- wlug - list.wlug.org.nz

Backblaze Hard Drive Stats Q3 2020
by Peter Reutemann 21 Oct '20

21 Oct '20

'Backblaze's Q3 2020 hard drive stats: As of September 30, 2020, Backblaze had 153,727 spinning hard drives in our cloud storage ecosystem spread across four data centers. Of that number, there were 2,780 boot drives and 150,947 data drives. This review looks at the Q3 2020 and lifetime hard drive failure rates of the data drive models currently in operation in our data centers and provides a handful of insights and observations along the way. [...] There are several models with zero drive failures in the quarter. That's great, but when we dig in a little we get different stories for each of the drives. The 18TB Seagate model (ST18000NM000J) has 300 drive days and they've been in service for about 12 days. There were no out of the box failures which is a good start, but that's all you can say. The 16TB Seagate model (ST16000NM001G) has 5,428 drive days which is low, but they've been around for nearly 10 months on average. Still, I wouldn't try to draw any conclusions yet, but a quarter or two more like this and we might have something to say. The 4TB Toshiba model (MD04ABA400V) has only 9,108 drive days, but they have been putting up zeros for seven quarters straight. That has to count for something. The 14TB Seagate model (ST14000NM001G) has 21,120 drive days with 2,400 drives, but they have only been operational for less than one month. Next quarter will give us a better picture. The 4TB HGST (model: HMS5C4040ALE640) has 274,923 drive days with no failures this quarter.' -- source: https://hardware.slashdot.org/story/20/10/20/1927247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Adblockers Installed 300,000 Times Are Malicious and Should Be Removed Now
by Peter Reutemann 21 Oct '20

21 Oct '20

'Adblocking extensions with more than 300,000 active users have been surreptitiously uploading user browsing data and tampering with users' social media accounts thanks to malware its new owner introduced a few weeks ago, according to technical analyses and posts on Github. Hugo Xu, developer of the Nano Adblocker and Nano Defender extensions, said 17 days ago that he no longer had the time to maintain the project and had sold the rights to the versions available in Google's Chrome Web Store. Xu told me that Nano Adblocker and Nano Defender, which often are installed together, have about 300,000 installations total. Four days ago, Raymond Hill, maker of the uBlock Origin extension upon which Nano Adblocker is based, revealed that the new developers had rolled out updates that added malicious code. The first thing Hill noticed the new extension doing was checking if the user had opened the developer console. If it was opened, the extension sent a file titled "report" to a server at https://def.dev-nano.com/. "In simple words, the extension remotely checks whether you are using the extension dev tools -- which is what you would do if you wanted to find out what the extension is doing," he wrote. The most obvious change end users noticed was that infected browsers were automatically issuing likes for large numbers of Instagram posts, with no input from users. Cyril Gorlla, an artificial intelligence and machine learning researcher at the University of California in San Diego, told me that his browser liked more than 200 images from an Instagram account that didn't follow anyone. The screenshot to the right shows some of the photos involved.' -- source: https://it.slashdot.org/story/20/10/20/2116228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Surface Duo review—Orphaned Windows hardware makes a poor Android device
by Peter Reutemann 20 Oct '20

20 Oct '20

'After one of the strangest run-ups to launch in smartphone history, the Microsoft Surface Duo is here. Microsoft's first-ever Android phone (sorry, we're not counting the Nokia X) was announced and demoed an entire year before its release, hinting at what a long and winding road the Surface Duo took from inception to shipping. The hardware apparently dates back to plans to revitalize Windows for phones, but after that plan fell through, the hardware was upcycled into the most head-scratching Android phone of the year. The Surface Duo sales pitch is that foldable display technology isn't ready yet, so try this best-we-can-do-right-now version that features two rigid, 5.6-inch OLED displays attached together with a 360 hinge. Microsoft is calling this a "productivity" device thanks to it having the side-by-side app capability of a tablet-style foldable smartphone without any of the janky display technology. Microsoft's website also says the Duo was designed to "inspire people to rethink how they want to use the device in their pocket," indicating that the company definitely sees this as a primary device. I bring up Microsoft's sales pitch because, boy, is the Surface Duo bad at doing the things Microsoft says it's supposed to be good at. The phone feels like it was made without any respect to ergonomics, hand size, pocket-size, or anything that makes a good Android phone. It has crippling productivity problems that negate any benefit you could get from the two-screen design, it's extremely awkward in day-to-day use, and it's very buggy. The phone is missing a whole host of features you would expect for the stratospheric $1400 asking price, and even the hardware that is here seems like it's a least a year old. The Surface Duo feels like a phone that was slapped together without a plan, and the reports of the phone's history indicate that's what actually happened. We would like to gently welcome Microsoft to the Android ecosystem, but we are not grading $1400 smartphones on a curve. Microsoft needed to knock this out of the park. Instead, the company turned in a borderline incompetent smartphone that I really had to force myself to use during the review period.' -- source: https://arstechnica.com/gadgets/2020/10/surface-duo-review-orphaned-windows… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chat goes free in 2021, while Hangouts loses features this month
by Peter Reutemann 20 Oct '20

20 Oct '20

'With the rise of Google Chat, Google Hangouts is going to die. Google initially announced this all the way back in 2018, and now we're getting more details about the service's slow shutdown and transition plans for the services that rely on it. We've already seen Hangouts lose location sharing and SMS support, and in the blog post, Google announced that phone calls, Google Fi support, and Google Voice support will soon be stripped away from the service.' -- source: https://arstechnica.com/gadgets/2020/10/google-chat-goes-free-in-2021-while… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fancy Bear imposters are on a hacking extortion spree
by Peter Reutemann 20 Oct '20

20 Oct '20

'Ransomware attacks that tear through corporate networks can bring massive organizations to their knees. But even as these hacks reach new popularity highs—and new ethical lows—among attackers, it's not the only technique criminals are using to shake down corporate victims. A new wave of attacks relies instead on digital extortion—with a side of impersonation. On Wednesday, the Web security firm Radware published extortion notes that had been sent to a variety of companies around the world. In each of them, the senders purport to be from the North Korean government hackers Lazarus Group, or APT38, and Russian state-backed hackers Fancy Bear, or APT28. The communications threaten that if the target doesn’t send a set number of bitcoin—typically equivalent to tens or even hundreds of thousands of dollars—the group will launch powerful distributed denial of service attacks against the victim, walloping the organization with a fire hose of junk traffic strategically directed to knock it offline. This type of digital extortion—give us what we’re asking for and we won’t attack you—has resurfaced repeatedly throughout the last decade. But in recent months, criminals have attempted to capitalize on fear about high-profile nation-state attacks, combined with anxieties related to rising ransomware attacks, to try to make some extra money.' -- source: https://arstechnica.com/information-technology/2020/10/fancy-bear-imposters… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers are using a severe Windows bug to backdoor unpatched servers
by Peter Reutemann 20 Oct '20

