- wlug - list.wlug.org.nz

Chrome and Edge Rise In Popularity. Firefox, Opera, and Safari Drop.
by Peter Reutemann 04 Aug '20

04 Aug '20

'July's statistics from web analytics firm Net Applications showed continuing changes in the most frequently-used web browsers. Softpedia reports: Last month, Google Chrome increased its market share from 70.19% to 71.00%, while Microsoft Edge jumped from 8.07% to 8.46%... The migration to the Chromium engine allowed Microsoft to turn Edge into a cross-platform browser, and this is one of the reasons that contributed to the growth of the new app. Edge is now available not only on Windows 10, but also on Windows 7, Windows 8, Windows 8.1, and even macOS. At the same time, Microsoft is also working on a Linux version of the browser, and a preview build is expected by the end of the year. But what made Microsoft Edge the second most-used desktop browser out there so fast after the switch to Chromium is definitely Microsoft offering it as the default browser in Windows 10. But what about Firefox? And Opera, and Apple's Safari? Computerworld reports: A decade ago, Mozilla's browser may have dreamed of upsetting the then-order of things, taking its April 2010 share of 25.1% and parlaying it into victory over IE — down to 61.2% by then... But that was Firefox's peak. At the end of July, Firefox stood at 7.3%, down three-tenths of a percentage point from the previous month... Firefox let its second-place spot (far, far behind Chrome) slip away in March, when Edge snatched it. That did not change in July. The gap between the two more than doubled, in fact, to 1.2 points. On almost every browser share metric, Firefox is in trouble... Since the end of January, Firefox has been stuck in the 7s; for the eight months before that, it was mired in the 8s; and between May 2018 and March 2019, Firefox floundered in the 9s. The trend is crystal clear... Elsewhere in Net Applications' numbers, Apple's Safari plunged to 3%, a loss of six-tenths of a point, its lowest mark since late 2008. Opera software's Opera also took a dive, ending July at 0.8%, a decline of three-tenths of a point. Those numbers have to be frightening to both those browsers' makers.' -- source: https://news.slashdot.org/story/20/08/03/028217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Package management mistake borking some Ubuntu machines running WireGuard
by Eric Light 04 Aug '20

04 Aug '20

Morning folks! For those who watch WireGuard, Jason Donenfeld is giving the Canonical kernel team a damn roasting after they bungled a Provides statement in about half of their Linux kernel manifests... which borks certain systems running WireGuard. For example, systems with the linux-image-oem kernel will try to install the linux-image-gke kernel (meant for the Google Kubernetes Engine), in order to receive the wireguard-modules package, leading to Proper Breakage. Donenfeld: "I'll note that this is at least the third time Canonical has forgotten the "Provides:" line for kernel packages. I'd highly recommend they put some time into double checking their procedures. [...] Usually things go quite a bit better with the WireGuard side of things, but this seems pretty par for the course with _Ubuntu_ and Canonical's kernel team. We've had perpetual issues over the last 6 months with getting Canonical to release high quality packages in a timely manner. A pretty large portion of my time is spent dealing with these bugs and Ubuntu in general." Looks like Canonical's kernel packaging team are already working on it, after Jason Donenfeld escalated a bug report earlier this morning. E -------------------------------------------- Q: Why is this email five sentences or less? A: http://five.sentenc.es

1 0

Red Hat Security Update Renders Systems Unbootable
by Peter Reutemann 04 Aug '20

04 Aug '20

'A recently released Red Hat update for the BootHole Vulnerability (firehose link) is causing systems to become unbootable. It is widely reported that updates to the shim, grub2 and kernel packages in RHEL and CentOS 7 and 8 are leaving various systems that use secure boot unbootable. Current recommendations are to avoid updating your system until the issue is resolved, or at least avoid updating the shim, grub2 and kernel packages. Update, shared by PAjamian: Red Hat is now recommending that users do not apply grub2, fwupd, fwupdate or shim updates until new packages are available.' -- source: https://linux.slashdot.org/story/20/07/31/158212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

