- wlug - list.wlug.org.nz

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Verdict After Hackaday's Teardown of a Raspberry Pi 400: 'Very, Very Slick'
by Peter Reutemann 09 Nov '20

09 Nov '20

'"You can't send Hackaday a piece of gear without us taking it apart," warns an article shared by Slashdot reader beggarwoman. Hackady's verdict? The new Raspberry Pi 400 "is very, very slick." Inside, there's a flat-flex that connects the keyboard, and you see that big aluminum heat sink. It's almost the full size of the keyboard, and it's thick and heat-taped to the CPU. You know it means business. It's also right up against the aluminum bottom of the keyboard, suggesting it could get radiative help that way, and maybe keep your fingers warm in the winter. (I didn't feel any actual heat, but it's gotta go somewhere, right? There are also vents in the underside of the case.) Four PZ1 screws and a little bit of courage to unstick the pad get you underneath the heat spreader to find, surprise!, a Raspberry Pi 4. This was a little anticlimactic, as I've just spent a couple weeks looking over the schematics for my review of the new Compute Module 4, and it's just exactly what you'd expect. It's a Raspberry Pi 4, with all the ports broken out, inside a nice keyboard, with a beefy heat spreader. Ethernet magnetics sit on one side, and the wireless module sits on the other. That's it! "[C]ombine this with a small touch screen, and run it all off of a 5 V power pack, and you've got a ton of portable computing in a very small package. "If you're not mousing around all the time anyway, there's a certain streamlined simplicity here that's mighty tempting."' -- source: https://hardware.slashdot.org/story/20/11/07/1938245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Older Versions of Android, Many Let's Encrypt-Secured Sites May Stop Working in 2021
by Peter Reutemann 09 Nov '20

09 Nov '20

'This year Let's Encrypt announced that it's issued a billion certificates, and it's been estimated they've made certs for almost 30% of web domains. But Friday they posted that "The DST Root X3 root certificate that we relied on to get us off the ground is going to expire — on September 1, 2021. Fortunately, we're ready to stand on our own, and rely solely on our own root certificate." "However, this does introduce some compatibility woes." Some software that hasn't been updated since 2016 (approximately when our root was accepted to many root programs) still doesn't trust our root certificate, ISRG Root X1. Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let's Encrypt. Android has a long-standing and well known issue with operating system updates. There are lots of Android devices in the world running out-of-date operating systems. The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it. When there's an update to Android, both the manufacturer and the mobile carrier have to incorporate those changes into their customized version before sending it out. Often manufacturers decide that's not worth the effort. The result is bad for the people who buy these devices: many are stuck on operating systems that are years out of date. Currently, 66.2% of Android devices are running version 7.1 or above. The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let's Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant. Let's Encrypt engineer Jacob Hoffman-Andrews explains that "In the time between now and September 29 we plan to start serving certificates with the 'alternate' link relation 186 to allow Automatic Certificate Management Environment (ACME) clients to programmatically select a chain they prefer." But Friday's blog post explains that won't solve everything: There will be site owners that receive complaints from users and we are empathetic to that being not ideal. We're working hard to alert site owners so you can plan and prepare. We encourage site owners to deploy a temporary fix (switching to the alternate certificate chain) to keep your site working while you evaluate what you need for a long-term solution: whether you need to run a banner asking your Android users on older OSes to install Firefox, stop supporting older Android versions, drop back to HTTP for older Android versions, or switch to a CA that is installed on those older versions. Gizmodo notes that Firefox will be unaffected "since it relies on its own certificate store that includes Let's Encrypt's root, though that wouldn't keep applications from breaking or ensure functionality beyond your browser." They describe Let's Encrypt as "the Mozilla-partnered nonprofit," and offers this succinct summary of the problem. "One of the world's top certificate authorities warns that phones running versions of Android prior to 7.1.1 Nougat will be cut off from large portions of the secure web starting in 2021."' -- source: https://it.slashdot.org/story/20/11/08/1654223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating Flag Emojis
by Lawrence D'Oliveiro 08 Nov '20

08 Nov '20

You may have seen our new Foreign Minister, Nanaia Mahuta, tweeting her congratulations to the next President of the USA, including a couple of country flag emojis. I was looking through the Unicode character list for the codes for country flags, and discovered that there aren’t any, as such. Instead, there is this range of special character codes (“Regional indicator symbols”): 1F1E6 REGIONAL INDICATOR SYMBOL LETTER A ... 1F1FF REGIONAL INDICATOR SYMBOL LETTER Z with a note saying These characters can be used in pairs to represent regional codes. In some emoji implementations, certain pairs may be recognized and displayed by alternate means; for instance, an implementation might recognize F + R and display this combination with a symbol representing the flag of France. So for example if I enter U+1F1F3 (the code for N in the above block) followed by U+1F1FF (the code for Z), being the ISO-3166 regional code for NZ, the text-rendering system could replace them with the NZ flag: 🇳🇿. Anyway, I found out this works in YouTube comments as well. (Not that I’m saying the YouTube commenting system is particularly fine -- but that’s another story...)

1 0

EFF Argues RIAA is 'Abusing DMCA' to Take Down YouTube-DL
by Peter Reutemann 08 Nov '20

08 Nov '20

'While the RIAA has objected to a tool for downloading online videos, EFF senior activist Elliot Harmon responds with this question. "Who died and put them in charge of YouTube?" He asks the question in a new video "explainer" on the controversy, and argues in a new piece at EFF.org that the youtube-dl tool "doesn't infringe on any RIAA copyrights." RIAA's argument relies on a different section of the DMCA, Section 1201. DMCA 1201 says that it's illegal to bypass a digital lock in order to access or modify a copyrighted work. Copyright holders have argued that it's a violation of DMCA 1201 to bypass DRM even if you're doing it for completely lawful purposes; for example, if you're downloading a video on YouTube for the purpose of using it in a way that's protected by fair use. (And thanks to the way that copyright law has been globalized via trade agreements, similar laws exist in many other jurisdictions too.) RIAA argues that since youtube-dl could be used to download music owned by RIAA-member labels, no one should be able to use the tool, even for completely lawful purposes. This is an egregious abuse of the notice-and-takedown system, which is intended to resolve disputes over allegedly infringing material online. Again, youtube-dl doesn't use RIAA-member labels' music in any way. The makers of youtube-dl simply shared information with the public about how to perform a certain task — one with many completely lawful applications. Harmon wants to hear from people using youtube-dl for lawful purposes. And he also links to an earlier EFF piece arguing that DMCA 1201 "is incredibly broad, apparently allowing rightsholders to legally harass any 'trafficker' in code that lets users re-take control of their devices from DRM locks..." And EFF's concern over DMCA 1201 has been ongoing: DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our "Unintended Consequences" series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law. But due to the WIPO Copyright Treaty, the DMCA's anti-circumvention provisions infest much of the world's jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC.' -- source: https://yro.slashdot.org/story/20/11/07/0313228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Hits 20 Million Monthly Users a Year After 1.0 Release
by Peter Reutemann 06 Nov '20

06 Nov '20

'One year after its first 1.0 release, Brave says it has hit the milestone of 20.5 million active monthly users. "At the same time last year, the browser had 8.7 million active monthly users, and of the 20 million monthly users, 7 million are daily users, which represents more than a doubling of last year's 3 million," reports ZDNet. "Brave added that since Apple allowed browsers other than its own to be the default option on iOS, it has seen its iOS user base increase by a third." From the report: One of the touted features of the browser is that it hates ads, and will go out of its way to block them, unless users decide to see Brave-powered advertisements. To that end, Brave has hit "2 billion ad confirmation events" and completed 2,215 campaigns from over 460 companies. The browser maker says its users have a click-through rate of 9%, way and away outstripping industry averages. The browser also has its own cryptocurrency, Basic Attention Tokens, that users use to "tip" content creators. Thus far, 26 million of the tokens have been sent to creators. At the time of writing, the blockchain-based token is trading for just under 18 cents, meaning $4.6 million has been sent from users. ' -- source: https://tech.slashdot.org/story/20/11/05/0424253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Why Do Printers Still Suck?
by Peter Reutemann 06 Nov '20

