- wlug - list.wlug.org.nz

AGM minutes
by Peter Reutemann 26 Jan '21

26 Jan '21

Hi everyone The minutes of last night's AGM are now available: http://wiki.wlug.org.nz/MeetingTopics.2021-01-25 Thanks everyone for attending and the lively discussions. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Back To School: Technology, Stationery Costs Can Leave Parents In Debt
by Lawrence D'Oliveiro 26 Jan '21

26 Jan '21

Time was, you just needed to make sure your child had exercise books for school. Now they have to have a Chromebook, or maybe an Apple Mac or Ipad if that’s what their school uses. <https://www.nzherald.co.nz/nz/back-to-school-technology-stationery-costs-ca…>

1 0

When Adobe Stopped Flash Content, It Also Stopped A Chinese Railroad
by Peter Reutemann 25 Jan '21

25 Jan '21

'Jalopnik shares a story for our times: Adobe's Flash, the web browser plug-in that powered so very many crappy games, confusing interfaces, and animated icons of the early web like Homestar Runner is now finally gone, after a long, slow, protracted death. For most of us, this just means that some goofy webgame you searched for out of misplaced nostalgia will no longer run. For a select few in China, though, the death of Flash meant being late to work, because the city of Dalian in northern China was running their railroad system on it. Yes, a railroad, run on Flash, the same thing used to run "free online casinos" and knockoff Breakout games in mortgage re-fi ads... Hell, YouTube used to run on Flash until 2015. It wasn't all stupid little web games but, that said, I can't for the life of me fathom why anyone would want to run a freaking railroad network on it, with physical, multi-ton moving railcars full of human beings on it. So, when Adobe finally killed Flash-based content from running, this Tuesday Dalian's railroad network found itself ground to a halt for 20 hours. The railroad's technicians did get everything back up and running, but the way they did this is fascinating, too. They didn't switch the rail management system to some other, more modern codebase or software installation; instead, they installed a pirated version of Flash that was still operational. The knockoff version seems to be known as "Ghost Version." This, along with installing an older version of the Flash player to work with the knockoff Flash server setup, "solved" the problem, and the railroad was back up and running.' -- source: https://tech.slashdot.org/story/21/01/24/189207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 88 Released, Removing Adobe Flash -- and FTP
by Peter Reutemann 24 Jan '21

24 Jan '21

'Google released Chrome 88 this week — and besides improving its dark mode support, they removed support for both Adobe Flash and FTP. PC World calls it "the end of two eras." The most noteworthy change in this update is what's not included. Chrome 88 lays Adobe Flash and the FTP protocol to rest. RIP circa-2000 Internet. Neither comes as a surprise, though it's poetic that they're being buried together. Adobe halted Flash Player downloads at the end of 2020, making good on a promise made years before, and began blocking Flash content altogether a couple weeks later. Removing Flash from Chrome 88 is just Google's way of flushing the toilet. On the other hand, FTP isn't dead, but it is now for Chrome users. The File Transport Protocol has helped users send files across the Internet for decades, but in an era of prolific cloud storage services and other sharing methods, its use has waned. Google started slowly disabling FTP support in Chrome 86, per ZDNet, and now you'll no longer be able to access FTP links in the browser. Look for standalone FTP software instead if you need it, such as FileZilla. That's not all. Mac users should be aware that Chrome 88 drops support for OS X 10.10 (OS X Yosemite). Yosemite released in 2014 and received its last update in 2017... But Google killing Flash and FTP might be the footnotes that hit old-school web users in the feels. Chrome 88 will also block non-encrypted downloads originating from an encrypted page, the article reports. And the Verge notes Chrome also offers less intrusive website permission requests (as an experimental feature enabled from chrome://flags/#permission-chip ), while Bleeping Computer describes Chrome 88's new experimental feature for searching through all your open tabs. And Chrome's blog points out some additional features under the hood: Chrome 88 will heavily throttle chained JavaScript timers for hidden pages in particular conditions. This will reduce CPU usage, which will also reduce battery usage. There are some edge cases where this will change behavior, but timers are often used where a different API would be more efficient, and more reliable.' -- source: https://slashdot.org/story/21/01/23/2018224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why AWS Is Forking Elasticsearch and Kibana
by Peter Reutemann 24 Jan '21

24 Jan '21

'Steven J. Vaughan-Nichols writes at ZDNet: When Elastic, makers of the open-source search and analytic engine Elasticsearch, went after Amazon Web Services (AWS) by changing its license from the open-source Apache 2.0-license ALv2) to the non-open-source friendly Server Side Public License, I predicted "we'd soon see AWS-sponsored Elasticsearch and Kibana forks." The next day, AWS tweeted it "will launch new forks of both Elasticsearch and Kibana based on the latest Apache 2.0 licensed codebases." Well, that didn't take long! In a blog post, AWS explained that since Elastic is no longer making its search and analytic engine Elasticsearch and its companion data visualization dashboard Kibana available as open source, AWS is taking action. "In order to ensure open source versions of both packages remain available and well supported, including in our own offerings, we are announcing today that AWS will step up to create and maintain an ALv2-licensed fork of open-source Elasticsearch and Kibana.... AWS brings years of experience working with these codebases, as well as making upstream code contributions to both Elasticsearch and Apache Lucene, the core search library that Elasticsearch is built on — with more than 230 Lucene contributions in 2020 alone... We're in this for the long haul, and will work in a way that fosters healthy and sustainable open source practices — including implementing shared project governance with a community of contributors..." Yet another company, Logz.io, a cloud-monitoring company, and some partners have announced that it will launch a "true" open source distribution for Elasticsearch and Kibana.' -- source: https://news.slashdot.org/story/21/01/23/0245229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brad Cox, Creator of Objective-C Programming Language, Dies At 76
by Peter Reutemann 24 Jan '21

24 Jan '21

'We have learned that Brad Cox, computer scientist known mostly for creating the Objective-C programming language with his business partner Tom Love, died on January 2, 2021 at his residence. He was 76. >From a Legacy.com post: Brad was born on May 2, 1944 in Fort Benning, Georgia, to the late Nancy Hinson Cox and Dewey McBride Cox of Lake City, South Carolina. Brad grew up on the family's dairy farm in South Carolina but found himself most interested in science. After graduating from Lake City High School, he received his Bachelor of Science Degree in Organic Chemistry and Mathematics from Furman University, and his Ph.D. from the Department of Mathematical Biology at the University of Chicago, and worked on an early form of neural networks. He soon found himself more interested in computers and got a job at International Telephone and Telegraph (ITT) and later joined Schlumbeger -- Doll Research Labs, and ultimately formed his own Connecticut startup, Productivity Products International (PPI) later named Stepstone. Among his first known software projects, he wrote a PDP-8 program for simulating clusters of neurons. He worked at the National Institutes of Health and Woods Hole Oceanographic Institute before moving into the software profession. Dr. Cox was an entrepreneur, having founded the Stepstone Company together with Tom Love for releasing the first Objective-C implementation. Stepstone hoped to sell "ICPaks" and Dr. Cox focused on building his ICPak libraries and hired a team to continue work on Objective-C, including Steve Naroff. The late Steve Jobs', NeXT, licensed the Objective-C language for it's new operating system, NEXTSTEP. NeXT eventually acquired Objective- C from Stepstone. Objective-C continued to be the primary programming language for writing software for Apple's OS X and iOS. ' -- source: https://developers.slashdot.org/story/21/01/23/0446216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