5 4

O/T: Waikato-based laptop repairer
by David McNab 01 Aug '20

01 Aug '20

Hi all, Apologies for being slightly off-topic. Does anyone know of a computer repairer in/around Hamilton, who can do board-level troubleshooting and repair on laptops, without having to "send it to Auckland"? I've got a Gigabyte i7 laptop which became unable to charge its battery a couple of years ago. I was able to run it plugged into the mains since then. But just now, it won't even start up at all. I'd like someone to do some quick tests to determine if it's a feasible repair and, if so, give a cost estimate. Oh, but it was running Ubuntu, so not completely off-topic ;) All suggestions appreciated Cheers David

1 0

Allowing PBL'ed IP addresses in Postfix
by David McNab 31 Jul '20

31 Jul '20

Hi, Has anyone had experience with configuring Postfix to allow inbound client SMTP connections from NZ-based IP addresses that have been Policy Block Listed (PBL'ed) by their ISP? Spark have PBL'ed most or all of their home and small business fibre/*DSL connection IP addresses. 2degrees have PBL'ed most/all of their cellular data IP addresses. I'm trying to support a user to send email from their cellphone email client. Cheers David

4 5

Bug In Grub2 Breaks Secure Boot (Yawn)
by Lawrence D'Oliveiro 30 Jul '20

30 Jul '20

Seems a vulnerability has been found in everyone’s favourite bootloader <https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-sec…> which allows a bypass of the “Secure Boot” mechanism in modern UEFI-based machines. But given that so many other bypasses already exist, nobody seems especially worried about this. For example, the article references an attempt by Microsoft to revoke the certification of (an obsolete version of) a secure bootloader from Kaspersky Lab with a vulnerability in it; the revocation caused so many headaches for users that it had to be rolled back.

1 0

NoiseTorch
by Peter Reutemann 28 Jul '20

28 Jul '20

Hi everyone Angus mentioned NoiseTorch at last night's meeting as a way of avoiding noise from being recorded when using microphones: 'NoiseTorch is an easy to use open source application for Linux with PulseAudio. It creates a virtual microphone that suppresses noise, in any application. Use whichever conferencing or VOIP application you like and simply select the NoiseTorch Virtual Microphone as input to torch the sound of your mechanical keyboard, computer fans, trains and the likes.' -- source: https://github.com/lawl/NoiseTorch Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hackers Stole GitHub and GitLab OAuth Tokens From Git Analytics Firm Waydev
by Peter Reutemann 28 Jul '20

28 Jul '20

'Waydev, an analytics platform used by software companies, has disclosed a security breach that occurred earlier this month. From a report: The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database. Waydev, a San Francisco-based company, runs a platform that can be used to track software engineers' work output by analyzing Git-based codebases. To do this, Waydev runs a special app listed on the GitHub and GitLab app stores. When users install the app, Waydev receives an OAuth token that it can use to access its customers' GitHub or GitLab projects. Waydev stores this token in its database and uses it on a daily basis to generate analytical reports for its customers. Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.' -- source: https://tech.slashdot.org/story/20/07/27/1918237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting suggestions?
by Peter Reutemann 26 Jul '20

26 Jul '20

Hi everyone For our first in-person meeting after the lockdown on July 27th, any ideas for topics? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

World’s Fastest Computer Is ARM
by Lawrence D'Oliveiro 26 Jul '20

26 Jul '20

Looking at the June Top500 list <https://top500.org/lists/top500/list/2020/06/>, the current number 1, Japan’s Fugaku, uses over 7 million A64FX cores and close to 5 petabytes of RAM. Numbers 2 and 3 are based on IBM’s POWER architecture, while number 4 is a Chinese RISC-based machine, which might have some resemblance to the DEC Alpha <https://en.wikipedia.org/wiki/Sunway_(processor)>, or MIPS, or not. It’s not until 5th place does x86 make an appearance.

1 0

Popular Chinese-Made Drone Is Found To Have Security Weakness
by Peter Reutemann 24 Jul '20

24 Jul '20

'Cybersecurity researchers revealed on Thursday a newfound vulnerability in an app that controls the world's most popular consumer drones, threatening to intensify the growing tensions between China and the United States. From a report: In two reports, the researchers contended that an app on Google's Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft. The world's largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company's drones over security fears. DJI said the decision was about politics, not software vulnerabilities. For months, U.S. government officials have stepped up warnings about the Chinese government's potentially exploiting weaknesses in tech products to force companies there to give up information about American users. Chinese companies must comply with any government request to turn over data, according to American officials. "Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so," said William R. Evanina, director of the National Counterintelligence and Security Center. "All Americans should be concerned that their images, biometrics, locational and other data stored on Chinese apps must be turned over to China's state security apparatus." The drone vulnerability, said American officials, is the kind of security hole that worries Washington.' -- source: https://it.slashdot.org/story/20/07/23/1437214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
by Lawrence D'Oliveiro 23 Jul '20