06 Nov '20

'Just when we need them the most, with print shops locked down, online schooling in session, and everyone working from home, they fail to step up. From a column: Printers have been my enemy ever since I can remember. My first office job involved an evil printer that suffered daily paper jams. Tasked with fixing it, I suffered frequent burns and paper cuts. It had a door you had to close just so, or it would immediately break again with the dreaded phantom paper jam. It tormented me for months, completely indifferent to my cries. There isn't even any paper in it! More than two decades later, printers haven't improved at all. It feels like printer companies stopped innovating sometime in the '90s when sales stopped climbing. In fact, it's almost as if they've regressed. Manufacturers tempt with unbelievably cheap deals on printers and then nail you on expensive ink. To make sure they get their pound of flesh, they focus an inordinate effort on making sure printers only work with proprietary ink cartridges. [...] Three years and a couple of printers later, sick of being gouged for ink cartridges that always seem to run out at the worst moment, I optimistically signed up for a printing subscription plan. The idea is you are charged a flat fee based on how many pages you print each month, and the printer automatically orders ink refills when it's running low. Reading this back, I can only cringe at my naivety. Things were fine for the first few weeks. Then I made the mistake of turning the printer off. It doesn't like to be turned off. It started emailing me, insisting that it needs to be turned on and connected to the internet so the subscription plan can work properly. Every time I turn it on, it prints an ink-heavy test page. It is incredibly good at printing test pages -- it just won't print the document you want. Things got worse when I made the mistake of changing my internet service provider. I forgot about the printer for a while. Then I suddenly needed it. I didn't have time to set up the Wi-Fi, so I plugged directly into the printer with a good old-fashioned cable. It refused to print. I refused to connect it to the internet, so it refused to print for me. To get it working again I had to completely uninstall everything related to the printer, update my drivers, install three separate programs, carry it to another room to plug directly into my desktop, carry it back again, hold down the correct button sequence at the stroke of midnight, spin around three times, and recite the printer incantation into a mirror. It's finally connected and working ... for now. But I know it's only a matter of time before it betrays me again.' -- source: https://hardware.slashdot.org/story/20/11/05/2049213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

LibreOffice: OpenOffice Should Give Up And Die, Already
by Lawrence D'Oliveiro 06 Nov '20

06 Nov '20

Seems OpenOffice still has the edge in brand recognition over LibreOffice, in spite of being a largely moribund project with no major releases in 6 years. Yet, in spite of occasional talk of shutting it down, it continues to lurk, unloved, in some obscure corner of the ASF Orbiting HQ. <https://www.theregister.com/2020/10/15/libreoffice_openoffice_taunts/>

1 1

AMD Ryzen 5000 Series Processors Set a New Performance Bar Over Intel
by Peter Reutemann 06 Nov '20

06 Nov '20

'AMD made bold claims when the company unveiled its new Zen 3-based Ryzen 5000 series processors early last month. Statements like "historic IPC uplift" and "fastest for gamers" were waved about like flags of victory. However, as with most things in the computing world, independent testing is always the best way to validate claims. Today AMD lifted the embargo on 3rd party reviews and, in testing, AMD's new Ryzen 5000 series CPUs set a new performance bar virtually across the board, and one that Intel currently can't touch. There are four processors in the initial Ryzen 5000 series lineup, though it's a safe bet more will be coming later. The current entry point is the Ryzen 5 5600X 6-core / 8-thread processor, followed by the 8-core / 16-thread Ryzen 7 5800X, 12-core / 24 thread Ryzen 9 5900X, and the flagship 16-core / 32-thread Ryzen 9 5950X. All of these new CPUs are backwards compatible with AMD socket AM4 motherboards. In comparison to Zen 2, Zen 3 has a larger L1 branch target buffer and improved bandwidth through multiple parts of its pipeline with additional load/store flexibility. Where Zen 2 could handle 2 load and 1 store per cycle, Zen 3 can handle 3 load and 2 stores. All told, AMD is claiming an average 19% increase in IPC with Zen 3, which is a huge uplift gen-over-gen. Couple that IPC uplift with stronger multi-core scaling and a new unified L3 cache configuration, and Zen 3's performance looks great across a wide variety of workloads for both content creation and gaming especially. AMD's Ryzen 9 5950X, Ryzen 9 5900X, Ryzen 7 5800X and Ryzen 5 5600X will be priced at $799, $549, $449 and $299, respectively and should be on retail and etail shelves starting today.' -- source: https://slashdot.org/story/20/11/05/208242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Dell Adding Hardware Privacy Driver For Linux
by Peter Reutemann 05 Nov '20

05 Nov '20

'According to Phoronix, a Dell privacy driver is is being prepared for the Linux kernel. From the report: Beginning in Dell's 2021 laptop models they are providing hardware-based "privacy buttons" to disable microphone and camera support. These new Dell privacy buttons are basically hardware kill switches for the microphone and web camera video stream. The Dell privacy driver sent out on Tuesday for the Linux kernel is about manipulating the relevant LEDs and tracking the status of the hardware-based controls where as the actual toggling of the audio/video support is handled by the hardware. The Dell privacy driver in its current form is talked about for the camera and microphone support but the patch does also note a "PRIVACY_SCREEN_STATUS" bit as well. Presumably they will be extending this privacy driver as well for privacy screen handling around reducing the horizontal/vertical viewing angles of the display. The dell-privacy Linux driver in its initial form can be found via the kernel mailing list. It's great seeing Dell working on this driver punctually for Linux ahead of their next-gen laptops. ' -- source: https://linux.slashdot.org/story/20/11/04/2216242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Introduces Its Own Take On the Chromium Web Browser
by Peter Reutemann 05 Nov '20

05 Nov '20

'Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, have built their own take on Google's open-source Chromium web browser. ZDNet reports: Some of you may be saying, "Wait, haven't they offered Chromium for years? Well, yes, and no. For years, Mint used Ubuntu's Chromium build. But then Canonical, Ubuntu's parent company, moved from releasing Chromium as an APT-compatible DEB package to a Snap. The Ubuntu Snap software packing system, along with its rivals Flatpak and AppImage, is a new, container-oriented way of installing Linux applications. The older way of installing Linux apps, such as DEB and RPM package management systems for the Debian and Red Hat Linux families, incorporate the source code and hard-coded paths for each program. While tried and true, these traditional packages are troublesome for developers. They require programmers to hand-craft Linux programs to work with each specific distro and its various releases. They must ensure that each program has access to specific libraries' versions. That's a lot of work and painful programming, which led to the process being given the name: Dependency hell. Snap avoids this problem by incorporating the application and its libraries into a single package. It's then installed and mounted on a SquashFS virtual file system. When you run a Snap, you're running it inside a secured container of its own. For Chromium, in particular, Canonical felt using Snaps was the best way to handle this program. [...] Lefebvre wrote, "The Chromium browser is now available in the official repositories for both Linux Mint and LMDE. If you've been waiting for this I'd like to thank you for your patience." Part of the reason was, well, Canonical was right. Building Chromium from source code is one really slow process. He explained, "To guarantee reactivity and timely updates we had to automate the process of detecting, packaging and compiling new versions of Chromium. This is an application which can require more than 6 hours per build on a fast computer. We allocated a new build server with high specifications (Ryzen 9 3900, 128GB RAM, NMVe) and reduced the time it took to build Chromium to a little more than an hour." That's a lot of power! Still, for those who love it, up-to-date builds of Chromium are now available for Mint users. ' -- source: https://linux.slashdot.org/story/20/11/03/2157255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Users Reposting YouTube-DL They Could Be Banned
by Peter Reutemann 04 Nov '20

04 Nov '20

'On October 23, 2020, the RIAA decided on action to stunt the growth and potentially the entire future of popular YouTube-ripping tool YouTube-DL. The music industry group filed a copyright complaint with code repository Github, demanding that the project be taken down for breaching the anti-circumvention provisions of the DMCA. While this was never likely to be well received by the hoards of people who support the software, the response was unprecedented. [...] One of the responses was to repost the content to Github itself, where hundreds of YouTube-DL forks kept the flame alight. A copy even appeared in Github's DMCA notice repository where surprisingly it remains to this day. Now, however, Github is warning of consequences for those who continue to use the platform for deliberate breaches of the DMCA. As previously reported, Github is being unusually sympathetic to the plight of the YouTube-DL developers. Most platforms are very happy to simply follow the rules by removing content in response to a DMCA complaint and standing back while declaring "Nothing to do with us folks." Github, on the other hand, has actively become involved to try and get the project reinstated. Unfortunately, however, there is only so far Github can go, something the company made clear in a statement posted to its DMCA repository this weekend. "If you are looking to file or dispute a takedown notice by posting to this repository, please STOP because we do not accept Pull Requests or other contributions to this repository," wrote Jesse Geraci, Github's Corporate Counsel. "Please note that re-posting the exact same content that was the subject of a takedown notice without following the proper process is a violation of GitHub's DMCA Policy and Terms of Service. If you commit or post content to this repository that violates our Terms of Service, we will delete that content and may suspend access to your account as well," Geraci wrote. This statement caused an update to Github's earlier DMCA notice advice.' -- source: https://yro.slashdot.org/story/20/11/02/2250200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Wildly off topic but!!!
by john 03 Nov '20