20 Oct '20

'One of the most critical Windows vulnerabilities disclosed this year is under active attack by hackers who are trying to backdoor servers that store credentials for every user and administrative account on a network, a researcher said on Friday. Zerologon, as the vulnerability has been dubbed, gained widespread attention last month when the firm that discovered it said it could give attackers instant access to active directories, which admins use to create, delete, and manage network accounts. Active directories and the domain controllers they run on are among the most coveted prizes in hacking, because once hijacked, they allow attackers to execute code in unison on all connected machines. Microsoft patched CVE-2020-1472, as the security flaw is indexed, in August. On Friday, Kevin Beaumont, working in his capacity as an independent researcher, said in a blog post that he had detected attacks on the honeypot he uses to keep abreast of attacks hackers are using in the wild. When his lure server was unpatched, the attackers were able to use a powershell script to successfully change an admin password and backdoor the server.' -- source: https://arstechnica.com/information-technology/2020/10/hackers-are-using-a-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Foundation Launches Compute Module 4 for Industrial Users
by Peter Reutemann 20 Oct '20

20 Oct '20

'The Raspberry Pi Foundation is launching a new product today -- the Compute Module 4. From a report: If you've been keeping an eye on the Raspberry Pi releases, you know that the flagship Raspberry Pi 4 was released in June 2019. The Compute Module 4 features the same processor, but packed in a compute module for industrial use cases. A traditional Raspberry Pi is a single-board computer with a ton of ports sticking out. Compute Modules are somewhat different. Those system-on-module variants are more compact single-board computers without any traditional port. It lets you create a prototype using a traditional Raspberry Pi, and then order a bunch of Compute Modules to embed in your commercial products. "Over half of the seven million Raspberry Pi units we sell each year go into industrial and commercial applications, from digital signage to thin clients to process automation," Eben Upton wrote on the Raspberry Pi blog. Some things are strictly similar between the Raspberry Pi 4 and the Compute Module 4, such as the 64-bit ARM-based processor with VideoCore VI graphics. This is going to represent a huge upgrade for previous Compute Module customers. In particular, you get much better video performance with 4Kp60 hardware decode for H.265 videos, 1080p60 hardware decode for H.264 videos, 1080p30 hardware encode of H.264 videos. You can also take advantage of the dual HDMI interfaces to connect up to two 4K displays at 60 frames per second.' -- source: https://tech.slashdot.org/story/20/10/19/175255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Three npm Packages Opened Remote-Access Shells on Linux and Windows Systems
by Peter Reutemann 19 Oct '20

19 Oct '20

'"Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code," reports ZDNet. "According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects." The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations. The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others. All three packages were uploaded on the npm portal in May (first) and September 2018 (last two). Each package had hundreds of downloads since being uploaded on the npm portal. The packages names were: plutov-slack-client nodetest199 nodetest1010 "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.' -- source: https://it.slashdot.org/story/20/10/18/2321208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.10 Solves the Year 2038 Problem Until 2486
by Peter Reutemann 19 Oct '20

19 Oct '20

'The Linux 5.10 kernel's XFS file-system will have two new on-disk meta-data capabilities, reports Phoronix: 1. The size of inode btrees in the allocation group is now recorded. This is for increasing redundancy checks and also allowing faster mount times. 2. Support for timestamps now until the year 2486. This "big timestamps" feature is the refactoring of their timestamp and inode encoding functions to handle timestamps as a 64-bit nanosecond counter and bit shifting to increase the effective size. This now allows XFS to run well past the Year 2038 problem (where storing the time since 1970 in seconds will no longer fit in a signed 32-bit integer and thus wraparound) to now the Year 2486. Making a new XFS file-system with bigtime enabled allows a timestamp range from December 1901 to July 2486 rather than December 1901 to January 2038. For preserving backwards compatibility, the big timestamps feature is not currently enabled by default. ' -- source: https://linux.slashdot.org/story/20/10/17/2237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash Hackers’ Wiki
by Lawrence D'Oliveiro 18 Oct '20

18 Oct '20

Found this useful collection of Bash tips and tricks. May not be all that well maintained, but I found some handy pages, like this list <https://wiki.bash-hackers.org/scripting/bashchanges> of the more interesting features that were introduced in the various versions of Bash. I was looking for something like this because the Bash version in my Debian Unstable installations was just upgraded to 5.1.

1 0

Need A New Computer For Homeschooling? How About a 2007-Vintage MacBook?
by Lawrence D'Oliveiro 17 Oct '20

17 Oct '20

PC sales have been given a boost by, among other things, the need for schooling the young ones from home, but there’s no reason why they need the latest and greatest hardware for this. How about something from over a decade ago? Here a long-time collector of same <https://www.theregister.com/2020/10/16/need_a_new_computer_for/> reports how Apple-branded gear from that era can be obtained quite cheaply, is a lot easier to service and upgrade than the current stuff, and while it is not supported by current versions of Apple’s own OS, something like Linux will work just fine. That way you get a modern web browser, and enough grunt to stream video. What more could you ask for?

1 0

Quote Of The Week: The State Of Microsoft
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

>From this <https://forums.theregister.com/forum/all/2020/10/15/microsoft_adopting_goog…> reader comment: ... today's Microsoft users really are left with best guesses [as to what their software is doing]. It's sad that web searches reveal that everybody's first concern on [Macs]/Linux is installing 3rd party things, but the first concern for everybody on Windows is uninstalling 1st party things. Ironically, nobody on Windows seems to use the term "jailbreak” ... ... yet.

