problem by reverse engineering some encrypted data he spotted being sent back to Beijing. Once the key had been cracked, he was able to see that every time he visited a website, it was being encrypted and transmitted back to the Alibaba company. On Apple's iOS, he didn't even need to reverse engineer the encryption because there effectively was none on the device (though it was encrypted when in transit). "This kind of tracking is done on purpose without any regard for user privacy," Cirlig told Forbes. When compared to Google's own Chrome browser, for instance, it does not transfer user web browsing habits when in incognito. Cirlig said he'd looked at other major browsers and found none did the same as UC Browser. ' -- source: https://yro.slashdot.org/story/21/06/02/185213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome's Top Web App Advocate Resigns
by Peter Reutemann 03 Jun '21

03 Jun '21

'Google is losing one of its strongest champions of the web. Alex Russell, who has led the Fugu project to make web apps as powerful as those running on Google's Android or Apple's iOS software, is leaving the company on Wednesday. From a report: Russell announced his departure on Twitter. He's not quitting in anger or being pushed out. But after 12 years at Google pushing his vision for a more powerful web, "I need some time off," he said in an interview. Russell has been an outspoken advocate for the web, using Chrome's dominant position to help test and introduce new abilities that let programmers build interactive apps on the web, not just relatively static websites. Project Fugu embodies this effort, as does the broader progressive web app, or PWA, movement that lets you install and launch web apps more like those that run natively on smartphones and PCs.' -- source: https://tech.slashdot.org/story/21/06/02/1931236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huawei's HarmonyOS Arrives With iPad-Inspired Tablet UI, Apparent Android Base
by Peter Reutemann 03 Jun '21

03 Jun '21

'Two years into its ban from the US Government and, in turn, access to the Play Store on its Android-powered devices, Huawei is unveiling HarmonyOS. The platform is an alternative to Android that powers TVs, smartphones, tablets, and smartwatches. 9to5Google reports: Announced at an event today, Huawei is positioning HarmonyOS as an operating system that can handle just about everything, from the smartphone in your pocket to IoT devices such as "power sockets and lamps." The company says the goal of the platform is to have one set of code that can be used across virtually any device, saying that it is not aware of "any other operating system in the world" that can cover such a wide range of devices. Leaning into this ability, Huawei developed a "Control Panel," which gives users the ability to connect multiple devices together, with the example of using the "music widget" to throw audio playback to nearby speakers or TVs. A "Super Device" widget shows icons for other nearby devices and enables a quick and easy pairing mode. On smartphones, the HarmonyOS homescreen can use a swipe-up gesture on apps developed for the platform to see a widget pulling information from that app. Those widgets, apparently, can also be used across devices because of the shared codebase Huawei says HarmonyOS offers. The homescreen can also intelligently add apps to a folder based on the category. Interestingly, Huawei says HarmonyOS devices will also be able to move running apps from one device to another, which is really neat and unique. Moving apps between devices apparently also works between watches and TVs, with a workout app being used on both simultaneously given as an example. A video calling app was also shown moving between devices. Huawei says that performance of HarmonyOS is "superior" to Android with EMUI, specifically calling out long-term use. While there are certainly new elements in HarmonyOS, it appears to be a "fork" of Android. The Verge spent time with the HarmonyOS-powered MatePad Pro and described the act of installing Android APKs as "though I was using an Android device." Visually, there are also a tremendous number of similarities between HarmonyOS and Android, though there are some distinct elements of Apple's iPad OS in the platform's tablet-optimized homescreen, seen below as Evan Blass posted to Twitter. Android Authority further described HarmonyOS as "ultimately a spin on Android 10" with a "slight rebrand." TechRadar said the software was "clearly" based on Android. These findings from the media appear to back up a previous report from ArsTechnica, which showed the developer preview as basically a clone of EMUI-skinned Android. ' -- source: https://tech.slashdot.org/story/21/06/02/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

China Cracking Down On Cryptomining
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

This article <https://www.aljazeera.com/economy/2021/5/24/china-crackdown-forces-crypto-m…> reports on how many large cryptomining operators are moving out of China in the wake of the Government’s actions against them. But the main reason I’m posting this link is because of that picture. That’s what it looks like inside a cryptomining farm. Look at those power cables, like ships’ hawsers. It’s even more impressive at full resolution.

1 1

Multinational Meat Producer JBS Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

The world’s largest meat-producing company, Brazil-based JBS SA, has been hit by a ransomware attack that has forced the closure of its US installations <https://www.aljazeera.com/economy/2021/6/1/slaughterhouse-closures-spread-a…>. That means 20% of beef supply in the US has been cut. There are also reports of outages in its Australian and Canadian operations, so there is very likely more bad news to come. On the bright side, the company says its backup servers are fine, and it is in the process of restoring from them.