03 Nov '20

Hi all, I know, but some light relief for those who have not seen these.. https://www.youtube.com/watch?v=4QsIQOevMLg https://www.youtube.com/watch?v=3MHDDSekvcE -- Cheers John

1 0

'youtube-dl' Downloading Software Removed From GitHub By RIAA Takedown Notice
by Peter Reutemann 03 Nov '20

03 Nov '20

'The GitHub repository for the popular youtube-dl utility is offline after GitHub received a DMCA takedown notice from the RIAA. The notice claims that "The clear purpose of this source code is to (i) circumvent the technological protection measures used by authorized streaming services such as YouTube, and (ii) reproduce and distribute music videos and sound recordings owned by our member companies without authorization for such use." "Whether you're looking to backup contents of your personal YouTube account or download some of your favorite YouTuber's videos for offline use, many turn to youtube-dl as the most reliable and in-depth tool for downloading videos from YouTube -- along with many, many other sites that have videos like Vimeo, CNN, etc," writes Kyle Bradshaw via 9to5Google. "Beyond simple downloading features, youtube-dl is also able to convert your download into nearly any format, including creating an mp3 of just a video's audio track." "One of the primary bases for the RIAA's claim is that youtube-dl appears to be developed with the explicit intention of enabling the downloading of copyrighted works, with music videos from the likes of Icona Pop, Justin Timberlake, and Taylor Swift being used to test the tool's functionality, a claim which we were able to independently verify." It's now up to the project's creators to file a counterclaim in the hopes of restoring youtube-dl's status on GitHub.' -- source: https://news.slashdot.org/story/20/10/23/2341202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

NetMarketShare Is Giving Up
by Lawrence D'Oliveiro 03 Nov '20

03 Nov '20

One of the two main companies that tracks web browser market share is leaving the business <https://www.theregister.com/2020/11/02/netmarketshare_to_end_browser_stats/>. The main reason given is that the “User-Agent” string that browsers send as part of HTTP requests is becoming less and less useful. But then, that was never a good way of detecting browser functionality anyway. An outfit called the Web Incubator Community Group (WICG) has a new proposal, called “Client Hints”, which is a much more granular way for the server to interrogate client-side capabilities.

1 0

The Raspberry Pi 400 is a Compact Keyboard With a Built-in Computer
by Peter Reutemann 03 Nov '20

03 Nov '20

'The Raspberry Pi Foundation has announced the Raspberry Pi 400, a compact keyboard with an ARM-based computer built in. Just plug it into a TV or monitor using one of its two micro HDMI ports, insert a microSD card, attach a power cord and mouse, and you've got yourself a basic computer for day-to-day tasks, coding, or media playback. It's available starting today as a standalone machine for $70 or in a bundle including a mouse, power supply, microSD card, HDMI cable, and beginner's guide for $100. From a report: The hope is the Pi 400's form factor, plus these optional bundled items, makes it more approachable and user-friendly. That's important when you're selling an affordable computer, and it's especially important when you're selling an accessible device to help children learn to code. It looks more like a piece of consumer electronics than the basis for a DIY project. [...] Aside from its keyboard and form factor, the Raspberry Pi 400 is a very similar computer to last year's Raspberry Pi 4. It's got a slightly faster quad-core 1.8GHz ARM Cortex-A72 CPU, up from 1.5GHz in the Pi 4, 4GB of RAM, Gigabit Ethernet, Bluetooth 5.0, and 802.11ac Wi-Fi. There are a pair of micro HDMI ports that can each output up to 4K / 60Hz, two USB 3.0 ports, and a single USB 2.0 port. Power is provided via a USB-C port, there's a microSD card slot for storage, and there's a GPIO header for attaching a variety of more niche devices.' -- source: https://hardware.slashdot.org/story/20/11/02/1437202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Will Soon Have Its Own Dedicated Certificate Root Store
by Peter Reutemann 03 Nov '20

03 Nov '20

'Google has announced plans to run its own certificate root program/store for Chrome, in a major architectural shift for the company's web browser program. From a report: A "root program" or a "root store" is a list of root certificates that operating systems and applications use to verify the identity of a software program during its installation routine. Browsers like Chrome use root stores to check the validity of an HTTPS connection. They do this by looking at the website's TLS certificate and checking if the root certificate that was used to generate the TLS cert is included in the local root program/store. Since its launch in late 2009, Chrome was configured to use the "root store" of the underlying platform. For example, Chrome on Windows checked a site's TLS certificate against the Microsoft Trusted Root Program, the root store that ships with Windows; Chrome on macOS relied on the Apple Root Certificate Program; and so on. But in a wiki page, shared with ZDNet by one of our readers, Google announced plans to create its own root store, named the Chrome Root Program, that will ship with all versions of Chrome, on all platforms, except iOS.' -- source: https://it.slashdot.org/story/20/11/02/1638225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dr. Strangenet—or, how I stopped worrying and embraced the WFH IT apocalypse
by Peter Reutemann 03 Nov '20

03 Nov '20

'We are now a solid two quarters into our new work-from-home bizarro world. Many companies found themselves in a bit of a pickle as workforces went from occasional or limited to everyone all-the-time, throwing up whatever they could provision to allow for remote access and continued productivity (or at least some semblance of it). We're well past the emergency stage, folks. For many of us, this will be ongoing and potentially permanent. And the way we do business will have to change—including how we structure our IT operations.' -- source: https://arstechnica.com/features/2020/11/future-of-collaboration-03/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could RISC-V Processors Compete With Intel, ARM, and AMD?
by Peter Reutemann 02 Nov '20

02 Nov '20

'As promised, SiFive has unveiled a new computer featuring the company's SiFive FU740 processor based on RISC-V architecture," reports Liliputing: The company, which has been making RISC-V chips for several years, is positioning its new SiFive HiFive Unmatched computer as a professional development board for those interested in working with RISC-V. But unlike the company's other HiFive boards, the new Unmatched model is designed so that it can be easily integrated into a standard PC... SiFive says the system can support GNU/Linux distributions including Yocto, Debian, and Fedora. "SiFive is releasing the HiFive Unleashed in an effort to afford developers the ability to build RISC-V based systems, using readily available, off-the-shelf parts," explains Forbes: SiFive says it built the board to address the market need for easily accessible RISC-V hardware to further advance development of new platforms, products, and software using the royalty-free ISA... A short video demo shows the HiFive Unmatched installed in a common mid-tower PC chassis, running the included Linux distro, with an AMD Radeon graphics card pushing the pixels. In the video, the HiFive Unmatched is compiling an application and is shown browsing the web and opening a PDF. SiFive also notes that video playback is accelerated in hardware with the included version of Linux. "At the moment, these development PCs are early alternatives, most likely targeted at hobbyists and engineers who may snap them up when they become available in the fourth quarter for $665," notes VentureBeat. But they add that "While it's still early days, it's not inconceivable that RISC-V processors could someday be alternatives to Intel-based PCs and PC processors." The startup has raised $190 million to date, and former Qualcomm executive Patrick Little recently joined SiFive as CEO. His task will be to establish the company's RISC-V processors as an alternative to ARM. This move comes in the wake of Nvidia's $40 billion acquisition of the world's leading processor architecture. If Little is also looking to challenge Intel and AMD in PCs, he'll have his work cut out for him. For starters, SiFive is currently focused on Linux-based PCs, not Microsoft Windows PCs. Secondly, SiFive wouldn't build these processors or computers on its own. Its customers — anyone brave enough to take on the PC giants — would have to do that. "I wouldn't see this as SiFive moving out of the box. It's more like they're expanding their box," said Linley Group senior analyst Aakash Jani. "They're using their core architecture to enable other chip designers to build PCs, or whatever they plan to build."' -- source: https://hardware.slashdot.org/story/20/11/01/0127253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Creates Its Own Versions of Apple/Google Coronavirus Tracing Apps
by Peter Reutemann 02 Nov '20

02 Nov '20

'"The Linux Foundation has formed a new group to provide public health authorities with free technology for tracking the spread of the coronavirus and future epidemics," writes Business Insider. Launched in July, the group has already released two apps "that notify users if they've been in contact with someone who has tested positive with COVID-19." Since these apps are open source, people can contribute code and customize them, allowing regions with similar needs to collaborate, general manager at Linux Foundation Public Health, Dan Kohn, told Business Insider. Developers that want to build an app off these projects can access or download the source code. These apps take advantage of technology launched by Apple and Google, which can be integrated into any app, that uses Bluetooth on people's smartphones to track who a user has been in close proximity with, without identifying the specific people. If anyone tests positive for COVID-19 and uploads that information to a database run by a local public health authority, any user who has been in close contact with that person will get a notification through their app saying they may have been exposed — again, without identifying who has COVID-19. If someone knows that they may have been exposed, they can either self-quarantine or get tested. "Essentially we think exposure notification could have a big impact on reducing the overall rate of exposure," Kohn said. An Oxford University study in April said that if about 60% of the population used a contact tracing app, it could grind the diseases spread to a halt. Researchers on the team also found that digital contact tracing can cut down spread even at much lower levels of usage.' -- source: https://linux.slashdot.org/story/20/11/01/0214201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Chinese Laptop Appears With 14nm Loongsoon Quad-Core 3A4000 CPU
by Peter Reutemann 01 Nov '20