1 0

Should Windows Move To A Linux Kernel?
by Lawrence D'Oliveiro 16 Oct '20

16 Oct '20

An engineer at Canonical has poured cold water <https://www.theregister.com/2020/10/15/even_2020_cannot_bring_forth/> over the suggestion by Eric Raymond that Microsoft might move to substituting a Linux kernel over its own in the Windows OS. Sure, the idea seems complicated and expensive, and very likely troublesome, too. But since when have Windows upgrades not been troublesome? Even updates between different versions of what is ostensibly all the same OS, Windows 10, have been far from smooth lately. Attempting the level of compatibility needed for every Win32 API and syscall would be a huge undertaking. Consider that the WINE folks have already provided a usable fraction of this, with resources that are only a drop in the bucket compared to those available to Microsoft. And as for the vast array of drivers enjoyed by the NT kernel, Barnes reckoned that shunting them into Linux would cost millions. Sure. But would it cost as much as having to continue maintaining them? Particularly since most of those drivers would not be needed, because Linux already has its own native ones. Furthermore, rebasing Windows on Linux could have the ironic effect of stifling competition should a kernel monoculture take hold. Interesting to discuss this use of the term “monoculture”. Linux is already adaptable to a wider range of platforms and applications than Windows can manage. This in spite of the fact that the Windows NT kernel has been fragmented into a number of different versions, including about 5 or 6 different ones for ARM, with little or no compatibility between them. Linux is able to manager better interoperability than that, even between versions for entirely different architectures.

1 0

Google and Intel Warn of High-Severity Bluetooth Security Bug In Linux
by Peter Reutemann 15 Oct '20

15 Oct '20

'An anonymous reader quotes a report from Ars Technica: Google and Intel are warning of a high-severity Bluetooth flaw in all but the most recent version of the Linux Kernel. While a Google researcher said the bug allows seamless code execution by attackers within Bluetooth range, Intel is characterizing the flaw as providing an escalation of privileges or the disclosure of information. The flaw resides in BlueZ, the software stack that by default implements all Bluetooth core protocols and layers for Linux. Besides Linux laptops, it's used in many consumer or industrial Internet-of-things devices. It works with Linux versions 2.4.6 and later. So far, little is known about BleedingTooth, the name given by Google engineer Andy Nguyen, who said that a blog post will be published "soon." A Twitter thread and a YouTube video provide the most detail and give the impression that the bug provides a reliable way for nearby attackers to execute malicious code of their choice on vulnerable Linux devices that use BlueZ for Bluetooth. Intel, meanwhile, has issued this bare-bones advisory that categorizes the flaw as privilege-escalation or information-disclosure vulnerability. The advisory assigned a severity score of 8.3 out of a possible 10 to CVE-2020-12351, one of three distinct bugs that comprise BleedingTooth. "Potential security vulnerabilities in BlueZ may allow escalation of privilege or information disclosure," the advisory states. "BlueZ is releasing Linux kernel fixes to address these potential vulnerabilities." Intel, which is a primary contributor to the BlueZ open source project, said that the most effective way to patch the vulnerabilities is to update to Linux kernel version 5.9, which was published on Sunday. Those who can't upgrade to version 5.9 can install a series of kernel patches the advisory links to. Maintainers of BlueZ didn't immediately respond to emails asking for additional details about this vulnerability. Ars Technica points out that since BleedingTooth requires proximity to a vulnerable device, there's not much reason for people to worry about this vulnerability. "It also requires highly specialized knowledge and works on only a tiny fraction of the world's Bluetooth devices," it adds.' -- source: https://it.slashdot.org/story/20/10/15/0043232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.20 Released
by Peter Reutemann 15 Oct '20

15 Oct '20

'KDE's Plasma 5.20 is now available, bringing a bunch of refinements as well as some larger features. Some of the KDE Plasma 5.20 highlights include (via Phoronix): - Numerous fixes to the KWin window manager / compositor including a number of Wayland fixes. Among the Wayland work in Plasma 5.20 includes Klipper support and middle-click paste, mouse and touchpad support nearly on par to X11, window thumbnails in the task manager, crash fixes, and more. - Improved notifications. - Different redesigns and additions to the KDE System Settings from SMART monitoring to better looking interfaces. - Redesigned on-screen displays. - Various tack manager and system tray improvements. ' -- source: https://tech.slashdot.org/story/20/10/14/0058213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom To Roll Out End-to-End Encrypted (E2EE) Calls
by Peter Reutemann 15 Oct '20

15 Oct '20

'Video conferencing platform Zoom announced today plans to roll out end-to-end encryption (E2EE) capabilities starting next week. From a report: E2EE will allow Zoom users to generate individual encryption keys that will be used to encrypt voice or video calls between them and other conference participants. These keys will be stored locally and will not be shared with Zoom servers, meaning the software company won't be able to access or intercept any ongoing E2EE meetings. Support for E2EE calls will first be part of Zoom clients to be released next week. To use the new feature, users must update theri clients next week and enable support for E2EE calls at the account level. This green shield will contain a lock if E2EE is active. If the lock is absent, Zoom will use its default AES 256-bit GCM encryption scheme, which the company uses to secure current communications, but which the company can also intercept.' -- source: https://yro.slashdot.org/story/20/10/14/1722237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WordPress Versus Jamstack
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

Welcome to a new buzzword: “Jamstack”, which stands for “JavaScript, APIs and HTML Markup”. Or, in other words, websites made up of static pages, with all the dynamism implemented by JavaScript running on the browser. Hmm, maybe not quite all--that “APIs” part does still imply server-side dynamism of some sort. Seems the founder of WordPress is less than keen on the idea. WordPress, of course, is built very heavily around PHP code doing dynamic things (like reading and writing databases) server-side. Maybe the difference between the two is more one of degree and centralization rather than anything hard-and-fast. <https://www.theregister.com/2020/10/13/wordpress_matt_vs_netlify_matt/>

1 0

Oh, Those Lascivious Sinful Onions ...
by Lawrence D'Oliveiro 14 Oct '20

14 Oct '20

A seed company had one of its ads banned by Facebook after the image in it was deemed to contain “overtly sexual positioning”. To the normal human eye it just looks like a picture of some onions. Not even the most depraved imagination seems incapable of conjuring more than that out of it. Judge for yourself <https://www.theregister.com/2020/10/13/in_brief_ai/> ...