1 0

The State Of NZ Online Media
by Lawrence D'Oliveiro 02 Jun '21

02 Jun '21

Just saw this report <https://www.nzherald.co.nz/business/mediaworks-sale-revealed-how-much-disco…> that Discovery paid about $20 million for MediaWorks (TV channels Three, Bravo, Edge, Breeze and their “+1” repeaters, streaming service ThreeNow and Newshub). Contrast this against the $700-million valuation of MediaWorks back in 2007. There was an assumption it would be worth much less; “Much of this was ostensibly driven by the $1 sale of the Stuff news business”. Speaking of Stuff, seems Fairfax didn’t do well after acquiring it <https://www.nzherald.co.nz/business/stuff-the-laggard-among-fairfax-busines…>. I remember the head of the NZ Open-Source Society saying in a radio interview that it actually used to be a profitable business, but after the acquisition, Fairfax ripped out the open-source software it was built on and replaced it with some proprietary and expensive Adobe platform.

1 0

Quic Gives the Internet's Data Transmission Foundation a Needed Speedup
by Peter Reutemann 01 Jun '21

01 Jun '21

'One of the internet's foundations just got an upgrade. From a report: Quic, a protocol for transmitting data between computers, improves speed and security on the internet and can replace Transmission Control Protocol, or TCP, a standard that dates back to Ye Olde Internet of 1974. Last week, the Internet Engineering Task Force, which sets many standards for the global network, published Quic as a standard. Web browsers and online services have been testing the technology for years, but the IETF's imprimatur is a sign the standard is mature enough to embrace fully. It's extremely hard to improve the internet at the fundamental level of data transmission. Countless devices, programs and services are built to use the earlier infrastructure, which has lasted decades. Quic has been in public development for nearly eight years since Google first announced Quic in 2013 as an experimental addition to its Chrome browser. But upgrades to the internet's foundations are crucial to keep the world-spanning communication and commerce backbone humming. That's why engineers spend so much effort on titanic transitions like Quic, HTTPS for secure website communications, post-quantum cryptography to protect data from future quantum computers, and IPv6 for accommodating vastly more devices on the internet.' -- source: https://tech.slashdot.org/story/21/05/31/168221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Devices Will Soon Automatically Share Your Internet With Neighbors
by Peter Reutemann 01 Jun '21

01 Jun '21

'If you use Alexa, Echo, or any other Amazon device, you have just over a week to opt out of an experiment that leaves your personal privacy and security hanging in the balance. From a report: On June 8, the merchant, Web host, and entertainment behemoth will automatically enroll the devices in Amazon Sidewalk. The new wireless mesh service will share a small slice of your Internet bandwidth with nearby neighbors who don't have connectivity and help you to their bandwidth when you don't have a connection. By default, Amazon devices including Alexa, Echo, Ring, security cams, outdoor lights, motion sensors, and Tile trackers will enroll in the system. And since only a tiny fraction of people take the time to change default settings, that means millions of people will be co-opted into the program whether they know anything about it or not. The Amazon webpage linked above says Sidewalk "is currently only available in the US." [...] Amazon has published a white paper detailing the technical underpinnings and service terms that it says will protect the privacy and security of this bold undertaking. To be fair, the paper is fairly comprehensive, and so far no one has pointed out specific flaws that undermine the encryption or other safeguards being put in place. But there are enough theoretical risks to give users pause.' -- source: https://yro.slashdot.org/story/21/05/31/2024259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Remote Desktop with Linux: 5 Apps Which You Can Use
by Peter Reutemann 01 Jun '21

01 Jun '21

'With more people working from home than ever before, having the right remote desktop access software has become very important. Maybe you’re helping a family member or colleague with an IT issue, or perhaps you’re working from home. Accessing any system remotely is the need of the day. Generally, a remote desktop connection is defined as any software allowing you to remotely access a device from a geographical distance. In addition to desktop sharing, many tools can now conduct file transfers and offer highly secure remote access. The main purpose of this article is to help Linux users to find out the remote desktop app for usage with the Linux distro which they are using.' -- source: https://linuxiac.com/remote-desktop-with-linux/ NB: Not all are open-source software. But Apache Guacamole looks promising - anyone used it? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Quest For Faster Python
by Lawrence D'Oliveiro 31 May '21