DDoSers are abusing Microsoft RDP to make attacks more powerful
by Peter Reutemann 24 Jan '21

24 Jan '21

'DDoS-for-hire services are abusing the Microsoft Remote Desktop Protocol to increase the firepower of distributed denial-of-service attacks that paralyze websites and other online services, a security firm said this week. Typically abbreviated as RDP, Remote Desktop Protocol is the underpinning for a Microsoft Windows feature that allows one device to log into another device over the Internet. RDP is mostly used by businesses to save employees the cost or hassle of having to be physically present when accessing a computer. As is typical with many authenticated systems, RDP responds to login requests with a much longer sequence of bits that establish a connection between the two parties. So-called booter/stresser services, which for a fee will bombard Internet addresses with enough data to take them offline, have recently embraced RDP as a means to amplify their attacks, security firm Netscout said. The amplification allows attackers with only modest resources to strengthen the size of the data they direct at targets. The technique works by bouncing a relatively small amount of data at the amplifying service, which in turn reflects a much larger amount of data at the final target. With an amplification factor of 85.9 to 1, 10 gigabytes-per-second of requests directed at an RDP server will deliver roughly 860Gbps to the target. “Observed attack sizes range from ~20 Gbps – ~750 Gbps,” Netscout researchers wrote. “As is routinely the case with newer DDoS attack vectors, it appears that after an initial period of employment by advanced attackers with access to bespoke DDoS attack infrastructure, RDP reflection/amplification has been weaponized and added to the arsenals of so-called booter/stresser DDoS-for-hire services, placing it within the reach of the general attacker population.”' -- source: https://arstechnica.com/information-technology/2021/01/ddosers-are-abusing-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How DNSpooq Attacks Could Poison DNS Cache Records
by Peter Reutemann 24 Jan '21

24 Jan '21

'Earlier this week security experts disclosed details on seven vulnerabilities impacting Dnsmasq, "a popular DNS software package that is commonly deployed in networking equipment, such as routers and access points," reports ZDNet. "The vulnerabilities tracked as DNSpooq, impact Dnsmasq, a DNS forwarding client for *NIX-based operating systems." Slashdot reader Joe2020 shared Help Net Security's quote from Shlomi Oberman, CEO and researcher at JSOF. "Some of the bigger users of Dnsmasq are Android/Google, Comcast, Cisco, Red Hat, Netgear, and Ubiquiti, but there are many more. All major Linux distributions offer Dnsmasq as a package, but some use it more than others, e.g., in OpenWRT it is used a lot, Red Hat use it as part of their virtualization platforms, Google uses it for Android hotspots (and maybe other things), while, for example Ubuntu just has it as an optional package." More from ZDNet: Dnsmasq is usually included inside the firmware of various networking devices to provide DNS forwarding capabilities by taking DNS requests made by local users, forwarding the request to an upstream DNS server, and then caching the results once they arrive, making the same results readily available for other clients without needing to make a new DNS query upstream. While their role seems banal and insignificant, they play a crucial role in accelerating internet speeds by avoiding recursive traffic... Today, the DNSpooq software has made its way in millions of devices sold worldwide [including] all sorts of networking gear like routers, access points, firewalls, and VPNs from companies like ZTE, Aruba, Redhat, Belden, Ubiquiti, D-Link, Huawei, Linksys, Zyxel, Juniper, Netgear, HPE, IBM, Siemens, Xiaomi, and others. The DNSpooq vulnerabilities, disclosed today by security experts from JSOF, are dangerous because they can be combined to poison DNS cache entries recorded by Dnsmasq servers. Poisoning DNS cache records is a big problem for network administrators because it allows attackers to redirect users to clones of legitimate websites... In total, seven DNSpooq vulnerabilities have been disclosed today. Four are buffer overflows in the Dnsmasq code that can lead to remote code execution scenarios, while the other three bugs allow DNS cache poisoning. On their own, the danger from each is limited, but researchers argue they can be combined to attack any device with older versions of the Dnsmasq software... The JSOF exec told ZDNet that his company has worked with both the Dnsmasq project author and multiple industry partners to make sure patches were made available to device vendors by Tuesday's public disclosure.' -- source: https://it.slashdot.org/story/21/01/23/0412253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet Shuts Down Loon Internet Balloon Company
by Peter Reutemann 23 Jan '21

23 Jan '21

'Google's parent firm, Alphabet, is done exploring the idea of using a fleet of balloons to beam high-speed internet in remote parts of the world. From a report: The firm said on Thursday evening that it was winding down Loon, a nine-year-old project and a two-and-a-half-year-old spin off firm, after failing to find a sustainable business model and partners for one of its most prominent moonshot projects. The demise of Loon, which assumed spotlight after the project helped restore cell services knocked out by a hurricane in Puerto Rico, comes a year after the Android-maker ended Google Station, its other major connectivity effort to bring internet to the next billion users.' -- source: https://tech.slashdot.org/story/21/01/22/1418212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Talks With TSMC, Samsung To Outsource Some Chip Production
by Peter Reutemann 22 Jan '21

22 Jan '21

'Intel has talked with TSMC and Samsung about the Asian companies making some of its best chips, but the Silicon Valley pioneer is still holding out hope for last-minute improvements in its own production capabilities. Bloomberg reports: After successive delays in its chip fabrication processes, Santa Clara, California-based Intel has yet to make a final decision less than two weeks ahead of a scheduled announcement of its plans, according to people familiar with the deliberations. Any components that Intel might source from Taiwan wouldn't come to market until 2023 at the earliest and would be based on established manufacturing processes already in use by other TSMC customers, said the people, asking not to be identified because the plans are private. Talks with Samsung, whose foundry capabilities trail TSMC's, are at a more preliminary stage, the people said. An Intel spokesperson referred to previous comments by Bob Swan, the company's chief executive officer. Swan has promised investors he'll set out his plans for outsourcing and get Intel's production technology back on track when the company reports earnings Jan. 21. [...] TSMC, the largest maker of semiconductors for other companies, is preparing to offer Intel chips manufactured using a 4-nanometer process, with initial testing using an older 5-nanometer process, according to the people. The company has said it will make test production of 4-nanometer chips available in the fourth quarter of 2021 and volume shipments the following year. The Taiwanese company expects to have a new facility in Baoshan operational by the end of this year, which can be converted to production for Intel if required, one of the people said. TSMC executives previously said the new Baoshan unit would house a research center with 8,000 engineers. While Intel has outsourced production of lower-end chips before, it has kept the manufacturing of its best semiconductors in-house, considering it a competitive strength. Its engineers have historically tailored their designs to the company's manufacturing processes, making a shift to outsourcing of flagship products unthinkable in the past. As the provider of 80% of personal computer and server processors globally, Intel produces hundreds of millions of chips each year. That scale dictates that any potential supplier must create new capacity to accommodate Intel.' -- source: https://hardware.slashdot.org/story/21/01/08/2215226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

“When Elephants Fight, The Grass Gets Trampled”
by Lawrence D'Oliveiro 22 Jan '21

22 Jan '21

When big news organizations tussle with big Web search engines and social media outfits over who is stealing revenue from whom, how do you decide who is right and who is wrong? The Aussie Government is trying to protect one lot of multinational companies from the encroachments of another lot; where does fair competition end and protectionism or exploitation begin? <https://www.nzherald.co.nz/business/google-threatens-to-ban-search-button-i…> (By the way, in that old African proverb, the “grass” is the ordinary people who are the inevitable victims in any conflict between major powers.)