1 0

Meeting next Monday
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Due to labour day, our next (and last meeting before the AGM) will be next Monday already. Ian will talk a few minutes about his experience upgrading his Ubuntu to 20.04.1. However, we could do with additional content. Suggestions? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Notepad++/Windows -> Notepadqq/Linux
by Peter Reutemann 13 Oct '20

13 Oct '20

Hi everyone Today, I was looking for a (graphical) text editor that could search through a directory structure and replace a particular string in lots of config files. Just using find in conjunction with sed wasn't gonna cut it, as I needed to inspect each individual file first (but then do a single subversion commit covering all the files). While searching on alternativeto.net for an alternative to Notepad++, using this URL: https://alternativeto.net/software/notepad-plus-plus/ I came across Notepadqq, which had the desired functionality: https://notepadqq.com/ Just like Notepad++, it also has syntax highlighting for lots of different file types. It's great to have such a wide variety of editors out there! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Long-term WLUG member featured in a good-news article
by Eric Light 13 Oct '20

13 Oct '20

Hi everyone! I apologise if this isn't appropriate here (it does verge on a political post), but I noticed a familiar name in The Spinoff today. Most of you will know Roderick Aldridge from his membership in the WLUG over the years. It's been quite nice to see his writing on non-technical issues as well. https://thespinoff.co.nz/society/12-10-2020/im-80-years-old-ive-never-touch… Thanks Roderick :) E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

2 1

Linux 5.9 Boosts CPU Performance With FSGSBASE Support
by Peter Reutemann 13 Oct '20

13 Oct '20

'FSGSBASE support in Linux "has the possibility of helping Intel/AMD CPU performance especially in areas like context switching that had been hurt badly by Spectre/Meltdown and other CPU vulnerability mitigations largely on the Intel side," Phoronix wrote back in August. As it started its journey into the kernel, they provided a preview on August 10: The FSGSBASE support that was finally mainlined a few days ago for Linux 5.9 is off to providing a nice performance boost for both Intel and AMD systems... FSGSBASE support for the Linux kernel has been around a half-decade in the making and finally carried over the finish line by one of Microsoft's Linux kernel engineers... FSGSBASE particularly helps out context switching heavy workloads like I/O and allowing user-space software to write to the x86_64 GSBASE without kernel interaction. That in turn has been of interest to Java and others...On Linux 5.9 where FSGSBASE is finally mainlined, it's enabled by default on supported CPUs. FSGSBASE can be disabled at kernel boot time via the "nofsgsbase" kernel option. Today on the Linux kernel mailing list, Linus Torvalds announced the release of Linux 5.9: Ok, so I'll be honest - I had hoped for quite a bit fewer changes this last week, but at the same time there doesn't really seem to be anything particularly scary in here. It's just more commits and more lines changed than I would have wished for. And Phoronix reported: Linux 5.9 has a number of exciting improvements including initial support for upcoming Radeon RX 6000 "RDNA 2" graphics cards, initial Intel Rocket Lake graphics, NVMe zoned namespaces (ZNS) support, various storage improvements, IBM's initial work on POWER10 CPU bring-up, the FSGSBASE instruction is now used, 32-bit x86 Clang build support, and more. See our Linux 5.9 feature overview for the whole scoop on the many changes to see with this kernel.' -- source: https://linux.slashdot.org/story/20/10/12/0029215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple's T2 Security Chip Has an Unfixable Flaw
by Peter Reutemann 13 Oct '20

13 Oct '20

'A recently released tool is letting anyone exploit an unusual Mac vulnerability to bypass Apple's trusted T2 security chip and gain deep system access. The flaw is one researchers have also been using for more than a year to jailbreak older models of iPhones. But the fact that the T2 chip is vulnerable in the same way creates a new host of potential threats. Worst of all, while Apple may be able to slow down potential hackers, the flaw is ultimately unfixable in every Mac that has a T2 inside. From a report: In general, the jailbreak community haven't paid as much attention to macOS and OS X as it has iOS, because they don't have the same restrictions and walled gardens that are built into Apple's mobile ecosystem. But the T2 chip, launched in 2017, created some limitations and mysteries. Apple added the chip as a trusted mechanism for securing high-value features like encrypted data storage, Touch ID, and Activation Lock, which works with Apple's "Find My" services. But the T2 also contains a vulnerability, known as Checkm8, that jailbreakers have already been exploiting in Apple's A5 through A11 (2011 to 2017) mobile chipsets. Now Checkra1n, the same group that developed the tool for iOS, has released support for T2 bypass. On Macs, the jailbreak allows researchers to probe the T2 chip and explore its security features. It can even be used to run Linux on the T2 or play Doom on a MacBook Pro's Touch Bar. The jailbreak could also be weaponized by malicious hackers, though, to disable macOS security features like System Integrity Protection and Secure Boot and install malware. Combined with another T2 vulnerability that was publicly disclosed in July by the Chinese security research and jailbreaking group Pangu Team, the jailbreak could also potentially be used to obtain FileVault encryption keys and to decrypt user data. The vulnerability is unpatchable, because the flaw is in low-level, unchangeable code for hardware. "The T2 is meant to be this little secure black box in Macs -- a computer inside your computer, handling things like Lost Mode enforcement, integrity checking, and other privileged duties," says Will Strafach, a longtime iOS researcher and creator of the Guardian Firewall app for iOS. "So the significance is that this chip was supposed to be harder to compromise -- but now it's been done."' -- source: https://apple.slashdot.org/story/20/10/12/1854254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Five-Eyes Nations + Japan, India Ask Big Tech To Bake Backdoors Into Everything
by Lawrence D'Oliveiro 12 Oct '20

12 Oct '20

The abovementioned nations have issued a joint statement <https://www.theregister.com/2020/10/11/international_statementon_end_to_end…> where they “urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content”. One of the ways to do this is “Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight”. To the extent that this is not calling for restrictions on strong encryption altogether, merely on its wide adoption by certain large companies, I can live with it. Just so long as we are not forced into using the products and services provided by these companies as an inescapable part of our daily lives.

1 0

The Unreasonable Effectiveness Of The Julia Programming Language
by Lawrence D'Oliveiro 10 Oct '20

10 Oct '20

A report from the recent JuliaCon <https://arstechnica.com/science/2020/10/the-unreasonable-effectiveness-of-t…>: Six years ago, I wrote in these pages about the enduring prominence of Fortran for scientific computing and compared it with several other languages. I ended that article with a prediction that, in 10 years, a new language called Julia stood a good chance of becoming the one that scientists would turn to when tackling large-scale numerical problems. My prediction was not very accurate, though. It actually only took Julia about half that time. He goes on to talk about the “two-language problem” and the “expression problem”, and how Julia solves these through its “multiple-dispatch” feature. A key point is that, even with all these advanced features, it manages to maintain program speed close to that of C++.