31 May '21

This report <https://www.theregister.com/2021/05/06/the_quest_for_faster_python/> on Facebook’s new “Cinder” project for speeding up Python code also mentions some other existing alternatives for doing the same. Python is commonly considered slow, yet note this one interesting comparison that was done with JavaScript: In May 2020 AI specialists DLabs tested JavaScript versus Python performance for machine learning. For JavaScript Node 12.16.1 was used, and for Python 3.7.6. The results seem surprising: although JavaScript benefits from an excellent JIT in Node (which uses the V8 engine as used by Google Chrome), Python easily outperformed it. "The learnings from the tests I ran are stark. JavaScript couldn’t get close to Python’s tasks — across the board. JavaScript’s computational performance is still much better than Python’s. However, the maturity of the libraries — which often have underlying modules written in C — means that operations on large datasets can offer so much more than sheer computational power," said developer Krzysztof Miśtal. Which is what Guido van Rossum has long advised: write performance-critical parts as extension modules in C.

2 2

One Startup's Quest to Take on Chrome and Reinvent the Web Browser
by Peter Reutemann 31 May '21

31 May '21

'"The web browser is a crucial part of modern life, and yet it hasn't really been revised since the '90s," writes Protocol. "That may be about to change." The browser tab is an underrated thing. Most people think of them only when there are too many, when their computer once again buckles under Chrome's weight. Even the developers who build the tabs — the engineers and designers working on Chrome, Firefox, Brave and the rest — haven't done much to them. The internet has evolved in massive, earth-shaking ways over the last two decades, but tabs haven't really changed since they became a browser feature in the mid '90s. Josh Miller, however, has big plans for browser tabs. Miller is the CEO of a new startup called The Browser Company, and he wants to change the way people think about browsers altogether. He sees browsers as operating systems, and likes to wonder aloud what "iOS for the web" might look like. What if your browser could build you a personalized news feed because it knows the sites you go to? What if every web app felt like a native app, and the browser itself was just the app launcher? What if you could drag a file from one tab to another, and it just worked? What if the web browser was a shareable, synced, multiplayer experience? It would be nothing like the simple, passive windows to the web that browsers are now. Which is exactly the goal. The Browser Company (which everyone on the team just calls Browser) is one of a number of startups that are rethinking every part of the browser stack. Mighty has built a version of Chrome that runs on powerful server hardware and streams the browser itself over the web. Brave is building support for decentralized protocols like IPFS, and experimenting with using cryptocurrencies as a new business model for publishers. Synth is building a new bookmarks system that acts more like a web-wide inbox. Sidekick offers a vertical app launcher and makes tabs easier to organize. "A change is coming," said Mozilla CEO Mitchell Baker. "The question is just the time frame, and what's actually required to make it happen." They have lots of different ideas, but they share a belief that the browser can, and should, be more than it is. "We don't need a new web browser," Miller said. "We need a new successor to the web browser." While he was at the White House, Chief Digital Officer (and Miller's boss) Jason Goldman said something Miller couldn't forget. "Platforms have all the leverage," is how Miller remembers it. "And if you care about the future of the internet, or the way we use our computers, or want to improve any of the things that are broken about technology ... you can't really just build an application. Platforms, whether it's iOS or Windows or Android or Mac OS, that's where all the control is." ' -- source: https://tech.slashdot.org/story/21/05/30/2140208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Millions Can Now Run Linux GUI Apps in Windows 10
by Peter Reutemann 31 May '21

31 May '21

'"You can now use GUI app support on Windows Subsystem for Linux (WSL)," Microsoft announced this week, "so that all the tools and workflows of Linux run on your developer machine." Bleeping Computer has already tested it running Gnome's file manager Nautilus, the open-source application monitor/task manager Stacer, the backup software Timeshift, and even the game Hedgewars. Though it's currently available only to the millions who've registered for Windows 10 "Insider Preview" builds, it's already drawing positive reviews. "With the Windows Subsystem for Linux, developers no longer need to dual-boot a Windows and Linux system," argues the Windows Central site, "as you can now install all the Linux stuff a developer would need right on top of Windows instead." Finally formally announced at this week's annual Microsoft Build conference, the new functionality runs graphical Linux apps "seamlessly," according to Tech Radar, calling the feature "highly anticipated." Arguably, one of the biggest, and surely the most exciting update to the Windows 10 WSL, Microsoft has been working on WSLg for quite a while and in fact first demoed it at last year's conference, before releasing the preview in April... Microsoft recommends running WSLg after enabling support for virtual GPU (vGPU) for WSL, in order to take advantage of 3D acceleration within the Linux apps.... WSLg also supports audio and microphone devices, which means the graphical Linux apps will also be able to record and play audio. Keeping in line with its developer slant, Microsoft also announced that since WSLg can now help Linux apps leverage the graphics hardware on the Windows machine, the subsystem can be used to efficiently run Linux AI and ML workloads... If WSLg developers are to be believed, the update is expected to be generally available alongside the upcoming release of Windows. Bleeping Computer explains that WSLg launches a "companion system distro" with Wayland, X, and Pulse Audio servers, calling its bundling with Windows 10 "an exciting development as it blurs the lines between Linux and Windows 10, and fans get the benefits of both worlds."' -- source: https://linux.slashdot.org/story/21/05/29/1755229 My personal comment: What's the benefit of Win10? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Free Software Foundation's Executive Director Resigns
by Peter Reutemann 31 May '21