1 0

Ubuntu Now Runs On Apple Silicon, Devs Say It's 'Completely Usable'
by Peter Reutemann 22 Jan '21

22 Jan '21

'Developers at ARM virtualisation company Corellium have managed to get Ubuntu 20.04 up and running on the new Apple Silicon Mac Mini. And we're not talking 'it boots and prints a load of text' running here. No, this is the full Ubuntu desktop experience -- and it's already being described as "completely usable!" Pretty impressive, right? Even Linus Torvalds wasn't convinced that Linux M1 support was likely to appear anytime soon. He told ZDnet's Steven J. Vaughan-Nichols that: "...the main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Not that he was entirely wrong, mind. GPU support is indeed a current sticking point in Correllium's Linux for M1 effort. It doesn't (yet) include M1 GPU support meaning 'graphics' handling is done via software rendering.' -- source: https://news.slashdot.org/story/21/01/21/1329258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA Urges System Administrators To Replace Obsolete TLS Protocols
by Peter Reutemann 22 Jan '21

22 Jan '21

'The US National Security Agency has issued a security advisory this month urging system administrators in federal agencies and beyond to stop using old and obsolete TLS protocols. From a report: "NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used," the agency said. "Using obsolete encryption provides a false sense of security because it seems as though sensitive data is protected, even though it really is not," the agency added. Even if TLS 1.2 and TLS 1.3 are deployed, the NSA warns against configuring these two protocols with weak cryptographic parameters and cipher suites.' -- source: https://tech.slashdot.org/story/21/01/21/1646211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leave.EU Stays In The EU
by Lawrence D'Oliveiro 21 Jan '21

21 Jan '21

The domain that was registered by Brexiteers to promote their campaign for the UK to leave the EU has been re-domiciled to an address in the EU <https://www.theregister.com/2021/01/08/leave_eu_domain_name_hilarity/>. This is because of rule changes that mean UK-based entities are no longer entitled to register .eu names. So if the site wants to stay up under that name, it cannot, contrary to its own name, leave the EU. Just to add to the fun, the individual in the Republic of Ireland who is named on the domain registration claims to know nothing about it, and says he “will be looking into the matter”.

3 3

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Wine 6.0 Released
by Peter Reutemann 20 Jan '21

20 Jan '21

'Wine 6.0 has been released today and contains over 8,300 changes, according to its full release notes. Windows Central reports: The new release of version 6.0 has thousands of changes, but Wine's website highlights some of the biggest improvements: Core modules in PE format; Vulkan backend for WineD3D; DirectShow and Media Foundation support; and Text console redesign. The full release notes for Wine 6.0 explain that the core DLLs, which include NTDLL, KERNEL32, GDI32, and USER32 are now built in the Portable Executable (PE) format. As a result, people should see improvements for certain copy protection schemes. The update also includes a new mechanism to associate a Unix library with the PE module. This change makes it so systems can call Unix libraries from PE when trying to perform a function that can't be handled by Win32 APIs. Wine 6.0 also includes an experimental Vulkan rendered that translates Direct3D shaders to SPIR-V shaders. In another change related to Direct3D, the Direct3D graphics card database now recognizes more graphics cards and includes updated driver versions. ' -- source: https://tech.slashdot.org/story/21/01/19/039257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Becomes First Browser To Add Native Support For the IPFS Protocol
by Peter Reutemann 20 Jan '21

20 Jan '21

'With the release of Brave 1.19 today, Brave has become the first major browser maker to support IPFS, a peer-to-peer protocol meant for accessing decentralized or censored content. From a report: Released in 2015, IPFS stands for InterPlanetary File System. It is a classic peer-to-peer protocol similar to BitTorrent and designed to work as a decentralized storage system. IPFS allows users to host content distributed across hundreds or thousands of systems, which can be public IPFS gateways or private IPFS nodes. Users who want to access any of this content must enter an URL in the form of ipfs://{content_hash_ID}. Under normal circumstances, users would download this content from the nearest nodes or gateways rather than a central server. However, this only works if users have installed an IPFS desktop app or a browser extension. Brave says that with version 1.19, users will be able to access URLs that start with ipfs://, directly from the browser, with no extension needed, and that Brave will natively support ipfs:// links going forward. Since some major websites like Wikipedia have IPFS versions, users in oppressive countries can now use Brave's new IPFS support to go around national firewalls and access content that might be blocked inside their country for political reasons and is available via IPFS.' -- source: https://it.slashdot.org/story/21/01/19/2015252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye Releases Tool For Auditing Networks for Techniques Used by SolarWinds Hackers
by Peter Reutemann 20 Jan '21

20 Jan '21

'Cybersecurity firm FireEye has released today a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached. From a report: Together with the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks. Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike. The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.' -- source: https://tech.slashdot.org/story/21/01/19/2023209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The NSA warns enterprises to beware of third-party DNS resolvers
by Peter Reutemann 19 Jan '21

19 Jan '21

'DNS over HTTPS is a new protocol that protects domain-lookup traffic from eavesdropping and manipulation by malicious parties. Rather than an end-user device communicating with a DNS server over a plaintext channel—as DNS has done for more than three decades—DoH, as DNS over HTTPS is known, encrypts requests and responses using the same encryption websites rely on to send and receive HTTPS traffic. Using DoH or a similar protocol known as DoT—short for DNS over TLS—is a no brainer in 2021, since DNS traffic can be every bit as sensitive as any other data sent over the Internet. On Thursday, however, the National Security Agency said in some cases Fortune 500 companies, large government agencies, and other enterprise users are better off not using it. The reason: the same encryption that thwarts malicious third parties can hamper engineers’ efforts to secure their networks. “DoH provides the benefit of encrypted DNS transactions, but it can also bring issues to enterprises, including a false sense of security, bypassing of DNS monitoring and protections, concerns for internal network configurations and information, and exploitation of upstream DNS traffic,” NSA officials wrote in published recommendations. “In some cases, individual client applications may enable DoH using external resolvers, causing some of these issues automatically.”' -- source: https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocat Author Gets Insanely Fast Backing To Build P2P Tech For Social Media
by Peter Reutemann 19 Jan '21