1 0

controlling network manager from the console
by Peter Reutemann 08 Oct '20

08 Oct '20

Hi everyone For a project at work, I'm working with a Nvidia Jetson Nano (https://www.nvidia.com/en-us/autonomous-machines/embedded-systems/jetson-na…) In order to get it hooked up to the wireless network, I came across the following tutorial: https://learn.sparkfun.com/tutorials/adding-wifi-to-the-nvidia-jetson/all The interesting tidbit in this article was the "nmcli" tool (https://linux.die.net/man/1/nmcli) to control the network manager from the console. Really neat! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Botched Excel Import May Have Caused Loss Of 15,841 UK COVID-19 Cases
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Looks like someone tried to load a file of nationwide Coronavirus test results into Microsoft Excel, and exceeded its maximum-row limit <https://arstechnica.com/tech-policy/2020/10/excel-glitch-may-have-caused-uk…>. The omission has since been fixed.

1 2

Free Software Foundation Turns 35
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

<https://www.theregister.com/2020/10/06/fsf_35/>: The FSF is keen that all should don their sandals and share in the celebration, perhaps by trying out an approved GNU/Linux distribution, or switching out a proprietary app like Microsoft Office for LibreOffice, or Adobe Photoshop for the GNU Image Manipulation Program. Heck, one could even have a crack at GNU Emacs and celebrate a keyboard shortcut or two.

1 0

Python 3.9 Is Out
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

Worth noting from <https://devclass.com/2020/10/06/python-3_9/>: * Merging of dictionaries with “|” and “|=” operators * Generics in type hints * General expressions now allowed in decorators (I didn’t actually realize there were restrictions before) * New PEG parser, with option to revert to old parser for now (not that I expect to notice any difference between the two) * Deprecation of features for Python 2 backward compatibility (to be removed altogether in 3.10)

1 0

Oracle vs Google Goes To The US Supreme Court
by Lawrence D'Oliveiro 07 Oct '20

07 Oct '20

The US Supreme Court is due to hear Google’s appeal tomorrow <https://arstechnica.com/tech-policy/2020/10/google-asks-supreme-court-to-ov…> against the CAFC ruling that APIs are copyrightable and that Google infringed Oracle’s copyright on the Java APIs. A few companies (including GitHub) have filed “amicus curiae” briefs explaining why allowing the verdict against Google to stand will have unfortunate consequences for the entire software industry. The CAFC (Court of Appeals for the Federal Circuit) is a notoriously “intellectual-property-friendly” court, shall we say. They wouldn’t even have got the chance to rule on the original verdict by Judge Alsup, except that the suit initially included a patent claim (that was very quickly thrown out). Definite points to Oracle’s lawyers for doing this: like a chess strategy where you advance a seemingly unimportant pawn in the opening moves that is immediately sacrificed, but the long-term consequences for your opponent’s position only become apparent some time later in the game.

1 0

Developers Are Managing 100× More Code Than They Were 10 Years Ago
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

This survey <https://arstechnica.com/gadgets/2020/10/sourcegraph-devs-are-managing-100x-…> reports on the explosion in typical source code bases that seems to have occurred over the past decade. I have a couple of concerns with this: * The obvious quantity-versus-quality issue. How much of this is due to things like node.js pulling in hundreds of dependencies for a comparatively small class library? Clearly, “managing” does not mean “writing” or even “maintaining”. * The use of “technology” as some kind of synonym for “information technology”. You mean it didn’t require “technology” to conduct insurance, retail, food and beverage businesses before? After all, pencil and paper are “technologies”, too. And if you think they are easy things to make, well ... try making them yourself. </rant>

1 0

What Operating Systems Keep Things Running In Space?
by Lawrence D'Oliveiro 05 Oct '20

05 Oct '20

Nice report <https://arstechnica.com/features/2020/10/the-space-operating-systems-bootin…> going into some details on the proprietary VxWorks (popular with NASA) and the open-source RTEMS (originating from the US military, now heavily used by ESA). Also mentions SpaceChain, which was developed in order to implement a BitCoin network in space. This is based on Sylix, which comes from the Chinese military, but is now open-source as well. And there is some use of Linux, but only in situations where hard-realtime constraints can be guaranteed by lower-level custom hardware. Summary: VxWorks and RTEMS are pretty much identical in basic features and maturity/reliability, but RTEMS does have an edge in configurability.

1 0

DigitalOcean’s “Hacktoberfest” Backfires
by Lawrence D'Oliveiro 03 Oct '20

03 Oct '20

Cloud company Digital Ocean has started its seventh annual “Hacktoberfest” <https://www.theregister.com/2020/10/01/digitalocean_hacktoberfest_pull_requ…>, promising free T-shirts to those who submit “quality” pull requests to online open-source repositories. Seems this year, the “quality” proviso is being roundly ignored. Many project maintainers are being deluged with trivial and pointless patches, many of whose submittors readily admit they are only doing it for the T-shirt. Choice quote: Imagine an arsonist declaring, "Only you can prevent forest fires," and you can get a sense of the frustration among open source maintainers. Actually, I’m surprised this hasn’t happened in previous years. But then again, maybe it has: "Hacktoberfest has never generated anything of value for open source ... It’s a marketing stunt which sends a deluge of low-effort contributions to maintainers, leaving them to clean up the spam." There’s also a link to a rather pungently-named Twitter account which is collecting examples of these useless patch submissions.