23 Jul '20

This paper <http://people.cs.uchicago.edu/%7Eravenben/publications/abstracts/fawkes-use…>, presented at USENIX Security 2020, discusses techniques for allowing you to continue to share images of yourself online while making them resistant to automated exploitation by “deep-learning” facial-recognition software. The researchers found that they could make subtle distortions to facial images, imperceptible to the human eye, that would severely confuse recognition services from major providers like Microsoft and Amazon. (Found from Bruce Schneier <https://www.schneier.com/blog/archives/2020/07/fawkes_digital_.html>.)

1 0

We test Mozilla’s new Wireguard-based $5/mo VPN service
by Peter Reutemann 23 Jul '20

23 Jul '20

'Mozilla, the open source company best known for the Firefox Web browser, made its VPN service generally available in the United States this month. The cross-platform VPN is based on Wireguard and delivered in partnership with well-known and especially techie-friendly VPN provider Mullvad. Mullvad itself was, to the best of our knowledge, the first publicly available VPN provider to offer Wireguard support back in 2017. The Mozilla VPN service costs $4.95 per month and offers server endpoints in 30-plus countries. It currently has VPN clients available for Windows 10, Android, and iOS—but users of other operating systems, such as MacOS and Linux, are going to have to wait. Mozilla says that support for MacOS and Linux is coming soon—but unfortunately, even if you're an advanced user who understands Wireguard configs, you can't just roll your own connection now. The service authenticates via Firefox cloud account. When you sign up for a Mozilla VPN subscription, you'll be asked to create a Firefox account if you don't already have one. The Firefox account is an SSO (Single Sign On) service which uses oauth2, much like a Google account—but it's not tied to a Google account, so even if you sign up using a Gmail address tied to an Android device, that device won't be automatically logged in. Aside from the Firefox-based oauth2 integration, Mozilla's VPN appears to effectively be a Mullvad VPN, with a different client application and different billing entity. It is a bit less expensive through Mozilla, though—Mullvad costs €5 per month. This makes Mozilla's offering about $0.80 per month cheaper, at current exchange rates.' -- source: https://arstechnica.com/gadgets/2020/07/we-test-mozillas-new-wireguard-base… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lambton Property Management Privacy Breach
by Lawrence D'Oliveiro 22 Jul '20

22 Jul '20

A whole bunch of tenants who have had dealings with Lambton Property Management have had their confidential personal details compromised, according to TVNZ <https://www.tvnz.co.nz/one-news/new-zealand/thousands-kiwis-could-have-had-…>, <https://www.tvnz.co.nz/one-news/new-zealand/second-researcher-gains-access-…>. Neither of those articles gives much detail about the nature of the breach, but going to the source <https://cybernews.com/security/new-zealand-property-management-company-leak…> confirms it’s another instance of the all-too-frequent situation of an improperly-secured public cloud area.

1 0

Fwd: [NZLUG] Free intro course
by Peter Reutemann 22 Jul '20

22 Jul '20

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: DL Neil <...> Date: Wed, Jul 22, 2020 at 4:47 PM Subject: [NZLUG] Free intro course To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Video-based course providing a basic introduction to Linux. Video 1. What are Linux, open source software, and a distribution? Video 2. Introduction to the shell Video 3. Kernel and user spaces Video 4. Orientation to the graphical user interface Video 5. File management in Linux Video 6. The file system hierarchy Video 7. Editing files using Vim Video 8. Organizing users and groups Video 9. File permissions Video 10. Managing software Video 11. Configuring networking Video 12. Controlling system startup processes Video 13. Introduction to containers Video 14. Overview of cockpit Video 15. Learning more about Red Hat Enterprise Linux 8 https://www.redhat.com/en/services/training/rh024-red-hat-linux-technical-o… -- Regards, =dn _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Incognito Mode Detection Still Works in Chrome Despite Promise To Fix
by Peter Reutemann 22 Jul '20