19 Jan '21

'TechCrunch: The idea for Capsule started with a tweet about reinventing social media. A day later cryptography researcher, Nadim Kobeissi -- best known for authoring the open-source E2E-encrypted desktop chat app Cryptocat (now discontinued) -- had pulled in a pre-seed investment of $100,000 for his lightweight mesh-networked microservices concept, with support coming from angel investor and former Coinbase CTO Balaji Srinivasan, William J. Pulte and Wamda Capital. The nascent startup has a post-money valuation on paper of $10 million, according to Kobeissi, who is working on the prototype -- hoping to launch an MVP of Capsule in March (as a web app), after which he intends to raise a seed round (targeting $1 million-$1.5 million) to build out a team and start developing mobile apps. For now there's nothing to see beyond Capsule's landing page and a pitch deck (which he shared with TechCrunch for review). But Kobeissi says he was startled by the level of interest in the concept. "I posted that tweet and the expectation that I had was that basically 60 people max would retweet it and then maybe I'll set up a Kickstarter," he tells us. Instead the tweet "just completely exploded" and he found himself raising $100,000 "in a single day" -- with $50,000 paid in there and then. "I'm not a startup guy. I've been running a business based on consulting and based on academic R&D services," he continues. "But by the end of the day -- last Sunday, eight days ago -- I was running a Delaware corporation valued at $10 million with $100,000 in pre-seed funding, which is insane. Completely insane."' -- source: https://news.slashdot.org/story/21/01/18/2144252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenWRT Forum User Data Stolen In Weekend Data Breach
by Peter Reutemann 19 Jan '21

19 Jan '21

'The OpenWRT forum, a large community of enthusiasts of alternative, open-source operating systems for routers, announced a data breach over the weekend. Bleeping Computer reports: The attack occurred on Saturday, around 04:00 (GMT), when an unauthorized third party gained admin access to and copied a list with details about forum users and related statistical information. The intruder used the account of an OpenWRT administrator. Although the account had "a good password," additional security provided by two-factor authentication (2FA) was not active. Email addresses and handles of the forum users have been stolen, the moderators say. They add that they believe the attacker was not able to download the forum database, meaning that passwords should be safe. However, they reset all the passwords on the forum just to be on the safe side and invalidated all the API keys used for project development processes. Users have to set the new password manually from the login menu by providing their user name and following the "get a new password" instructions. Those logging in using GitHub credentials are advised to reset or refresh it. The OpenWRT forum credentials are separate from the Wiki. Currently, there is no suspicion that the Wiki credentials have been compromised in any way. OpenWRT forum administrators warn that since this breach exposed email addresses, users may become targets of credible phishing attempts. ' -- source: https://it.slashdot.org/story/21/01/18/2148210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Surpasses 100 Million Daily Search Queries For the First Time
by Peter Reutemann 19 Jan '21

19 Jan '21

'Privacy-focused search engine DuckDuckGo reached a major milestone in its 12-year-old history last week when it recorded on Monday its first-ever day with more than 100 million user search queries. From a report: The achievement comes after a period of sustained growth the company has been seeing for the past two years, and especially since August 2020, when the search engine began seeing more than 2 billion search queries a month on a regular basis. The numbers are small in comparison to Google's 5 billion daily search queries but it's a positive sign that users are looking for alternatives. DuckDuckGo's popularity comes after the search engine has expanded beyond its own site and now currently offers mobile apps for Android and iOS, but also a dedicated Chrome extension. More than 4 million users installed these apps and extension, the company said in a tweet in September 2020.' -- source: https://tech.slashdot.org/story/21/01/18/1450258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next week
by Peter Reutemann 18 Jan '21

18 Jan '21

Hi everyone Just a reminder that our AGM is coming up next week: https://www.meetup.com/WaikatoLinuxUsersGroup/events/274861121/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Tim Berners-Lee Will Fix the Internet
by Peter Reutemann 18 Jan '21

18 Jan '21

'"Sir Tim Berners-Lee, the British computer scientist who was knighted for inventing the internet navigation system known as the World Wide Web, wants to re-make cyberspace once again," reports Reuters: With a new startup called Inrupt, Berners-Lee aims to fix some of the problems that have handicapped the so-called open web in an age of huge, closed platforms such as Facebook. Building on ideas developed by an open-source software project called Solid, Inrupt promises a web where people can use a single sign-on for any service and personal data is stored in "pods," or personal online data stores, controlled by the user. "People are fed up with the lack of controls, the silos," said Berners-Lee, co-founder and chief technology officer of Inrupt, in an interview at the Reuters Next conference... John Bruce, a veteran technology executive who is CEO of Inrupt, said the company had signed up Britain's National Health Service, the BBC and the government of Flanders in Belgium as pilot customers, and hoped to announce many more by April... A key aim for Inrupt is to get software developers to write programs for the platform. Inrupt, like the original web, is at its core mostly a set of protocols for how machines talk to one another, meaning that specific applications bring it to life. "The use cases are so broad, it's like a do-over for the web," Berners-Lee said. In a video interview, Berners-Lee tells Reuters that what people are worried about isn't privacy per se but "the lack of empowerment" — for example, to collaborate with people. And then he acknowledges that the worldwide web does suffer from limited access control. "I wanted it to be a collaborative space, but in a way that was naive, because collaborative spaces you need to be private. You need to start off with just a limited sharing, and then you allow the sharing to increase." Social networks provided some features like a unique login and identity. But unfortunately, then "The large social networks will tend to get larger" — and ultimately without a single global signon, users then become trapped in separate silos.' -- source: https://tech.slashdot.org/story/21/01/16/2336244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Jamie Zawinski Calls Cinnamon Screensaver Lock-Bypass Bug 'Unconscionable'
by Peter Reutemann 18 Jan '21

18 Jan '21

'Legendary programmer Jamie Zawinski has worked on everything from the earliest releases of the Netscape Navigator browser to XEmacs, Mozilla, and, of course, the XScreenSaver project. Now Slashdot reader e432776 writes: JWZ continues to track issues with screensavers on Linux (since 2004!), and discusses a new bug in cinnamon-screensaver. Long-standing topics like X11, developer interaction, and code licensing all feature. Solutions to these long-standing issues remain elusive. Jamie titled his blog post "I told you so, 2021 edition": You will recall that in 2004 , which is now seventeen years ago, I wrote a document explaining why I made the design trade-offs that I did in XScreenSaver, and in that document I predicted this exact bug as my example of, "this is what will happen if you don't do it this way." And they went and made that happen. Repeatedly. Every time this bug is re-introduced, someone pipes up and says something like, "So what, it was a bug, they've fixed it." That's really missing the point. The point is not that such a bug existed, but that such a bug was even possible. The real bug here is that the design of the system even permits this class of bug. It is unconscionable that someone designing a critical piece of security infrastructure would design the system in such a way that it does not fail safe . Especially when I have given them nearly 30 years of prior art demonstrating how to do it right, and a two-decades-old document clearly explaining What Not To Do that coincidentally used this very bug as its illustrative strawman! These bugs are a shameful embarrassment of design -- as opposed to merely bad code... ZDNet reports that Linux Mint has issued a patch for Cinnamon that fixes the screensaver bug. But HotHardware notes that it was discovered when "one Dad let the kids play with the keyboard. This button-mashing actually crashed the machine's screensaver by sheer luck, allowing them onto the desktop, ultimately leading to the discovery of a high priority security vulnerability for the Linux Mint team." But that's not the only thing bothering Jamie Zawinski: Just to add insult to injury, it has recently come to my attention that not only are Gnome-screensaver, Mint-screensaver and Cinnamon-screensaver buggy and insecure dumpster fires, but they are also in violation of my license and infringing my copyright. XScreenSaver was released under the BSD license, one of the oldest and most permissive of the free software licenses. It turns out, the Gnome-screensaver authors copied large parts of XScreenSaver into their program, removed the BSD license and slapped a GPL license on my code instead -- and also removed my name. Rude... Mint-screensaver and Cinnamon-screensaver, being forks and descendants of Gnome-screensaver, have inherited this license violation and continue to perpetuate it. Every Linux distro is shipping this copyright- and license-infringing code. I eagerly await hearing how they're going to make this right.' -- source: https://tech.slashdot.org/story/21/01/17/0024243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Interview With Jon “maddog” Hall
by Lawrence D'Oliveiro 17 Jan '21