2 1

Developers Try Again To Upstream Motorola 68000 Series Support In LLVM
by Peter Reutemann 01 Oct '20

01 Oct '20

'Hobbyist developers are trying once again to get a Motorola 68000 back-end merged into the upstream LLVM compiler. Phoronix reports: The Motorola 68000 series processors have been around since the 80's thanks to the likes of the early Apple Macintosh computers. Fast forward to 2020, the Motorola 68000 is still a popular target for vintage computer enthusiasts and hobbyists. Community developers have worked on improving the Linux kernel support for M68k hardware like early Apple Powerbooks as recently as a few years ago and the compiler support is a continued target. GCC 11 due out next year was looking to drop the M68k target over its unmaintained status. Hobbyists though stepped up there so the M68k support will remain in GCC. Now developers are also looking at adding M68k support to the LLVM compiler. This isn't the first time that M68k support for LLVM has been brought up albeit never successfully landed to date. Building off the past failures to get the Motorola 68000 series support upstreamed, developers last week sent out new patches proposing this back-end -- this time they are showing more clarity about the developers involved and being committed to supporting the code, the sustainability of the code, and responding quickly to code review comments. This patch series is the latest attempt at upstreaming Motorola 68000 series support in LLVM. Besides all the back-end specific code there is also some common LLVM code changes that fall under greater scrutiny. ' -- source: https://hardware.slashdot.org/story/20/09/30/225226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Xen Project Officially Ports Its Hypervisor To Raspberry Pi 4
by Peter Reutemann 30 Sep '20

30 Sep '20

'The Xen Project has ported its hypervisor to the 64-bit Raspberry Pi 4. The Register reports: The idea to do an official port bubbled up from the Xen community and then reached the desk of George Dunlap, chairman of the Xen Project's Advisory Board. Dunlap mentioned the idea to an acquaintance who works at the Raspberry Pi Foundation, and was told that around 40 percent of Pis are sold to business users rather than hobbyists. With more than 30 million Arm-based Pis sold as of December 2019, and sales running at a brisk 600,000-plus a month in April 2020, according to Pi guy Eben Upton, Dunlap saw an opportunity to continue Xen's drive towards embedded and industrial applications. Stefano Stabellini, who by day works at FPGA outfit Xilinx, and past Apache Foundation director Roman Shaposhnik took on the task of the port. The pair clocked that the RPi 4's system-on-chip used a regular GIC-400 interrupt controller, which Xen supports out of the box, and thought this was a sign this would, overall, be an easy enough job. That, the duo admitted, was dangerous optimism. Forget the IRQs, there was a whole world of physical and virtual memory addresses to navigate. The pair were "utterly oblivious that we were about to embark on an adventure deep in the belly of the Xen memory allocator and Linux address translation layers," we're told. [The article goes on to explain the hurdles that were ahead of them.] "Once Linux 5.9 is out, we will have Xen working on RPi4 out of the box," the pair said. [...] Stefano Stabellini told The Register that an official Xen-on-RPi port will make a difference in the Internet-of-Things community, because other Arm development boards are more costly than the Pi, and programmers will gravitate towards a cheaper alternative for prototyping. He also outlined scenarios, such as a single edge device running both a real-time operating system alongside another OS, each dedicated to different tasks but inhabiting the same hardware and enjoying the splendid isolation of a virtual machine rather than sharing an OS as containers. George Dunlap also thinks that an official Xen-on-RPi port could also be of use to home lab builders, or perhaps just give developers a more suitable environment for their side projects than a virtual machine or container on their main machines. Stay tuned to Project EVE's Github page for more details about how to build your own Xen-for-RPi. Hacks to get it up and running should also appear on the Xen project blog.' -- source: https://hardware.slashdot.org/story/20/09/29/2025213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cloudflare's Privacy Crusade Continues With a Challenge To Google Analytics
by Peter Reutemann 30 Sep '20

30 Sep '20

'Fortune: Cloudflare is launching a privacy-friendly rival to Google Analytics. Google Analytics is a free toolkit that's used by website administrators across the globe to help them track the behavior of the people visiting those sites -- how they find them, what they do there, the devices they're using, and so on. However, the service -- the most popular of its kind -- also helps Google track websites' visitors, so it can better profile them for advertising purposes. This privacy-invasive aspect makes many people squeamish. And that's where Cloudflare would now like to step in. Around its birthday every year, the decade-old company -- which went public last year -- announces a move intended to "give back" to the wider Internet community. These moves are often related to privacy. On Tuesday, it unveiled Cloudflare Web Analytics, a free-to-use toolkit that largely replicates what Google Analytics offers -- minus the invasive tracking, and thus the ability to assess the performance of targeted ads carried on websites. Cloudflare Web Analytics is immediately available to the company's paid customers, but any website owner will be able to use it from some point in the coming months. Cloudflare's scale is crucial here [...] because it takes substantial resources to run a free analytics platform, and Cloudflare already has a giant network that can support the load. Cloudflare Web Analytics isn't the company's only big announcement this week. "On Monday, Cloudflare launched a beta testing program for a cloud technology called Durable Objects," the report adds. "You can read the technical explanation here, but in essence this is a tool that allows developers of online services to make those services comply with the increasing number of data-localization and data-protection laws that limit where users' data is supposed to go." "With Durable Objects, Cloudflare says, it is possible to specify where particular data will reside on Cloudflare's network, so -- for example -- a German user's data does not have to leave Germany. Or, with an eye to other current news, a service such as TikTok could ensure that U.S. users' data never leaves the U.S., without having to create a separate version of its service for that country." ' -- source: https://tech.slashdot.org/story/20/09/29/2011226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 17 Android Apps Caught Engaging In WAP Billing Fraud
by Peter Reutemann 30 Sep '20

30 Sep '20

'Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected. Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run. Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains. ' -- source: https://tech.slashdot.org/story/20/09/28/236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu - Online upgrade to 20.04.1 now available
by Ian Stewart 29 Sep '20

29 Sep '20

Hi All, I mentioned last night at the WLUG meeting that there had been a delay in releasing the Ubuntu 18.04 to 20.04.1 online upgrade. As of today, the Focal Fossa (20.04.1 LTS) Point-Release Status Tracking webpage<https://discourse.ubuntu.com/t/focal-fossa-20-04-1-lts-point-release-status…> is still showing Status 20.04.1 Released! Upgrades from 18.04 to 20.04.1 still disabled ...but with... Upgrade blockers None Previously two bugs, 1891680<https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1891680> and 1876506<https://bugs.launchpad.net/ubuntu/focal/+source/os-prober/+bug/1876506> had been shown as the "upgrade blockers". These bugs were fixed in the last few weeks. Despite the above message, today on my Ubuntu Mate 18.04 laptop, I ran the GUI application "Software Updater". When it completed it stated: The software on this computer is up to date. However, Ubuntu 20.04.1 LTS is now available (you have 18.04). I clicked on "Upgrade". There were 384 new packages to install and 1547 packages to upgrade requiring about 1.4GB of downloading. On my rather slow 1.4GHz CPU, but with reasonably fast internet and a SSD it took 50 minutes to do the upgrade. cheers, Ian. PS: The upgrade kept my python Version 2 at V2.7.18 and upgraded Python3 to 3.8.2. If I had done a fresh install from DVD/USB of Ubuntu 20.04.1 it would not have installed Python 2.