22 Jul '20

'Websites are still capable of detecting when a visitor is using Chrome's incognito (private browsing) mode, despite Google's efforts last year to disrupt the practice. From a report: It is still possible to detect incognito mode in Chrome, and all the other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, all of which share the core of Chrome's codebase. Furthermore, developers have taken the scripts shared last year and have expanded support to non-Chrome browsers, such as Firefox and Safari, allowing sites to block users in incognito mode across the board. Currently, there is no deadline for a new Chrome update to block incognito mode detections, however, today, Google might be interested more than ever in fixing this issue' -- source: https://yro.slashdot.org/story/20/06/04/1857211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

SUSE Releases Major Linux Update
by Peter Reutemann 22 Jul '20

22 Jul '20

'SUSE has released the next versions of its flagship operating system, SUSE Linux Enterprise (SLE) 15 Service Pack 2 and its latest infrastructure management program, SUSE Manager 4.1. ZDNet reports: SLE 15 SP2 is available on the x86-64, Arm, IBM POWER, IBM Z, and LinuxONE hardware architectures. This new Linux server edition is based on the Linux 5.3 kernel. This new kernel release includes upstream features such as utilization clamping support in the task scheduler, and power-efficient userspace waiting. Other new and noteworthy features include: - Support for migration from openSUSE Leap to SUSE Linux Enterprise Server (SLES). With this, you can try the free, community openSUSE Linux distro, and then, if you find it's a good choice for your business, upgrade to SLES. - Extended Package Search. By using the new Zypper, SUSE's command line package manager, command option -- zypper search-packages -- sysadmins can now search across all SUSE repositories, even unenabled ones. This makes it easier for administrators to find required software packages. - SLE Software Development Kit (SDK) is now integrated into SLE. Development packages are packaged alongside regular packages. - Python 3: SLE 15 offers full support for Python 3 development. SLE still supports Python 2 for the time being. - 389 Directory Server replaces OpenLDAP as the LDAP directory service. - Repository Mirroring Tool (RMT) replaces Subscription Management Tool (SMT). RMT allows mirroring SUSE repositories and custom repositories. You can then register systems directly with RMT. In environments with tightened security, RMT can also proxy other RMT servers. - Better business continuity with improved SLE Live Patching. SUSE claims Live Patching increases system uptime by up to 12 months. SLE Live Patching is also now available for IBM Z and LinuxONE mainframe architectures. As for SUSE Manager 4.1, this is an improved open-source infrastructure management and automation solution that lowers costs, identifies risk, enhances availability, and reduces complexity in edge, cloud, and data center environments. With SUSE Manager you can keep servers, VMs, containers, and clusters secure, healthy, compliant, and low maintenance whether in private, public, or hybrid cloud. That's especially important these days thanks to coronavirus pandemic IT staff disruptions. SUSE Manager 4.1 can also be used with the Salt DevOps program. Its vertical-market brother, SUSE Manager for Retail 4.1, is optimized and tailored specifically for retail. This release comes with enhancements for small store operations, enhanced offline capabilities and image management over Wi-Fi, and enhanced virtual machine management and monitoring capabilities. Simultaneously it can scale retail environments to tens of thousands of end-point devices and help modernize point-of-service rollouts.' -- source: https://linux.slashdot.org/story/20/07/21/2152237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Brings Procmon To Linux
by Peter Reutemann 21 Jul '20

21 Jul '20

'ProcMon for Linux is Microsoft's newest open-source Linux software. ProcMon is a rewritten and re-imagined version of its Processor Monitor found on Windows within their Sysinternals suite. From a report: Microsoft explains, "The Procmon is a Linux reimagining of the classic Procmon tool from the Sysinternals suite of tools for Windows. Procmon provides a convenient and efficient way for Linux developers to trace the syscall activity on the system."' -- source: https://it.slashdot.org/story/20/07/20/205232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source Code of Covid Tracker Ireland App Goes Global With Linux Project
by Peter Reutemann 21 Jul '20