17 Jan '21

Been watching this nearly-hour-long conversation <https://www.youtube.com/watch?v=EZMA3Ge144U> with Jon “maddog” Hall, who if you don’t know him, was very likely the inspiration for the famous Dilbert cartoon featuring the Unix-using neckbeard telling the corporate jobsworth to “get a better computer” <https://dilbert.com/strip/1995-06-24>. Seems that there were several round-number anniversaries related to Unix coming due in 2019 (the year after the video was made), including the 50th anniversary of its creation at Bell Labs. After an early career on IBM mainframe equipment, maddog got a job as a sysadmin at Bell Labs, where he was introduced to Unix. Then he did various different jobs over many years at DEC. At about the half-hour mark, he talks about how he met Linus Torvalds, and asked the latter about porting his still-only-32-bit x86-only fledgling Linux kernel onto the 64-bit Alpha architecture. Linus wanted to do this, but he couldn’t get an Alpha machine from the Helsinki DEC office. So maddog went to bat, pulled a few strings, and got one for him. And it took just 9 months to take Linux from being x86-only and 32-bit-only to being cross-platform and 64-bit-native.

1 0

Windows 10 Bug Corrupts Your Hard Drive On Seeing This File's Icon
by Peter Reutemann 15 Jan '21

15 Jan '21

'An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command. Bleeping Computer reports: In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. [...] It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. One striking finding shared by Jonas with us was that a crafted Windows shortcut file (.url) that had its icon location set to C:\:$i30:$bitmap would trigger the vulnerability even if the user never opened the file! As observed by BleepingComputer, as soon as this shortcut file is downloaded on a Windows 10 PC, and the user views the folder it is present in, Windows Explorer will attempt to display the file's icon. To do this, Windows Explorer would attempt to access the crafted icon path inside the file in the background, thereby corrupting the NTFS hard drive in the process. Next, "restart to repair hard drive" notifications start popping up on the Windows PC -- all this without the user even having opened or double-clicked on the shortcut file. ' -- source: https://hardware.slashdot.org/story/21/01/14/232238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BeagleV is a $150 RISC-V Computer Designed To Run Linux
by Peter Reutemann 15 Jan '21

15 Jan '21

'Seeed Studios -- the makers of the Odyssey mini-PC -- have teamed up with well-known SBC vendor BeagleBoard to produce an affordable RISC-V system designed to run Linux. The new BeagleV (pronounced "Beagle Five") system features a dual-core, 1GHz RISC-V CPU made by StarFive -- one of a network of RISC-V startups created by better-known RISC-V vendor SiFive. The CPU is based on two of SiFive's U74 Standard Cores -- and unlike simpler microcontroller-only designs, it features a MMU and all the other trimmings necessary to run full-fledged modern operating systems such as Linux distributions. StarFive's VIC7100 processor design is aimed at edge AI tasks as well as general-purpose computing. In addition to the two RISC-V CPU cores, it features a Tensilica Vision VP6 DSP for machine-vision applications, a Neural Network Engine, and a single-core NVDLA (Nvidia Deep Learning Accelerator) engine.' -- source: https://hardware.slashdot.org/story/21/01/13/1928249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Google Reveals Sophisticated Windows and Android Hacking Operation
by Peter Reutemann 15 Jan '21

15 Jan '21

'Google published a six-part report this week detailing a sophisticated hacking operation that the company detected in early 2020 and which targeted owners of both Android and Windows devices. >From a report: The attacks were carried out via two exploit servers delivering different exploit chains via watering hole attacks, Google said. "One server targeted Windows users, the other targeted Android," Project Zero, one of Google's security teams, said in the first of six blog posts. Google said that both exploit servers used Google Chrome vulnerabilities to gain an initial foothold on victim devices. Once an initial entry point was established in the user's browsers, attackers deployed an OS-level exploit to gain more control of the victim's devices. The exploit chains included a combination of both zero-day and n-day vulnerabilities, where zero-day refers to bugs unknown to the software makers, and n-day refers to bugs that have been patched but are still being exploited in the wild.' -- source: https://tech.slashdot.org/story/21/01/14/1610220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10X for Single Screens Leaks
by Peter Reutemann 15 Jan '21

15 Jan '21

'Just ahead of its launch for commercial PC-like devices, an install image of Windows 10X for single screens has leaked, giving us an early peek at Microsoft's new OS. And yes, it's just like Chrome OS. From a report: Let's just get that out of the way. Microsoft has been working for years on a Chromebook competitor, but it has been largely unsuccessful. Windows 10 S, which was originally called Windows 10 Cloud, was Terry Myerson's approach, and that, of course, crashed and burned, in part because it looked identical to Windows 10 but couldn't run downloaded Windows 10 desktop applications. And now we have Windows 10X. Microsoft tried to hide its true intent with this product by pretending last year that it was aimed at a new generation of dual-display PCs, but the software giant really created 10X to compete with Chrome OS on inexpensive single-display PCs. So after failing to get its container-based Windows desktop application compatibility solution to work, Microsoft scaled back and repositioned Windows 10X as was originally intended: It will now ship only on new traditional PCs aimed at education and other commercial markets.' -- source: https://tech.slashdot.org/story/21/01/14/1657218 Wouldn't be surprised if they got bitten again by not having separate kernel/window manager architecture in Windows... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Foundation Now Offers a Suite of Open-Source Management Classes
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Linux Foundation has new courses to help you manage open-source projects and technical staff within your organization. Steven J. Vaughan-Nichols writes via ZDNet: Previously, if you want to know how to run open-source well in your company, you had to work with OASIS Open or the TODO Group. Both are non-profit organizations supporting best open source and open standards practices. But, to work with either group, effectively, you already had to know a lot about open source. [...] This 7-module course series is designed to help executives, managers, software developers, and engineers understand the basic concepts for building effective open-source practices. It's also helpful to those in the C suite who want to set up effective open-source program management, including how to create an Open Source Program Office (OSPO). The program builds on the accumulated wisdom of many previous training modules on open-source best practices while adding fresh and updated content to explain all of the critical elements of working effectively with open source in enterprises. The courses are designed to be self-paced, and reasonably high-level, but with enough detail to get new open-source practitioners up and running quickly. Guy Martin, OASIS Open's executive director, developed these courses. Martin knows his way around open source. He has a unique blend of over 25 years' experience both as a software engineer and open-source strategist. Marin has helped build open-source programs at Red Hat, Samsung, and Autodesk. He was also instrumental in founding the Academy Software Foundation, the Open Connectivity Foundation, and has contributed to TODO Group's best practices and learning guides. The "Open Source Management & Strategy program" costs $499 and is available to begin immediately. A certificate is awarded upon completion.' -- source: https://news.slashdot.org/story/21/01/13/2023236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian Discusses Vendoring -- Again
by Peter Reutemann 14 Jan '21