1 0

Eric S. Raymond: Is Microsoft Switching To a Linux Kernel That Emulates Windows?
by Peter Reutemann 28 Sep '20

28 Sep '20

'Most of Microsoft's money now comes from its cloud service Azure, points out open-source advocate Eric S. Raymond. Now he posits a future where Windows development will "inevitably" become a drag on Microsoft's business: So, you're a Microsoft corporate strategist. What's the profit-maximizing path forward given all these factors? It's this: Microsoft Windows becomes a Proton-like emulation layer over a Linux kernel, with the layer getting thinner over time as more of the support lands in the mainline kernel sources. The economic motive is that Microsoft sheds an ever-larger fraction of its development costs as less and less has to be done in-house. If you think this is fantasy, think again. The best evidence that it's already the plan is that Microsoft has already ported Edge to run under Linux. There is only one way that makes any sense, and that is as a trial run for freeing the rest of the Windows utility suite from depending on any emulation layer. So, the end state this all points at is: New Windows is mostly a Linux kernel, there's an old-Windows emulation over it, but Edge and the rest of the Windows user-land utilities don't use the emulation. The emulation layer is there for games and other legacy third-party software. Economic pressure will be on Microsoft to deprecate the emulation layer... Every increment of Windows/Linux convergence helps with that — reduces administration and the expected volume of support traffic. Eventually, Microsoft announces upcoming end-of-life on the Windows emulation. The OS itself , and its userland tools, has for some time already been Linux underneath a carefully preserved old-Windows UI. Third-party software providers stop shipping Windows binaries in favor of ELF binaries with a pure Linux API... ...and Linux finally wins the desktop wars, not by displacing Windows but by co-opting it. Perhaps this is always how it had to be.' -- source: https://linux.slashdot.org/story/20/09/27/193250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU is Not Unix Emacs Developers (Including Richard Stallman) Discuss How to Build a More 'Modern' Emacs
by Peter Reutemann 27 Sep '20

27 Sep '20

'LWN.net re-visits the emacs-devel mailing list, where the Emacs 28 development cycle has revived discussions about how to make the text editor more "modern" and attractive to new users: A default dark theme may not be in the future, leading one to think that there may yet be hope for the world in general. But there does seem to be general agreement that Emacs could benefit from a better, more centralized approach to color themes, rather than having color names hard-coded throughout various Elisp packages. From that, a proper theme engine could be supported, making dark themes and such easily available to those who want them... Another area where Emacs is insufficiently "modern", it seems, has to do with keyboard and mouse bindings. On the keyboard side, users have come to expect certain actions from certain keystrokes; ^X to cut a selection, ^V to paste it, etc. These bindings are easily had by turning on the Cua mode, but new users tend not to know about this mode or how to enable it. Many participants in the discussion said that this mode should be on by default. That, of course, would break the finger memory of large numbers of existing Emacs users, who would be unlikely to appreciate the disruption. Or, as Richard Stallman put it: It is not an option to change these basic key bindings to imitate other, newer editors. It would create a different editor that we Emacs users would never switch to. It is unfortunate that the people who implemented the newer editors chose incompatibility with Emacs.... The situation with mouse behavior is similar; as several participants in the discussion pointed out, users of graphical interfaces have come to expect that a right-button click will produce a menu of available actions. In Emacs, instead, that button marks a region ("selection"), with a second click in the same spot yanking ("cutting") the selected text. Many experienced Emacs users have come to like this behavior, but it is surprising to newcomers. The right mouse button with the control key held down does produce a menu defined by the current major mode, but that is evidently not what is being requested here; that menu, some say, should present global actions rather mode-specific ones. Stallman suggested offering a "reshuffled mode" that would bring the context menu to an unadorned right-button click, and which would add some of the expected basic editing commands there as well. This would be relatively easy to do, he said, since mouse bindings are separate from everything else. Besides, as he noted, the current mouse behavior was derived from "what was the standard in X Windows around 1990"; while one wouldn't want to act in haste, it might just be about time for an update. Other proposed changes involved "discoverability," including the default enabling of various modes, although to incorporate them into GNU Emacs "would often require the author to sign copyrights over to the Free Software Foundation, which is not something all authors are willing to do..."' -- source: https://news.slashdot.org/story/20/09/25/2213230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored Developer Creates 'DOS Subsystem For Linux'
by Peter Reutemann 27 Sep '20

27 Sep '20

'iTnews: A software engineer in Melbourne is whiling away the city's lockdown by creating a tool that DOS users so far have lacked: an integrated Linux environment similar to what Windows 10 users enjoy... "I first started out just seeing if I could get Linux booting from the DOS command line, and that turned out to be straightforward enough so I thought it'd be fun to see if I could continue executing DOS once Linux was running," Charlie Somerville said. "I'm mostly surprised by how smoothly the whole thing works given how *dodgy* it all is haha," he added. DOS Subsystem for Linux runs a real copy of MS-DOS under the QEMU virtual machine, and starts up from that, Somerville said... "Helpfully Linux seems to leave the first megabyte of memory (where DOS lives) intact during its own boot process, so it's just a matter of jumping back to the right place to continue DOS execution," he added. Somerville had it pointed out to him that this approach of running DOS under vm8086 is actually how early Windows worked. "Kinda cool to rediscover the technique so many years later," Somerville said.' -- source: https://linux.slashdot.org/story/20/09/26/048223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 81 Released, Can Now Be Your Default Browser in iOS
by Peter Reutemann 27 Sep '20

27 Sep '20

'Engadget reports: One big benefit of iOS 14 is that you can set non-Apple-made apps as your default, including for email and web browsing. Hot on the heels of you being able to set Chrome and Gmail as your clients of choice, Firefox is enabling you to make its browser the default on iPhones and iPads. Naturally, you'll need to have both the latest version of the operating system and the apps, and then just make the switch inside settings. Meanwhile, Bleeping Computer profiles some of the new features in this week's release of Firefox 81, including: The ability to control videos via your headset and keyboard even if you're not using Firefox at the time - A new credit card autofill feature for Firefox users in the U.S. and Canada - A new theme called AlpenGlow - Firefox can now be set as the default system PDF viewer' -- source: https://news.slashdot.org/story/20/09/26/0454229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug Allowed Hijacking Other Firefox Mobile Browsers on the Same Wi-Fi Network
by Peter Reutemann 27 Sep '20