31 May '21

'John Sullivan became the Free Software Foundation's Executive Director back in 2003 (at the age of 26). But now after 18 years, "I've decided to resign my position..." he tweeted Friday, "effective at the end of a transition period." "We'll be sharing further details, including information about that transition, and a few more words, in the coming days." Meanwhile, the Free Software Foundation announced Thursday that it's seeking "a principled, compassionate, and capable leader" to be its new executive director, working remotely out of their Boston office with the Foundation's current staff and board of directors. "The executive director, working with the president, is the public face of the Foundation." The FSF faces many challenges as software becomes increasingly central in the exercise of all fundamental human freedoms, including speech, association, privacy, and movement, and as software owners seek to exploit their control over us to profit at the expense of those freedoms. The executive director has a vital role in enabling the FSF to continue meeting these challenges, starting from the strong base that has been built in the last thirty-five years. The Foundation has recently reached record-high membership numbers and was awarded a perfect score from Charity Navigator, as well as its eighth consecutive four-star rating. Efforts to improve the Foundation's governance are underway. The executive director is the FSF's chief employed officer. The position reports to the president/CEO and the board of directors, and is responsible for management of all other staff, all day-to-day operations, and oversight of the Boston physical office. The successful candidate will have the opportunity to hire for additional key positions in the management team. One interesting item on their list of job responsibilities: Mentor, inspire, coordinate, and manage all FSF staff, building a culture that upholds the FSF's ideological principles and includes accountability, empathy, efficiency, and excellence A blog post on the FSF site also notes that the last month saw 11 new GNU releases. "A number of GNU packages, as well as the GNU operating system as a whole, are looking for maintainers and other assistance: please see https://www.gnu.org/server/takeaction.html#unmaint if you'd like to help."' -- source: https://news.slashdot.org/story/21/05/29/0144223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Freenode Apologizes as Prominent Open Source Projects Switch to Libera Chat
by Peter Reutemann 31 May '21

31 May '21

'Ubuntu has announced that, with immediate effect Ubuntu's IRC channels are moving to libera.chat. The move follows a "hostile takeover" of Ubuntu's namespace by Freenode's new management that appears to be happening to many other distributions including Gentoo as well as other projects that have used Freenode [including channels associated with the programming languages Raku, Elixir, and Haskell]. For Ubuntu, and many other FOSS projects, Freenode has long been one of the major official forms of communication... With IRC channels often used for important system advice, and project communication, this becomes not just an inconvenience but even a security problem. For this reason Ubuntu's replacement network, libera.chat has a more clearly open organisational structure than Freenode had before being taken over. "All told, it appears something like 700 irc.freenode.net channels have been seized and re-permissioned," reports The Register, "supposedly because the channels mentioned Libera Chat in violation of Freenode's advertising policy." Wednesday Freenode owner Andrew Lee posted a blog post explaining that "in retrospect, we should have handled the action of closing down channels slightly differently..." "The intent of doing this was not an attempt of a hostile takeover nor hijack like many people are saying. Since certain projects were disrupting their users' ability to chat on freenode via mass kicks, force closures, spam, we decided to enact this policy in those places which were deemed in violation and could cause an issue later... "We believe we should have done this in a much more communicative way to circulate the right message and keep things transparent which of course did not happen. As we move forward I'd like to fully assure you that we will be working in complete commitment to restore projects, namespaces and channels that were closed on accident as a part of this event and we welcome them to use freenode as before as their very own homebase. "Lastly, there are no excuses for this, and I'm willing to admit that I was wrong with Tuesday's move and apologize for the inconvenience that may have caused."' -- source: https://developers.slashdot.org/story/21/05/29/0224246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0