14 Jan '21

'Jake Edge, writing at LWN: The problems with "vendoring" in packages -- bundling dependencies rather than getting them from other packages -- seems to crop up frequently these days. We looked at Debian's concerns about packaging Kubernetes and its myriad of Go dependencies back in October. A more recent discussion in that distribution's community looks at another famously dependency-heavy ecosystem: JavaScript libraries from the npm repository. Even C-based ecosystems are not immune to the problem, as we saw with iproute2 and libbpf back in November; the discussion of vendoring seems likely to recur over the coming years. Many application projects, particularly those written in languages like JavaScript, PHP, and Go, tend to have a rather large pile of dependencies. These projects typically simply download specific versions of the needed dependencies at build time. This works well for fast-moving projects using collections of fast-moving libraries and frameworks, but it works rather less well for traditional Linux distributions. So distribution projects have been trying to figure out how best to incorporate these types of applications. This time around, Raphael Hertzog raised the issue with regard to the Greenbone Security Assistant (gsa), which provides a web front-end to the OpenVAS vulnerability scanner (which is now known as Greenbone Vulnerability Management or gvm). "the version currently in Debian no longer works with the latest gvm so we have to update it to the latest upstream release... but the latest upstream release has significant changes, in particular it now relies on yarn or npm from the node ecosystem to download all the node modules that it needs (and there are many of them, and there's no way that we will package them individually). The Debian policy forbids download during the build so we can't run the upstream build system as is." Hertzog suggested three possible solutions: collecting all of the dependencies into the Debian source package (though there would be problems creating the copyright file), moving the package to the contrib repository and adding a post-install step to download the dependencies, or removing gsa from Debian entirely. He is working on updating gsa as part of his work on Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has, so the Kali gsa package can simply use the upstream build process. He would prefer to keep gsa in Debian, "but there's only so much busy-work that I'm willing to do to achieve this goal". He wondered if it made more sense for Debian to consider relaxing its requirements. But Jonas Smedegaard offered another possible approach: analyzing what packages are needed by gsa and then either using existing Debian packages for those dependencies or creating new ones for those that are not available. Hertzog was convinced that wouldn't be done, but Smedegaard said that the JavaScript team is already working on that process for multiple projects.' -- source: https://linux.slashdot.org/story/21/01/13/1744228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WhatsApp Clarifies It's Not Giving All Your Data To Facebook
by Peter Reutemann 14 Jan '21

14 Jan '21

'The Verge: WhatsApp has published a new FAQ page to its website outlining its stances on user privacy in response to widespread backlash over an upcoming privacy policy update. The core issue relates to WhatsApp's data-sharing procedures with Facebook, with many users concerned an updated privacy policy going into effect on February 8th will mandate sharing of sensitive profile information with WhatsApp's parent company. That isn't true -- the update has nothing to do with consumer chats or profile data, and instead the change is designed to outline how businesses who use WhatsApp for customer service may store logs of its chats on Facebook servers. That's something the company feels it is required to disclose in its privacy policy, which it's now doing after previewing the upcoming changes to business chats back in October. But a wave of misinformation on social media, not helped by Facebook's abysmal track record on privacy and its reputation for obfuscating changes to its various terms of service agreements, has resulted in a full-blown WhatsApp backlash that has users fleeing to competitors like Signal and Telegram. [...] WhatsApp executives, as well as Instagram chief Adam Mosseri and Facebook AR / VR head Andrew "Boz" Bosworth, are now trying to set the record straight, perhaps to little avail at this point. "We want to be clear that the policy update does not affect the privacy of your messages with friends or family in any way. Instead, this update includes changes related to messaging a business on WhatsApp, which is optional, and provides further transparency about how we collect and use data," the company writes on the new FAQ page. It also stresses in the FAQ that neither Facebook nor WhatsApp read users' message logs or listen to their calls, and that WhatsApp doesn't store user location data or share contact information with Facebook. (It's also worth noting that data sharing with Facebook is extremely limited for European users due to stronger user privacy protections in the EU.) WhatsApp chief Will Cathcart also took to Twitter a few days ago to post a thread (later shared by Bosworth in the tweet above) trying to cut through the confusion and explain what's actually going on. "With end-to-end encryption, we cannot see your private chats or calls and neither can Facebook. We're committed to this technology and committed to defending it globally," Cathcart wrote. "It's important for us to be clear this update describes business communication and does not change WhatsApp's data sharing practices with Facebook. It does not impact how people communicate privately with friends or family wherever they are in the world." ' -- source: https://it.slashdot.org/story/21/01/13/065219 In the meantime, people are moving to Telegram and Signal... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers steal Mimecast certificate used to encrypt customers’ M365 traffic
by Peter Reutemann 13 Jan '21

13 Jan '21

'Email management provider Mimecast said that hackers have compromised a digital certificate it issued and used it to target select customers who use it to encrypt data they sent and received through the company’s cloud-based service. In a post published on Tuesday, the company said that the certificate was used by about 10 percent of its customer base, which—according to the company—numbers about 36,100. The “sophisticated threat actor” then likely used the certificate to target “a low single digit number” of customers using the certificate to encrypt Microsoft 365 data. Mimecast said it learned of the compromise from Microsoft. Certificate compromises allow hackers to read and modify encrypted data as it travels over the Internet. For that to happen, a hacker must first gain the ability to monitor the connection going into and out of a target’s network. Typically, certificate compromises require access to highly fortified storage devices that store private encryption keys. That access usually requires deep-level hacking or insider access. The Mimecast post didn’t describe what type of certificate was compromised, and a company spokesman declined to elaborate. This post, however, discusses how customers can use a certificate provided by Mimecast to connect their Microsoft 365 servers to the company’s service. Mimecast provides seven different certificates based on the geographic region of the customer.' -- source: https://arstechnica.com/information-technology/2021/01/mimecast-says-hacker… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quote Of The Week
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

“The “S” in “IoT” stands for “security”.” (Copied from <https://forums.theregister.com/forum/all/2021/01/12/flash_is_dead/#c_4185268>.)

1 0

Keeping Flash Player Going A Little Longer
by Lawrence D'Oliveiro 13 Jan '21

13 Jan '21

Adobe Flash Player has officially stopped working, since apparently Adobe included a logic bomb a few releases back with an expiry date in it <https://www.theregister.com/2021/01/12/flash_is_dead/>. However, for those who really, really need it, this article <https://charleswilkinson.co.uk/2021/01/12/how-to-use-flash-in-2021/> describes a workaround to re-enable it for certain sites (e.g. corporate intranet ones), by editing certain .cfg files. Those .cfg files don’t exist on a Linux installation -- not by default, anyway. However, doing a “strings” on libflashplayer.so finds (among other things) a reference to “/etc/adobe” and “/opt/adobe” directories. So perhaps you could create one of these and put files with the right names in it? Anyway, I’m just throwing this out there for anyone who wants to play with it. ;)

1 0

The Impractical but Indisputable Rise of Retrocomputing
by Peter Reutemann 13 Jan '21