27 Sep '20

'"Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same Wi-Fi network and force users to access malicious sites, such as phishing pages," reports ZDNet: The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab. The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device). When devices are found, the Firefox SSDP component gets the location of an XML file where that device's configuration is stored. However, Moberly discovered that in older versions of Firefox, you could hide Android "intent" commands in this XML and have the Firefox browser execute the "intent," which could be a regular command like telling Firefox to access a link... The bug was fixed in Firefox 79; however, many users may not be running the latest release. Firefox for desktop versions were not impacted. ' -- source: https://news.slashdot.org/story/20/09/26/0443215 Chers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

killedbygoogle.com
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Came across this <https://killedbygoogle.com/> little hall of -- shame? sadness? quiet desperation? schadenfreude? -- listing projects that Google created and later abandoned, or is in the process of abandoning. Found it in a reader comment to this report <https://www.theregister.com/2020/09/23/google_sunsets_chrome_web_store/> on the death of Chrome Web Store payments. By the way: Neighbourly is dead? I keep seeing mentions of neighbourly.co.nz in the local free papers -- is that different?

3 2

Facebook “Took A Page From Big Tobacco’s Playbook”
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Some former Facebook employees are testifying to the US Congress <https://arstechnica.com/tech-policy/2020/09/former-facebook-manager-we-took…> as part of a hearing into the role social media platforms play in spreading extremist and radical content. Tim Kendall, former director of monetization, says: “We took a page form Big Tobacco’s playbook, working to make our offering addictive at the outset.” After making some more direct comparisons with how tobacco companies made their product more addictive, he talked about “engagement”, which was the measure Facebook tried to maximize above all else: “We initially used engagement as sort of a proxy for user benefit,” Kendall explained. “But we also started to realize that engagement could also mean [users] were sufficiently sucked in that they couldn’t work in their own best long-term interest to get off the platform... We started to see real-life consequences, but they weren’t given much weight. Engagement always won, it always trumped.” If a company becomes large and powerful, and cannot be trusted to exercise that power responsibly, then it must be taken from them.

1 0

Researchers Found the Manual For the World's Oldest Surviving Computer
by Peter Reutemann 24 Sep '20

24 Sep '20

'Researchers will be able to gain a deeper understanding of what's considered the world's oldest surviving (digital) computer after its long-lost user manual was unearthed. Engadget reports: The Z4, which was built in 1945, runs on tape, takes up most of a room and needs several people to operate it. The machine now takes residence at the Deutsches Museum in Munich, but it hasn't been used in quite some time. An archivist at ETH Zurich, Evelyn Boesch, discovered the manual among her father's documents in March, according to retired lecturer Herbert Bruderer. Rene Boesch worked with the Swiss Aeronautical Engineering Association, which was based at the university's Institute for Aircraft Statics and Aircraft Construction. The Z4 was housed there in the early 1950s. Among Boesch's documents were notes on math problems the Z4 solved that were linked to the development of the P-16 jet fighter. "These included calculations on the trajectory of rockets, on aircraft wings, on flutter vibrations [and] on nosedive," Bruderer wrote in a Association of Computing Machinery blog post.' -- source: https://hardware.slashdot.org/story/20/09/23/2058222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Wikipedia is getting a new look for the first time in 10 years. Here’s why.
by Peter Reutemann 24 Sep '20

24 Sep '20

'In order to make the desktop experience more readable and less overwhelming to new users, Wikipedia is being redesigned to move page elements, collapse in the sidebar, and decrease the maximum line width. From Diff, the Wikimedia community blog: Forthcoming changes to the desktop include a reconfigured logo, collapsible sidebar, table of contents, and more! You can see the full list of new features on MediaWiki. These changes will happen incrementally over a long period of time, to allow for ample user testing and feedback. If all goes to plan, these improvements will be the default on all wikis by the end of 2021, timed with Wikipedia's 20th birthday celebrations.' -- source: https://news.slashdot.org/story/20/09/23/1822218 Link to gallery of images that show the differences/new features: https://www.mediawiki.org/wiki/Reading/Web/Desktop_Improvements#What_featur… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 24 Sep '20

24 Sep '20

Hi everyone We have a meeting next Monday, but no topic/speaker yet. Any ideas? Maybe some bash scripting or some useful command-line utilities? I came across "pigz" (https://linux.die.net/man/1/pigz) today by accident... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

“LokiBot,” the malware that steals your most sensitive data, is on the rise
by Peter Reutemann 24 Sep '20

24 Sep '20

'Federal and state officials are seeing a big uptick in infections coming from LokiBot, an open source DIY malware package for Windows that’s openly sold or traded for free in underground forums. It steals passwords and cryptocurrency wallets, and it can also download and install new malware. In an alert published on Tuesday, the Department of Homeland Security’s Cybersecurity and Infrastructure Agency and the Multi-State Information Sharing & Analysis Center said LokiBot activity has scaled up dramatically in the past two months. The increase was measured by “EINSTEIN,” an automated intrusion-detection system for collecting, correlating, analyzing, and sharing computer security information across the federal civilian departments and agencies. “CISA has observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020,” Tuesday’s alert stated. “Throughout this period, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected persistent malicious LokiBot activity.”' -- source: https://arstechnica.com/information-technology/2020/09/lokibot-the-malware-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo begins selling OEM Ubuntu PCs to the general public
by Peter Reutemann 24 Sep '20

24 Sep '20

'Beginning today, Lenovo is offering a greatly expanded selection of OEM Linux PCs to the general public. Earlier this year, Lenovo began offering Fedora Linux pre-installed on laptop systems including Thinkpad P1 Gen 2, Thinkpad P53, and Thinkpad X1 Gen 8. Today's announcement makes Ubuntu Linux available on a considerably broader swath of both desktop and laptop PCs.' -- source: https://arstechnica.com/gadgets/2020/09/lenovo-launches-new-oem-linux-think… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0