01 Nov '20

'"BDY electronics, a Chinese laptop manufacturer, has unveiled an all-new 13.3-inch laptop sporting Longsoon's new Dragon Core 3A4000 quad-core 14nm CPU," reports Tom's Hardware: The biggest feature of this laptop is the CPU, featuring Longsoon's latest 14nm quad-core 3A4000 CPU. Longsoon claims the CPU is 100% faster than the previous generation 3A3000 and is comparable in performance to AMD's "Excavator" cores used in the A8-7680 Godavari architecture. Of course, this demonstrates how far behind Longsoon is from TSMC and Intel in performance, speed, and efficiency of its latest node. However, the chairman of Loongsoon Technologies, Hu Weiwu, says, "14nm and 28nm (for its GPU node) is enough for 90% of applications.," so it appears the company isn't too worried about catching up to the performance leaders like Intel and AMD. Due to this laptop being in the Chinese market, Windows is not supported at all. It only runs Chinese "domestic operating systems" that are typically modified versions of Linux. Fortunately, this does mean you can install any Linux flavor you want on the laptop, which can be handy if you don't want to run China-specific apps only. Slashdot reader Hmmmmmm points out that Loongson's upcoming 3a5000 CPU "will be a 12nm CPU that is 50% faster than the 3A4000."' -- source: https://hardware.slashdot.org/story/20/10/31/1926242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Software Freedom Conservancy: Microsoft Should Resign from RIAA Over Youtube-DL Takedown Demand
by Peter Reutemann 01 Nov '20

01 Nov '20

'"We believe that youtube-dl has substantial non-infringing uses," argues the non-profit Software Freedom Conservancy. But while that software faces a DMCA takedown notice from the Recording Industry Association of America (RIAA), GitHub's owner Microsoft is also a paying member of the RIAA. The Software Freedom Conservancy argues that this leaves Microsoft "stuck between their industry association's abuses of the law and the needs of FOSS projects for which they provide infrastructure." While under current law (which we object to), complying with the takedown notice is admittedly the fastest way to limit Microsoft's liability, we view Microsoft's membership in the RIAA as a much bigger liability to our community, now that Microsoft controls GitHub. We call on Microsoft to resign from the RIAA and remove their conflict of interest in this matter. This is an important opportunity for Microsoft to stand up for the values of software freedom... To build a strong community of FOSS developers, we need confidence that our software hosting platforms will fight for our rights. While we'd prefer that Microsoft would simply refuse to kowtow to institutions like the RIAA and reject their DMCA requests, we believe in the alternative Microsoft can take the easy first step of resigning from RIAA in protest. We similarly call on all RIAA members who value FOSS to also resign.' -- source: https://yro.slashdot.org/story/20/10/31/0416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Registering An XSS Attack As A UK Company Name
by Lawrence D'Oliveiro 31 Oct '20

31 Oct '20

It is permissible under UK law <https://www.theregister.com/2020/10/30/companies_house_xss_silliness/> to register a company name that, when inserted without escapes into a web page, will trigger certain ... interesting ... behaviour. Companies House blocked such an attempt, but frankly I don’t see why they don’t just allow it. It would serve as a wake-up call to a whole lot of lazy/naïve web developers, anyway.

1 0

Is X.Org Server Abandonware?
by Peter Reutemann 31 Oct '20

31 Oct '20

'Phoronix ran a story this morning with this provocative headline: "It's Time To Admit It: The X.Org Server Is Abandonware." The last major release of the X.Org Server was in May 2018 but don't expect the long-awaited X.Org Server 1.21 to actually be released anytime soon. This should hardly be surprising but a prominent Intel open-source developer has conceded that the X.Org Server is pretty much "abandonware" with Wayland being the future. [Or, more specifically, that "The main worry I have is that xserver is abandonware without even regular releases from the main branch."] This comes as X.Org Server development hits a nearly two decade low, the X.Org Server is well off its six month release regimen in not seeing a major release in over two years, and no one is stepping up to manage the 1.21 release. A year ago was a proposal to see new releases driven via continuous integration testing but even that didn't take flight and as we roll into 2021 there isn't any motivation for releasing new versions of the X.Org Server by those capable of doing so. Red Hat folks have long stepped up to manage X.Org Server releases but with Fedora Workstation using Wayland by default and RHEL working that way, they haven't been eager to devote resources to new X.Org Server releases. Other major stakeholders also have resisted stepping up to ship 1.21 or commit any major resources to new xorg-server versions.' -- source: https://tech.slashdot.org/story/20/10/25/1523253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

NSA “Learned Its Lesson” About Crypto Backdoors -- Take Their Word For It
by Lawrence D'Oliveiro 29 Oct '20

29 Oct '20

Some years ago, the US National Security Agency was quite keen to see the “Dual EC DRBG” pseudorandom number generator become widely adopted for secure encryption purposes <https://www.theregister.com/2020/10/28/nsa_backdoor_wyden/>. But two independent researchers at Microsoft discovered that there were weaknesses in the algorithm, that could be exploited to implant backdoors -- that is, it was possible to compromise the algorithm such that the output still looked random, but a knowledgeable attacker would be able to predict enough statistical characteristics of the bitstream to fatally weaken its randomness. Naturally you can figure out what the NSA were assuming -- that they would be the only ones in the world with the capability to take advantage of such a weakness. This turned out to be wrong. Apparently a report was written up about “lessons learned” from this episode (would it be too much to assume it concluded that such backdoors should never be planted again?) ... but the NSA cannot find the report.

1 0

Hackers Can Now Reverse Engineer Intel Updates Or Write Their Own Custom Firmware
by Peter Reutemann 29 Oct '20

29 Oct '20

'Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have wide-ranging consequences for the way the chips are used and, possibly, the way they're secured. The key makes it possible to decrypt the microcode updates Intel provides to fix security vulnerabilities and other types of bugs. Having a decrypted copy of an update may allow hackers to reverse engineer it and learn precisely how to exploit the hole it's patching. The key may also allow parties other than Intel -- say a malicious hacker or a hobbyist -- to update chips with their own microcode, although that customized version wouldn't survive a reboot. "At the moment, it is quite difficult to assess the security impact," independent researcher Maxim Goryachy said in a direct message. "But in any case, this is the first time in the history of Intel processors when you can execute your microcode inside and analyze the updates." Goryachy and two other researchers -- Dmitry Sklyarov and Mark Ermolov, both with security firm Positive Technologies -- worked jointly on the project. The key can be extracted for any chip -- be it a Celeron, Pentium, or Atom -- that's based on Intel's Goldmont architecture. In a statement, Intel officials wrote: "The issue described does not represent security exposure to customers, and we do not rely on obfuscation of information behind red unlock as a security measure. In addition to the INTEL-SA-00086 mitigation, OEMs following Intel's manufacturing guidance have mitigated the OEM specific unlock capabilities required for this research. The private key used to authenticate microcode does not reside in the silicon, and an attacker cannot load an unauthenticated patch on a remote system."' -- source: https://developers.slashdot.org/story/20/10/28/217212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikimedia Is Moving To GitLab
by Peter Reutemann 29 Oct '20