13 Jan '21

'For all the personal technology introduced and popularized in 2020 -- upscale fitness bikes, at-home Covid tests, game consoles new and old -- the personal computer lands on the list with a bit of a thud. PCs lack the novelty of other gadgets, but they're practical, essential even, in a year when work, school and social life have come to rely heavily upon them. From a report: While modern, ever more efficient computers are selling better than they have in years, vintage computers -- impractical old devices in need of repairs and out-of-production parts -- are also in demand on sites like eBay. Collectors also flock to message boards, subreddits and Discord servers to buy, sell and trade parts. People are buying these PCs not necessarily for daily use, but for the satisfaction they get from rebuilding them. It's a trend one might chalk up to quarantine boredom, though it's been gaining traction for years. Retrocomputing, the hobby is called, is hardly just a way to pass the time. Instead, as enthusiasts see it, it's a means of communing with the past. "You get into this mind-set of what it must've been like to be somebody in the late '70s, having spent thousands of dollars on this thing that barely does anything more than a calculator," said Clint Basinger, 34, who runs the YouTube channel Lazy Game Reviews. (The devices do allow retrocomputers to make art and music using software unavailable on new computers and to play 8-bit games, but not much else beyond that.) "It's like a time machine to me," Mr. Basinger added. Before the pandemic, there were several vintage computing conventions located around the United States, to which collectors brought their computers to show off. Attendees bought and traded hardware at these events, as well as meet the friends they've made online.' -- source: https://it.slashdot.org/story/21/01/12/1910218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Shows Off Impressive Ryzen 5000 Mobile Processors and 3rd Gen Epyc Server Chips
by Peter Reutemann 13 Jan '21

13 Jan '21

'Advanced Micro Devices showed off some impressive Ryzen 5000 mobile processors today and teased the performance of its 3rd Gen Epyc server chips. From a report: Those chips are aimed at keeping AMD's performance lead over its rival Intel in the mobile and server markets. AMD CEO Lisa Su showed off the new chips in a keynote speech at CES 2021, the online-only tech trade show. AMD is launching its Ryzen 5000 Series mobile processors for gaming laptops and thin-and-light notebooks. These eight-core x86 chips are built with a 7-nanometer manufacturing process (where the circuits are 7 billionths of a meter apart). They are also based on the Zen3 design for processor cores, which can process instructions 19% faster per clock cycle than Zen2 cores. The H-Series focuses on top performance in laptops for gamers and content creators, while the U-Series focuses on thin-and-light notebooks with great battery life. The chips have four to eight cores and they range in power consumption from 15 watts to 45 watts. AMD said the 5000 Series will be available in PCs in February, and we'll see more than 150 systems using it. That compares to 100 systems for the Ryzen 4000 Series and 70 for the Ryzen 3000.' -- source: https://hardware.slashdot.org/story/21/01/12/1826233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping a Bunch of Old CPUs
by Peter Reutemann 12 Jan '21

12 Jan '21

'Charlotte Web writes: With Linux 5.10 having shipped as the latest Long Term Support (LTS) release to be maintained for at least the next five years, a discussion has begun over dropping a number of old and obsolete CPU platform support currently found within the mainline kernel. For many of the architectures being considered for removal they haven't seen any new commits in years but as is the case once proposals are made for them to be removed there are often passionate users wanting the support to be kept.' -- source: https://linux.slashdot.org/story/21/01/11/187220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Block Backspace Key From Working as 'Back' Button
by Peter Reutemann 12 Jan '21

12 Jan '21

'Mozilla developers plan to remove support for using the Backspace key as a Back button inside Firefox. From a report: The change is currently active in the Firefox Nightly version and is expected to go live in Firefox 86, scheduled to be released next month, in late February 2021. The removal of the Backspace key as a navigational element didn't come out of the blue. It was first proposed back in July 2014, in a bug report opened on Mozilla's bug tracker. At the time, Mozilla engineers argued that many users who press the Backspace key don't always mean to navigate to the previous page (the equivalent of pressing the Back button).' -- source: https://news.slashdot.org/story/21/01/11/1551224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rediscovering RISC-V: Apple M1 Sparks Renewed Interest in Non-x86 Architecture
by Peter Reutemann 11 Jan '21

11 Jan '21

'"With the runaway success of the new ARM-based M1 Macs, non-x86 architectures are getting their closeup," explains a new article at ZDNet. "RISC-V is getting the most attention from system designers looking to horn-in on Apple's recipe for high performance. Here's why..." RISC-V is, like x86 and ARM, an instruction set architecture (ISA). Unlike x86 and ARM, it is a free and open standard that anyone can use without getting locked into someone else's processor designs or paying costly license fees... Reaching the end of Moore's Law, we can't just cram more transistors on a chip. Instead, as Apple's A and M series processors show, adding specialized co-processors — for codecs, encryption, AI — to fast general-purpose RISC CPUs can offer stunning application performance and power efficiency. But a proprietary ISA, like ARM, is expensive. Worse, they typically only allow you to use that ISA's hardware designs, unless, of course, you're one of the large companies — like Apple — that can afford a top-tier license and a design team to exploit it. A canned design means architects can't specify tweaks that cut costs and improve performance. An open and free ISA, like RISC-V, eliminates a lot of this cost, giving small companies the ability to optimize their hardware for their applications. As we move intelligence into ever more cost-sensitive applications, using processors that cost a dollar or less, the need for application and cost-optimized processors is greater than ever... While open operating systems, like Linux, get a lot of attention, ISAs are an even longer-lived foundational technology. The x86 ISA dates back 50 years and today exists as a layer that gets translated to a simpler — and faster — underlying hardware architecture. (I suspect this fact is key to the success of the macOS Rosetta 2 translation from x86 code to Apple's M1 code.) Of course, an open ISA is only part of the solution. Free standard hardware designs — with tools to design more — and smart compilers to generate optimized code are vital. That larger project is what Berkeley's Adept Lab is working on. As computing continues to permeate civilization, the cost of sub-optimal infrastructure will continue to rise. Optimizing for efficiency, long-life, and broad application is vital for humanity's progress in a cyber-enabled world. One RISC-V feature highlighted by the article: 128-bit addressing (in addition to 32 and 64 bit).' -- source: https://hardware.slashdot.org/story/21/01/10/2020208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Wasmer 1.0 Can Run WebAssembly 'Universal Binaries' on Linux, MacOS, Windows, Android, and iOS
by Peter Reutemann 11 Jan '21

11 Jan '21

'The WebAssembly portable binary format will now have wider support from Wasmer, the server-side runtime which "allows universal binaries compiled from C++, Rust, Go, Python, and other languages to run on different operating systems and in web browsers without modification," reports InfoWorld: Wasmer can run lightweight containers based on WebAssembly on a variety of platforms — Linux, MacOS, Windows, Android, iOS — from the desktop to the cloud to IoT and mobile devices, while also allowing these containers to be embedded in any programming language. The Wasmer runtime also is able to run the Nginx web server and other WebAssembly modules... Wasmer was introduced in December 2018, with the stated goal of doing for WebAssembly what JavaScript did for Node.js: establish it server-side. By leveraging Wasmer for containerization, developers can create universal binaries that work anywhere without modification, including on Linux, MacOS, and Windows as well as web browsers. WebAssembly automatically sandboxes applications by default for secure execution, shielding the host environment from malicious code, bugs, and vulnerabilities in the software being run. Wasmer 1.0 reached "general availability status" with its release on January 5, and its developers are now claiming "out of this world" runtime and compiler performance. "We believe that WebAssembly will be a crucial component for the future of software execution and containerization (not only inside the browser but also outside)."' -- source: https://news.slashdot.org/story/21/01/10/0242244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 20.1 Long-term Support Release Is Out
by Peter Reutemann 10 Jan '21

10 Jan '21

'gHacks: Linux Mint 20.1 is now available. The first stable release of Linux Mint in 2021 is available in the three flavors Cinnamon, MATE and Xfce. The new version of the Linux distribution is based on Ubuntu 20.04 LTS and Linux kernel 5.4... - Linux Mint 20.1 comes with a unified file system that sees certain directories being merged with their counterparts in /usr, e.g. /bin merged with /usr/bin, /lib merged with /usr/lib for compatibility purposes... - The developers have added an option to turn websites into desktop applications in the new version [using the new Web App manager]... Web apps behave like desktop programs for the most part; they start in their own window and use a custom icon, and you find them in the Alt-Tab interface when you use it. Web apps can be pinned and they are found in the application menu after they have been created. ' -- source: https://linux.slashdot.org/story/21/01/09/2147228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NVIDIA Fixes High Severity Flaws Affecting Windows, Linux devices
by Peter Reutemann 10 Jan '21

10 Jan '21

'Bleeping Computer reports: NVIDIA has released security updates to address six security vulnerabilities found in Windows and Linux GPU display drivers, as well as ten additional flaws affecting the NVIDIA Virtual GPU (vGPU) management software. The vulnerabilities expose Windows and Linux machines to attacks leading to denial of service, escalation of privileges, data tampering, or information disclosure. All these security bugs require local user access, which means that potential attackers will first have to gain access to vulnerable devices using an additional attack vector. Following successful exploitation of one of the vulnerabilities patched today, attackers can easily escalate privileges to gain permissions above the default ones granted by the OS.' -- source: https://it.slashdot.org/story/21/01/09/2139217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox-based mobile browser: Iceraven
by Peter Reutemann 10 Jan '21

10 Jan '21

Hi everyone With the recent UI changes in the mobile Firefox browser, it unfortunately became pretty much unusable. I just came across the Iceraven browser: "Definitely not brought to you by Mozilla! Iceraven Browser is a web browser for Android, based on Mozilla's Fenix version of Firefox, GeckoView and Mozilla Android Components. Our goal is to be a close fork of the new Firefox for Android that seeks to provide users with more options, more opportunities to customize (including a broad extension library), and more information about the pages they visit and how their browsers are interacting with those pages." -- source: https://github.com/fork-maintainers/iceraven-browser At the moment, you have to download the .apk releases yourself and install them manually. >From an initial test, it looks promising! However, I'm still not able to have my bookmarks display on the homescreen... :-/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Side-Channel Attack Can Recover Encryption Keys From Google Titan Security Keys
by Peter Reutemann 09 Jan '21

09 Jan '21

'A duo of French security researchers has discovered a vulnerability impacting chips used inside Google Titan and YubiKey hardware security keys. From a report: The vulnerability allows threat actors to recover the primary encryption key used by the hardware security key to generate cryptographic tokens for two-factor authentication (2FA) operations. Once obtained, the two security researchers say the encryption key, an ECDSA private key, would allow threat actors to clone Titan, YubiKey, and other keys to bypass 2FA procedures. However, while the attack sounds disastrous for Google and Yubico security key owners, its severity is not what it seems. In a 60-page PDF report, Victor Lomne and Thomas Roche, researchers with Montpellier-based NinjaLab, explain the intricacies of the attack, also tracked as CVE-2021-3011. For starters, the attack won't work remotely against a device, over the internet, or over a local network. To exploit any Google Titan or Yubico security key, an attacker would first need to get their hands on a security key in the first place.' -- source: https://tech.slashdot.org/story/21/01/08/1814254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Crypto-Mining Botnet Is Now Stealing Docker and AWS Credentials
by Peter Reutemann 09 Jan '21

09 Jan '21

'ZDNet: Analysts from security firm Trend Micro said in a report today that they've spotted a malware botnet that collects and steals Docker and AWS credentials. Researchers have linked the botnet to a cybercrime operation known as TeamTNT; a group first spotted over the 2020 summer installing cryptocurrency-mining malware on misconfigured container platforms. Initial reports at the time said that TeamTNT was breaching container platforms by looking for Docker systems that were exposing their management API port online without a password. Researchers said the TeamTNT group would access exposed Docker containers, install a crypto-mining malware, but also steal credentials for Amazon Web Services (AWS) servers in order to pivot to a company's other IT systems to infect even more servers and deploy more crypto-miners. At the time, researchers said that TeamTNT was the first crypto-mining botnet that implemented a feature dedicated to collecting and stealing AWS credentials. But in a report today, Trend Micro researchers said that the TeamTNT gang's malware code had received considerable updates since it was first spotted last summer. TeamTNT has now also added a feature to collect Docker API credentials, on top of the AWS creds-stealing code. This feature is most likely used on container platforms where the botnet infects hosts using other entry points than its original Docker API port scanning feature.' -- source: https://it.slashdot.org/story/21/01/08/2132205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

First There Was GPT-3 For Fake Text, Now There Is DALL-E For Fake Images
by Lawrence D'Oliveiro 09 Jan '21

09 Jan '21

OpenAI, the company behind the GPT-3 neural network that is capable of generating plausible-sounding text passages on any given subject, have now extended it <https://www.theregister.com/2021/01/07/openai_dalle_impact/> to generating images based on any given caption. How will this impact content creators? Given that the net is trained on data copied off the Internet, what happens if/when it spews out something a little too close, copyright-wise, to some existing work of a human artist/writer?

1 0

WhatsApp Rival Signal Reports Growing Pains as New Users Surge
by Peter Reutemann 08 Jan '21

08 Jan '21

'Signal, an encrypted messaging app that competes with other services including Facebook's WhatsApp, said Thursday that verification codes used to create new accounts were delayed because of a flood of new users. From a report: "We are working with carriers to resolve this as quickly as possible," the non-profit foundation said in a tweet. "Hang in there." The surge came just hours after Elon Musk endorsed the service and amid reported changes to WhatsApp's terms of service.' -- source: https://tech.slashdot.org/story/21/01/07/1918206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mandatory WhatsApp Privacy Policy Update Allows User Data To be Shared With Facebook
by Peter Reutemann 07 Jan '21

07 Jan '21

'WhatsApp's latest terms and privacy policy allows the popular messaging app to share a significant amount of user data with Facebook. From a report: WhatsApp users are today receiving an in-app notice informing them about the app's updated terms of service and privacy policy. The notice gives an overview of the main three updates, covering how WhatsApp processes user data, how businesses can use Facebook-hosted services to store and manage their WhatsApp chats, and how WhatsApp will soon partner with Facebook to offer deeper integrations across all of the parent company's products. The changes, which are set to take effect on February 8, 2021, are mandatory and users will not be able to continue using WhatsApp unless they accept the terms.' -- source: https://yro.slashdot.org/story/21/01/06/1358228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0