29 Oct '20

'The Wikimedia Foundation, the American non-profit organization that owns the internet domain names of many movement projects and hosts sites like Wikipedia, has decided to migrate their code repositories from Gerrit to Gitlab. Slashdot reader nfrankel shares the announcement: For the past two years, our developer satisfaction survey has shown that there is some level of dissatisfaction with Gerrit, our code review system. This dissatisfaction is particularly evident for our volunteer communities. The evident dissatisfaction with code review, coupled with an internal review of our CI tooling and practice makes this an opportune moment to revisit our code review choices. While Gerrit's workflow is in many respects best-in-class, its interface suffers from usability deficits, and its workflow differs from mainstream industry practices. This creates barriers to entry for the community and slows onboarding for WMF technical staff. In addition, there are a growing number of individuals and teams (both staff and non-staff) who are opting to forgo the use of Gerrit and instead use a third-party hosted option such as GitHub. Reasons vary for the choice to use third-party hosting but, based on informal communication, there are 3 main groupings: lower friction to create new repositories; easier setup and self-service of Continuous Integration configuration; and more familiarity with pull-request style workflows. All these explanations point to friction in our existing code-review system slowing development rather than fostering it. The choice to use third-party code-hosting hurts our collaboration (both internal and external), adds to the confusion of onboarding, and makes it more difficult to maintain code standards across repositories. At the same time, there is a requirement that all software which is deployed to Wikimedia production is hosted and deployed from Gerrit. If we fail to address the real usability problems that users have with Gerrit, people will continue to launch and build projects on whatever system it is they prefer -- Wikimedia's GitHub already contains 152 projects, the Research team has 127 projects. This raises the question: if Gerrit has identifiable problems, why can't we solve those problems in Gerrit? Gerrit is open source (Apache licensed) software; modifications are a simple matter of programming. [...] Upstream has improved the UI in recent releases, and releases have become more frequent; however, upgrade path documentation is often lacking. The migration from Gerrit 2 to Gerrit 3, for example, required several upstream patchsets to avoid the recommended path of several days of downtime. This is the effort required to maintain the status quo. Even small improvements require effort and time as, often, our use-case is very different from the remainder of the Gerrit community. ' -- source: https://news.slashdot.org/story/20/10/28/2114259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

RIAA's YouTube-DL Takedown Ticks Off Developers and GitHub's CEO
by Peter Reutemann 28 Oct '20

28 Oct '20

'An RIAA takedown request, which removed the YouTube-DL repository from GitHub, has ticked off developers and GitHub's CEO. Numerous people responded by copying and republishing the contested code, including in some quite clever ways. Meanwhile, GitHub's CEO is "annoyed" as well, offering help to get the repo reinstated. TorrentFreak reports: Soon after the RIAA notice took YouTube-DL offline many developers spoke out in protest. They believe that the music industry group went too far and started to republish copies of the code everywhere. Over the past several days, we have seen hundreds of new forks and copies appear online. These were also posted to GitHub, where YouTube-DL forks remain easy to find and continue to be uploaded. The code was also posted in some places one wouldn't expect. For example, there's still a copy in GitHub's DMCA notice repository, which some people find quite amusing. And the list of pull requests can be quite entertaining in themselves. One of the most creative responses we've seen was posted to Twitter by @GalacticFurball who encoded YouTube-DL into images that can be easily shared, encouraging others to share these as well. "I would also suggest that you save and repost the images, as one single source kind of defeats the point. Maybe start a hashtag trend or something. Make songs, and poetry. Get that data out there." This triggered even more creativity, with people finding alternative means to share the code online, all to counter the RIAA's takedown request. Meanwhile, GitHub's CEO Nat Friedman wasn't sitting still either. While the Microsoft-owned developer platform had to respond to the takedown notice, Friedman himself actively reached out to YouTube-DL's developers to help them get their project reinstated. The CEO joined YouTube-DL's IRC channel hoping to connect with the owner of the repository so he can help to get it unsuspended. "GitHub exists to help developers. We never want to interfere with their work. We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo," Friedman told TorrentFreak, explaining his actions. GitHub's CEO suggested that YouTube-DL won't be reinstated in its original form. But, the software may be able to return without the rolling cipher circumvention code and the examples of how to download copyrighted material. ' -- source: https://news.slashdot.org/story/20/10/27/2230218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Further Borgs Its Oculus Acquisition
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

When Facebook first acquired VR headset company Oculus back in 2014, the CEO of the latter claimed “I guarantee that you won't need to log into your Facebook account every time you wanna use the Oculus Rift.” That statement, to reuse an old phrase from the Vietnam War, is no longer operative <https://www.theregister.com/2020/10/27/facebook_oculus_accounts/>. They have also threatened to ban accounts that try to share more than one headset, but have resiled from that by popular demand, at least temporarily. Candidate for quote of the week: “While I do completely understand your concerns, we do need to have you comply with the Facebook TOS.”

1 0

Chrome OS May Finally Be Getting a Dark Mode
by Peter Reutemann 27 Oct '20

27 Oct '20

'The Verge: Chrome OS may finally be getting a dark mode, but so far it's only been spotted in its experimental Canary channel, Android Central reported. Before you go tinkering with Canary just be advised: Canary is Google's "bleeding edge" Chrome OS path, which receives daily updates of features before they've been widely tested. It can only be accessed from Chromebooks switched into a special developer mode (not to be confused with the Chrome OS Developer channel). Google warns that Canary can be "unstable." But at the moment, to activate dark mode on your Chromebook, you need to have the Canary channel installed. Once you've done that, Android Central says you just open Chrome and type in chrome://flags/#enable-force-dark and chrome://flags/#enable-webui-dark-mode into the URL bar. I should note I tried this on my older Chromebook and wasn't able to get it to work. But here's the view Android Police captured. Android Central says the dark mode has some bugs, but notes it seems to apply across the UI, not just as darker backgrounds. ' -- source: https://tech.slashdot.org/story/20/10/26/2047207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study shows which messengers leak your data, drain your battery, and more
by Peter Reutemann 27 Oct '20

27 Oct '20

'Link previews are a ubiquitous feature found in just about every chat and messaging app, and with good reason. They make online conversations easier by providing images and text associated with the file that’s being linked. Unfortunately, they can also leak our sensitive data, consume our limited bandwidth, drain our batteries, and, in one case, expose links in chats that are supposed to be end-to-end encrypted. Among the worst offenders, according to research published on Monday, were messengers from Facebook, Instagram, LinkedIn, and Line.' -- source: https://arstechnica.com/information-technology/2020/10/study-shows-which-me… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Flying Your Plane!?
by Lawrence D'Oliveiro 27 Oct '20

27 Oct '20

Linux hardware guru Greg Kroah-Hartman on the use of Linux in safety-critical systems <https://www.theregister.com/2020/10/26/linux_kernel_intel/>: What does he think about using Linux in a safety-critical environment? “Anyone who’s ever flown in a plane, it’s been controlled by Linux, for the past decade, so it’s in safety-critical environments today,” he said, grinning. “It runs telecoms systems, it runs stock markets, it runs satellites, it keeps mega yachts from tipping over, it’s been in automotive as well, in the head units for a long time … nobody wants to write an operating system, they just want to write applications to solve their problems.” He also has a warning for those trying to selectively backport security fixes to older kernel versions.

1 0

Vint Cerf Is Working on an Internet for Outer Space
by Peter Reutemann 27 Oct '20

27 Oct '20

'"TCP/IP doesn't work at interplanetary distances," 77-year-old Vinton Cerf tells Quanta magazine. "So we designed a set of protocols that do." Specifically, bundle protocols: a disruption/delay-tolerant networking (DTN) protocol with nodes that can also store information: A data packet traveling from Earth to Jupiter might, for example, go through a relay on Mars, Cerf explained. However, when the packet arrives at the relay, some 40 million miles into the 400-million-mile journey, Mars may not be oriented properly to send the packet on to Jupiter. "Why throw the information away, instead of hanging on to it until Jupiter shows up?" Cerf said. This store-and-forward feature allows bundles to navigate toward their destinations one hop at a time, despite large disruptions and delays... So, a couple decades after conceiving of bundle protocols, is the interplanetary internet up and running? We don't have to build the whole thing and then hope somebody uses it. We sought to get standards in place, as we have for the internet; offer those standards freely; and then achieve interoperability so that the various spacefaring nations could help each other. We're taking the next obvious step for multi-mission infrastructure: designing the capability for an interplanetary backbone network. You build what's needed for the next mission. As spacecraft get built and deployed, they carry the standard protocols that become part of the interplanetary backbone. Then, when they finish their primary scientific mission, they get repurposed as nodes in the backbone network. We accrete an interplanetary backbone over time. In 2004, the Mars rovers were supposed to transmit data back to Earth directly through the deep space network — three big 70-meter antennas in Australia, Spain and California. However, the channel's available data rate was 28 kilobits per second, which isn't much. When they turned the radios on, they overheated. They had to back off, which meant less data would come back. That made the scientists grumpy. One of the JPL engineers used prototype software — this is so cool! — to reprogram the rovers and orbiters from hundreds of millions of miles away. We built a small store-and-forward interplanetary internet with essentially three nodes: the rovers on the surface of Mars, the orbiters and the deep space network on Earth. That's been running ever since. We've been refining the design of those protocols, implementing and testing them. The latest protocols are running back-and-forth relays between Earth and the International Space Station... We did another test at the ISS where the astronauts were controlling a little robot vehicle in Germany.' -- source: https://science.slashdot.org/story/20/10/25/2329239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So How Good Is Edge on Linux?
by Peter Reutemann 26 Oct '20

26 Oct '20

'"No one asked Microsoft to port its Edge browser to Linux," writes Steven J. Vaughan-Nichols at ZDNet, adding "Indeed, very few people asked for Edge on Windows. "But, here it is. So, how good — or not — is it..?" The new release comes ready to run on Ubuntu, Debian, Fedora, and openSUSE Linux distributions... Since I've been benchmarking web browsers since Mosaic rolled off the bit assembly line, I benchmarked the first Edge browser and Chrome 86 and Firefox 81 on my main Linux production PC.... First up: JetStream 2.0, which is made up of 64 smaller tests. This JavaScript and WebAssembly benchmark suite focuses on advanced web applications. It rewards browsers that start up quickly, execute code quickly, and run smoothly. Higher scores are better on this benchmark. JetStream's top-scorer — drumroll please — was Edge with 136.971. But, right behind it within the margin of error, was Chrome with a score of 132.413. This isn't too surprising. They are, after all, built on the same platform. Back in the back was Firefox with 102.131. Next up: Kraken 1.1. This benchmark, which is based on the long-obsolete SunSpider, measures JavaScript performance. To this basic JavaScript testing, it added typical use-case scenarios. Mozilla, Firefox's parent organization, created Kraken. With this benchmark, the lower the score, the better the result. To no great surprise, Firefox took first place here with 810.1 milliseconds (ms). Following it was Chrome with 904.5ms and then Edge with 958.8ms. The latest version of WebXPRT is today's best browser benchmark. It's produced by the benchmark professionals at Principled Technology. This company's executives were the founders of the Ziff Davis Benchmark Operation, the gold-standard of PC benchmarking. WebXPRT uses scenarios created to mirror everyday tasks. These include Photo Enhancement, Organize Album, Stock Option Pricing, Local Notes, Sales Graphs, and DNA Sequencing. Here, the higher the score, the better the browser. On this benchmark, Firefox shines. It was an easy winner with a score of 272. Chrome edges out Edge 233 to 230. The article concludes that "Oddly, Edge, which turned in a poor performance when I recently benchmarked it on Windows, did well on Linux. Who'd have guessed...? Edge is a good, fast browser on Linux. If you're a Windows user coming over to Linux or you're doing development work aimed at Edge, then by all means try Edge on Linux. It works and it works well." Yet Vaughan-Nichols admits he's still not going to switch to Edge. "Chrome is more than fast enough for my purposes and I don't want my information tied into the Microsoft ecosystem. For better or worse, mine's already locked into the Googleverse and I can live with that."' -- source: https://linux.slashdot.org/story/20/10/25/0118218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Snopes.com Exposes 4chan Campaign to 'Kindle Mistrust in Snopes'
by Peter Reutemann 26 Oct '20

26 Oct '20

'"This is the perfect moment to do this. This is an age of conspiracies for boomers... Let's kindle their mistrust in Snopes and other fact checkers," wrote one 4chan poster. Snopes.com later reported: In October 2020, a series of threads was posted to the anonymous internet forum 4Chan as part of operation "Snopes-Piercer," a smear campaign with the stated goal of "red-pilling some normies" — internet slang for a propaganda technique in which distorted, fabricated, or skewed information is used to further a self-determined "truth." In order to "red-pill" these people (one thread noted that "boomers" were the primary target), the plan was to create and circulate doctored screenshots of Snopes fact checks to make it appear as if Snopes fact-checkers addressed claims that we had not. Over the next few days, users created and shared these fake Snopes screenshots in a number of additional 4chan threads. These images were also posted on social media sites, like Twitter.... Some were humorous (we did not actually address the claim that CNN reporter Chris Cuomo was actually Fredo from "The Godfather"), some were insidious (we did not really publish a fact check questioning the Holocaust), and some were political (we did not publish a fact check questioning the results of the 2020 election before the election happened)... These red pill campaigns all follow a basic formula. The user decides what they want to be true and then they set out to find, or manufacture, the evidence to support that truth. A concerted effort is then made to spread these false narratives to as wide an audience as possible in order to "red-pill" the general population. In this formula, the desired "truth" comes first. The "evidence" comes second. It goes without saying that this method is antithetical to the mission of Snopes, fact-checkers in general, journalists, and anyone seeking an objective view of reality.' -- source: https://news.slashdot.org/story/20/10/24/1952242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Apple, Google and a Deal That Controls the Internet'
by Peter Reutemann 26 Oct '20

26 Oct '20

'The New York Times' looks at "a deal that controls the internet" — Apple's agreement to feature Google as the preselected search engine for iPhones, saying America's Justice Department views it "as a prime example of what prosecutors say are Google's illegal tactics to protect its monopoly and choke off competition..." The scrutiny of the pact, which was first inked 15 years ago and has rarely been discussed by either company, has highlighted the special relationship between Silicon Valley's two most valuable companies — an unlikely union of rivals that regulators say is unfairly preventing smaller companies from flourishing. "We have this sort of strange term in Silicon Valley: co-opetition," said Bruce Sewell, Apple's general counsel from 2009 to 2017. "You have brutal competition, but at the same time, you have necessary cooperation." Apple and Google are joined at the hip even though Mr. Cook has said internet advertising, Google's bread and butter, engages in "surveillance" of consumers and even though Steve Jobs, Apple's co-founder, once promised "thermonuclear war" on his Silicon Valley neighbor when he learned it was working on a rival to the iPhone. Apple and Google's parent company, Alphabet, worth more than $3 trillion combined, do compete on plenty of fronts, like smartphones, digital maps and laptops. But they also know how to make nice when it suits their interests. And few deals have been nicer to both sides of the table than the iPhone search deal. Nearly half of Google's search traffic now comes from Apple devices, according to the Justice Department, and the prospect of losing the Apple deal has been described as a "code red" scenario inside the company. When iPhone users search on Google, they see the search ads that drive Google's business. They can also find their way to other Google products, like YouTube. A former Google executive, who asked not to be identified because he was not permitted to talk about the deal, said the prospect of losing Apple's traffic was "terrifying" to the company. The Justice Department, which is asking for a court injunction preventing Google from entering into deals like the one it made with Apple, argues that the arrangement has unfairly helped make Google, which handles 92 percent of the world's internet searches, the center of consumers' online lives... [C]ompetitors like DuckDuckGo, a small search engine that sells itself as a privacy-focused alternative to Google, could never match Google's tab with Apple. Apple now receives an estimated $8 billion to $12 billion in annual payments — up from $1 billion a year in 2014 — in exchange for building Google's search engine into its products. It is probably the single biggest payment that Google makes to anyone and accounts for 14 to 21 percent of Apple's annual profits. That's not money Apple would be eager to walk away from. In fact, Mr. Cook and Mr. Pichai met again in 2018 to discuss how they could increase revenue from search. After the meeting, a senior Apple employee wrote to a Google counterpart that "our vision is that we work as if we are one company," according to the Justice Department's complaint. The article remembers Steve Jobs unveiling the iPhone in 2007 — and then inviting Google CEO Eric Schmidt onto the stage. Schmidt, who was also on Apple's board of directors, joked "If we just sort of merged the two companies, we could just call them AppleGoo." He'd also added that with Google search on the iPhone, "you can actually merge without merging."' -- source: https://apple.slashdot.org/story/20/10/25/180214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot Asks: How Do You Feel About Btrfs?
by Peter Reutemann 25 Oct '20

25 Oct '20

'Linux Journal re-visiting the saga of the btrfs file system (initially designed at Oracle in 2007): The btrfs filesystem has taunted the Linux community for years, offering a stunning array of features and capability, but never earning universal acclaim. Btrfs is perhaps more deserving of patience, as its promised capabilities dwarf all peers, earning it vocal proponents with great influence. Still, [while] none can argue that btrfs is unfinished, many features are very new, and stability concerns remain for common functions. Most of the intended goals of btrfs have been met. However, Red Hat famously cut continued btrfs support from their 7.4 release, and has allowed the code to stagnate in their backported kernel since that time. The Fedora project announced their intention to adopt btrfs as the default filesystem for variants of their distribution, in a seeming juxtaposition. SUSE has maintained btrfs support for their own distribution and the greater community for many years. For users, the most desirable features of btrfs are transparent compression and snapshots; these features are stable, and relatively easy to add as a veneer to stock CentOS (and its peers). Administrators are further compelled by adjustable checksums, scrubs, and the ability to enlarge as well as (surprisingly) shrink filesystem images, while some advanced btrfs topics (i.e. deduplication, RAID, ext4 conversion) aren't really germane for minimal loopback usage. The systemd init package also has dependencies upon btrfs, among them machinectl and systemd-nspawn . Despite these features, there are many usage patterns that are not directly appropriate for use with btrfs. It is hostile to most databases and many other programs with incompatible I/O, and should be approached with some care. The original submission drew reactions from three disgruntled btrfs users. But the article goes on to explore providers of CentOS-compatible btrfs-enabled kernels, ultimately opining that "There are many 'rough edges' that are uncovered above with btrfs capabilities and implementations, especially with the measures taken to enable it for CentOS. Still, this is far better than ext2/3/4 and XFS, discarding all the desirable btrfs features, in that errors can be known because all filesystem content is checksummed." It would be helpful if the developers of btrfs and ZFS could work together to create a single kernel module, with maximal sharing of "cleanroom" code, that implemented both filesystems... Oracle is itself unwilling to settle these questions with either a GPL or BSD license release of ZFS. Oracle also delivers a btrfs implementation that is lacking in features, with inapplicable documentation, and out-of-date support tools (for CentOS 8 conversion). Oracle is the impediment, and a community effort to purge ZFS source of Oracle's contributions and unify it with btrfs seems the most straightforward option... It would also be helpful if other parties refrained from new filesystem efforts that lack the extensive btrfs functionality and feature set (i.e. Microsoft ReFS). Until such a day that an advanced filesystem becomes a ubiquitous commodity as Linux is as an OS, the user community will continue to be torn between questionable support, lack of features, and workarounds in a fragmented btrfs community. This is an uncomfortable place to be, and we would do well to remember the parties responsible for keeping us here. So how do Slashdot's readers feel about btrfs?' -- source: https://linux.slashdot.org/story/20/10/24/0146258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Patched an Actively-Exploited Zero-Day Bug in Chrome
by Peter Reutemann 25 Oct '20

25 Oct '20

'"Google released an update to its Chrome browser that patches a zero-day vulnerability in the software's FreeType font rendering library that was actively being exploited in the wild, Threatpost reported this week: Security researcher Sergei Glazunov of Google Project Zero discovered the bug which is classified as a type of memory-corruption flaw called a heap buffer overflow in FreeType. Glazunov informed Google of the vulnerability on Monday. Project Zero is an internal security team at the company aimed at finding zero-day vulnerabilities. By Tuesday, Google already had released a stable channel update, Chrome version 86.0.4240.111, that deploys five security fixes for Windows, Mac & Linux — among them a fix for the zero-day, which is being tracked as CVE-2020-15999 and is rated as high risk. "Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild," Prudhvikumar Bommana of the Google Chrome team wrote in a blog post announcing the update Tuesday... "The fix is also in today's stable release of FreeType 2.10.4," Ben Hawkes, technical lead for the Project Zero team, tweeted. Meanwhile, security researchers took to Twitter to encourage people to update their Chrome browsers immediately to avoid falling victim to attackers aiming to exploit the flaw... In addition to the FreeType zero day, Google patched four other bugs — three of high risk and one of medium risk — in the Chrome update released this week... So far in the last 12 months Google has patched three zero-day vulnerabilities in its Chrome browser.' -- source: https://it.slashdot.org/story/20/10/25/029202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Caught Exempting Google Sites From User Requests To Delete Data
by Peter Reutemann 25 Oct '20

25 Oct '20

'This week the Verge reported: If you ask Chrome to delete all cookies and site data whenever you quit the browser, it's reasonable to expect that this policy applies to all websites. Recently, though, a bug in the browser meant data wasn't being removed for two sites in particular: Google and YouTube. This problem was first documented by iOS developer Jeff Johnson on his blog. Johnson found that in Chrome version 86.0.4240.75, "local storage" data for Google.com and YouTube.com stuck around even after restarting the browser. We've been able to replicate similar behavior... The Register notes that Chrome's behavior could allow Google to stash cookie-style data as site data, allowing it to track users even when they think they're being careful by deleting their cookie and site data every time they close the browser. In a statement, Google said it was aware of the issue and was working on a fix... At least one of the affected sites, YouTube, appears to have already been fixed. After we upgraded the Chrome browser to version 86.0.4240.111, YouTube's local storage data seems to successfully purge after a restart, although the data from Google.com still sticks around.' -- source: https://tech.slashdot.org/story/20/10/25/0155246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Options For ps
by Lawrence D'Oliveiro 25 Oct '20

25 Oct '20

One look at the man page for ps(1) <https://man7.org/linux/man-pages/man1/ps.1.html> and you see all the different traditional option syntaxes it tries to be compatible with. The BSD style doesn’t even prefix options with dashes, which can lead to ambiguities and is best avoided. If this is what you’re used to, try to wean yourself off it. To list some useful info about all processes, you can do ps -ef or, for even more info, try ps -eF One thing I find annoying about this it reports less precision in process start times for long-running processes. To get around this, you can use a custom format. For example ps -eo pid,ppid,lstart,tty,etime,cmd shows some similar info to the default “-f” format, but always includes start time and elapsed time to the nearest second, regardless of how long the process has been running. Another useful command to use with ps is pgrep(1) <https://man7.org/linux/man-pages/man1/pgrep.1.html>, which lets you filter processes to get information for according to various criteria. Or you could just use grep(1) on the output from ps, as I suspect a lot of people do. ;)

1 1

Debian Donates 10,000 Euros to Fund Free and Decentralized Livestreaming
by Peter Reutemann 25 Oct '20

25 Oct '20

'PeerTube (developed by Framasoft) is "the free and decentralized alternative to video platforms, providing you over 400,000 videos published by 60,000 users and viewed over 15 million times," according to its web site. But now they're exploring livestreaming, writes Debian developer Phil Hands (Slashdot reader #2,365): Holding DebConf20 online this year highlighted the effort involved in setting up Live Streaming using Free Software — something that is beyond the reach of many smaller events which is where PeerTube with Live Streaming should be a perfect fit. In June PeerTube had posted a roadmap with a humble request for donations in lieu of a crowdfunding campaign: At a time when no one knows what the future holds, we deem it inappropriate to start a crowdfunding campaign and threaten not to do our best on PeerTube if we don't get the necessary funds. We believe in the public utility of PeerTube, so much so that we commit to working on it for six months to make this v3 happen, even if we must do it with our own funds (which we had already done for v2). We still hope that by sharing this roadmap as widely as possible, some of you will support us in our approach with a donation that will allow us to fund this project. And this week PeerTube's official Twitter feed announced that "Thanks to Debian's €10,000 donation we've just reached the 4th step of our PeerTube fundraising" — livestreaming. "Many thanks to all those who donated. And it's not too late to contribute." "We hope this unconventional gesture from the Debian project will help us make this year somewhat less terrible," added the Debian blog, "and give us, and thus humanity, better Free Software tooling to approach the future." It describes their donation as "a strong sign of recognition from an international project — one of the pillars of the Free Software world — towards a small French association which offers tools to liberate users from the clutches of the web's giant monopolies." And secondly, "it's a substantial amount of help in these difficult times, supporting the development of a tool which equally belongs to and is useful to everyone. The strength of Debian's gesture proves, once again, that solidarity, mutual aid and collaboration are values which allow our communities to create tools to help us strive towards Utopia."' -- source: https://linux.slashdot.org/story/20/10/24/010213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WHO To Grant Wikipedia Free Use of Its Published Material To Combat Covid Misinformation
by Peter Reutemann 23 Oct '20

23 Oct '20

'As part of efforts to stop the spread of false information about the coronavirus pandemic, Wikipedia and the World Health Organization announced a collaboration on Thursday: The health agency will grant the online encyclopedia free use of its published information, graphics and videos. The collaboration is the first between Wikipedia and a health agency. From a report: "We all consult just a few apps in our daily life, and this puts W.H.O. content right there in your language, in your town, in a way that relates to your geography," said Andrew Pattison, a digital content manager for the health agency who helped negotiate the contract. "Getting good content out quickly disarms the misinformation." Since its start in 2001, Wikipedia has become one of the world's 10 most consulted sites; it is frequently viewed for health information. The agreement puts much of the W.H.O.'s material into the Wikimedia "commons," meaning it can be reproduced or retranslated anywhere, without the need to seek permission -- as long as the material is identified as coming from the W.H.O. and a link to the original is included. "Equitable access to trusted health information is critical to keeping people safe and informed," said Tedros Adhanom Ghebreyesus, the W.H.O.'s director general. His agency translates its work into six official languages, which do not include, for example, Hindi, Bengali, German or Portuguese, so billions of people cannot read its documents in their native or even second language. Wikipedia articles, by contrast, are translated into about 175 languages. The first W.H.O. items used under the agreement are its "Mythbusters" infographics, which debunk more than two dozen false notions about Covid-19. Future additions could include, for example, treatment guidelines for doctors, said Ryan Merkley, chief of staff at the Wikimedia Foundation, which produces Wikipedia. If the arrangement works out, it could be extended to counter misinformation regarding AIDS, Ebola, influenza, polio and dozens of other diseases, Mr. Merkley said, "But this was something that just had to happen now." Eventually, live links will be established that would, for example, update global case and death numbers on Wikipedia as soon as the W.H.O. posts them, Mr. Pattison said.' -- source: https://news.slashdot.org/story/20/10/22/1833243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

Firefox 'Site Isolation' Feature Enters User Testing, Expected Next Year
by Peter Reutemann 23 Oct '20

23 Oct '20

'Site Isolation is a modern browser security feature that works by separating each web page and web iframes in their own operating system process in order to prevent sites from tampering or stealing with each other's data. The feature was first deployed with Google Chrome in mid-2018, with the release of Chrome 67. Although initially, Site Isolation was meant to be deployed as a general improvement to Chrome's security posture, the feature came just in time to serve as a protective measure against the Spectre vulnerability impacting modern CPUs. Seeing the feature's success, Mozilla also announced plans to support it with the Firefox browser in February 2019, as part of an internal project codenamed Fission. For both Google and Mozilla, implementing Site Isolation was a time-consuming operation, requiring engineers to re-write large chunks of their browsers' internal architecture. The process took about two years for both Google and Mozilla. While Site Isolation is now a stable feature inside Chrome, this work is now nearing its completion inside Firefox. According to an update to the Project Fission wiki page, Site Isolation can now be enabled inside versions of Firefox Nightly, the Firefox version where new features are tested.' -- source: https://news.slashdot.org/story/20/10/22/1717203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 20.10 'Groovy Gorilla' is Here With Renewed Raspberry Pi Focus
by Peter Reutemann 23 Oct '20

23 Oct '20

'As stated earlier, new Ubuntu versions come April and October, and wouldn't you know it, we are at the end of the latter. With Halloween a bit more than a week away, Canonical today releases Ubuntu 20.10. Ubuntu's version numbering scheme is based on year (YY), a period, and the month (MM). For instance, the previous stable version was released this past April and it is numbered as 20.04. In addition, Canonical (the operating system's owner) assigns names -- sequentially and alphabetically. The alphanumeric code name is always based on two words starting with the same sequential letter -- an adjective followed by an animal name. The aforementioned 20.04 is named "Focal Fossa." This time, the operating system will be called Ubuntu 20.10 "Groovy Gorilla." This new version of the desktop operating system is loaded with fixes, new features, and a renewed focus on the now-iconic Raspberry Pi. Yes, folks, with a compatible Pi (models with 4GB or 8GB of RAM), you can now have the full Ubuntu desktop experience.' -- source: https://news.slashdot.org/story/20/10/22/1737224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vector Instructions: Everything Old Is New Again
by Lawrence D'Oliveiro 22 Oct '20

22 Oct '20

This article <https://www.sigarch.org/simd-instructions-considered-harmful/> (linked from <https://www.theregister.com/2020/10/21/sifive_vector_cpu_core/>) goes into how RISC-V implements vector instructions, and how this differs from the conventional SIMD approach taken by existing architectures like x86, ARM and MIPS. These CPUs add instructions that can operate on two, four or eight operands at once, in parallel. One drawback is that every new data type (and every new extension to dealing with greater parallelism) requires a new set of instructions, and so we a massive growth in the size of instruction sets for these machines over time. And then there is the trickiness of generating code using these instructions: even though you mostly leave it to the compiler to worry about this sort of thing nowadays, it still involves the generation of complicated sequences to set up a loop and deal with odd numbers of operands that don’t fit into the exact multiples that the instructions can deal with. So you wonder why a small sequence of source code can generate a whole lot of machine code. RISC-V, on the other hand, hearkens back to the grand-daddy of vector machines, the original Cray supercomputer family from the 1970s and 1980s. Here you have a vector-length register, which tells the CPU how many operands you have. You then set up operand pointer registers and write basically one instruction that operates on a single set of operands, and leave it to the hardware to automatically repeat this operation the required number of times, batching the iterations up to whatever size a particular implementation can handle in parallel. So the same code can run unchanged on future hardware with more parallel function units, and automatically take advantage of the greater performance.

1 0

TrueNAS R-series hyperconverged appliances blend storage and compute
by Peter Reutemann 22 Oct '20

22 Oct '20

'Today, storage vendor iXsystems is launching a new R-series hyperconverged infrastructure appliance for its TrueNAS product line—and the first alpha release of TrueNAS SCALE, a Debian Linux-based version of the TrueNAS storage distribution. The new R-series appliances are designed to run either traditional, FreeBSD-based TrueNAS, or the new Debian-based TrueNAS SCALE. The series launches with four models—all rack-mounted—ranging from the 1U, 16-bay TrueNAS R10 to the up to 12U, 52 bay TrueNAS R50. All four models offer Ethernet connectivity up to dual 100GbE, as well as optional dual 32Gb Fibre Channel and Intel Xeon CPUs. The three larger models are expandable via separate JBOD shelves as well. TrueNAS itself is an OpenZFS-based storage distribution, which can be purchased preinstalled on NAS hardware or installed by users on their own generic PC equipment. It offers users the rich feature set of the ZFS filesystem—including block-level checksums and data healing, advanced storage topologies, atomic COW snapshots, rapid asymmetric replication, and more—along with a broad range of network sharing protocols, including SMB, NFS, sFTP, and iSCSI.' -- source: https://arstechnica.com/gadgets/2020/10/ixsystems-launches-new-hyperconverg… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Fears 'Collateral Damage' in Google Antitrust Case
by Peter Reutemann 22 Oct '20

22 Oct '20

'Mozilla has responded to the U.S. Department of Justice's antitrust lawsuit against Google, but rather than commending the DOJ's action, the Firefox browser maker has voiced concerns that its commercial partnership could make it "collateral damage" in the fight against Google's alleged monopolistic practices. From a report: The DOJ, with support from 11 U.S. states, confirmed yesterday that it is suing Google for allegedly violating anti-competition laws by crowding out rivals in the internet search and advertising markets. "Small and independent companies such as Mozilla thrive by innovating, disrupting, and providing users with industry-leading features and services in areas like search," Mozilla chief legal officer Amy Keating wrote in a blog post. "The ultimate outcomes of an antitrust lawsuit should not cause collateral damage to the very organizations -- like Mozilla -- best positioned to drive competition and protect the interests of consumers on the web." Mozilla has a long and complicated history with Google. In recent years, Mozilla has launched countless privacy campaigns against the internet giant's various online properties, and just last month it introduced a new browser add-on to crowdsource research into YouTube's opaque recommendation algorithm. On the other hand, Mozilla relies heavily on royalties from a search engine partnership with Google. The duo recently extended their deal to make Google the default search engine inside Firefox in the U.S. and other markets, which will reportedly secure Mozilla up to $450 million over the next three years.' -- source: https://news.slashdot.org/story/20/10/21/1633207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Releases Chromium-Based Edge Preview For Linux
by Peter Reutemann 21 Oct '20

21 Oct '20

'Last month, Microsoft officials said they'd release a preview of the new Chromium-based Edge browser for Linux some time in October. On October 20, Microsoft made good on the promise, making available the Edge Dev Channel build for Linux. ZDNet reports: The new release supports Ubuntu, Debian, Fedora and openSUSE Linux distributions. Microsoft is planning to release weekly builds, like it does with the Dev Channel builds for other platforms. To get started, users can download and install a .deb or .rpm package directly from the Edge Insider site, which will configure a system to get future automatic updates. Or users can install Edge from Microsoft's Linux Software Repository. More detailed instructions are available on Microsoft's Chredge-on-Linux blog post. ' -- source: https://linux.slashdot.org/story/20/10/20/2144234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Seven Mobile Browsers Vulnerable To Address Bar Spoofing Attacks
by Peter Reutemann 21 Oct '20

21 Oct '20

'In a report published today by cyber-security firm Rapid7, the company said it worked with Pakistani security researcher Rafay Baloch to disclose ten new address bar spoofing vulnerabilities across seven mobile browser apps. From a report: Impacted browsers include big names like Apple Safari, Opera Touch, and Opera Mini, but also niche apps like Bolt, RITS, UC Browser, and Yandex Browser. The issues were discovered earlier this year and reported to browser makers in August. The big vendors patched the issues right away, while the smaller vendors didn't even bother replying to the researchers, leaving their browsers vulnerable to attacks. "Exploitation all comes down to 'JavaScript shenanigans'," said Rapid7's Research Director, Tod Beardsley. The Rapid7 exec says that by messing with the timing between when the page loads and when the browser gets a chance to refresh the address bar URL, a malicious site could force the browser to show the wrong address.' -- source: https://tech.slashdot.org/story/20/10/20/1850252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0