21 Jul '20

'The Linux Foundation Public Health initiative has chosen the Covid Tracker Ireland app as one of its first two open-source Covid-19 projects. From a report: Since its launch, more than 1.3m people have downloaded the Covid Tracker Ireland app, which was developed to help track the future spread of the coronavirus. Now, the app has been chosen as one of the first two open-source contact-tracing projects by the newly established Linux Foundation Public Health (LFPH) initiative. Nearform, the Waterford-based company that developed the app with the HSE, has been made one of the initiative's seven premium members, along with Cisco, Doc.ai, Geometer, IBM, Tencent and VMware. Under the project name 'Covid Green', the source code of the Irish app is being made available for other public health authorities and their developers across the world to use and customise. As part of the agreement, Nearform will manage the source code repository on GitHub. In its announcement, the LFPH pointed to the "extraordinarily high" adoption rate of the Covid Tracker Ireland app.' -- source: https://linux.slashdot.org/story/20/07/20/168224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

BadPower Attack Corrupts Fast Chargers To Melt or Set Your Device on Fire
by Peter Reutemann 21 Jul '20

21 Jul '20

'Chinese security researchers said they can alter the firmware of fast chargers to cause damage to connected (charging) systems, such as melt the components, or even set devices on fire. Iwastheone shares a report: The technique, named BadPower, was detailed last week in a report published by Xuanwu Lab, a research unit of Chinese tech giant Tencent. According to researchers, BadPower works by corrupting the firmware of fast chargers -- a new type of charger that was developed in the past few years to speed up charging times. A fast charger looks like any typical charger but works using special firmware. This firmware "talks" to a connected device and negotiates a charging speed, based on the device's capabilities. If a fast-charging feature is not supported, the fast charger delivers the standard 5V, but if the device can handle bigger inputs, the fast charger can deliver up to 12V, 20V, or even more, for faster charging speeds. The BadPower technique works by altering the default charging parameters to deliver more voltage than the receiving device can handle, which degrades and damages the receiver's components, as they heat up, bend, melt, or even burn.' -- source: https://tech.slashdot.org/story/20/07/20/1624200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Could Pine64's Cheap Linux Smartphone Replace Your PC?
by Peter Reutemann 20 Jul '20

20 Jul '20

'TechRadar reports on Pine64's new "PinePhone Convergence Package" handset, calling it "a Linux desktop you can keep in your pocket" that can be used as a PC when plugged into an external display and a keyboard. The device costs just $199 and is aimed primarily at Linux enthusiasts. The PinePhone Linux smartphone is based on the Alpine Linux-based PostmarketOS that can be used both in smartphone and desktop modes... The main component that transforms the PinePhone into a PC-like device is its USB-C docking bar that features an HDMI display output, two USB Type-A connectors, and a 10/100Mb Ethernet port. The idea of using a smartphone with an external display and keyboard to run certain applications has not gained much traction neither with HP's Elite x3 Windows Phone 10 handset nor with Samsung's smartphones with its DeX software. Perhaps, since Linux community is generally more inclined to experiment with their gadgets (and their time), Pine64's PinePhone Convergence has a better chance to be actually used as a desktop by its owners. ' -- source: https://linux.slashdot.org/story/20/07/19/2252214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

'Mozilla VPN' Launches in Six Countries
by Peter Reutemann 20 Jul '20

20 Jul '20

'"Starting today, there's a VPN on the market from a company you trust," Mozilla announced Wednesday. Mozilla VPN is now officially available for Windows and Android in six countries: the U.S., Canada, the U.K., Singapore, Malaysia, and New Zealand, and it'll be coming to even more countries later this year, reports the Verge: The service is available for $4.99 a month, and, like other VPNs, it's designed to make your web-browsing more private and secure. As part of the move, the service is being rebranded from Firefox Private Network to Mozilla VPN, a change that was announced last month. Mozilla argues that its VPN service has a couple of advantages over its many competitors. It says it should offer a faster browsing experience in many cases because it's based on a protocol with less than a third of the lines of code of an average VPN service provider. The company is also banking on the reputation it's built up with its privacy-focused browser, and it adds that it only collects the information it needs to run a service and doesn't keep user data logs. The VPN's launch follows beta trials in the US, which also included tests of a VPN built directly into the Firefox browser. Last month, Mozilla announced that it would be testing asking users to pay $2.99 a month for unlimited usage of the extension, which is designed to mask your traffic within the browser rather than at a system-wide level.' -- source: https://tech.slashdot.org/story/20/07/19/0437230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

VPN With 'Strict No-Logs Policy' Exposed Millions of User Log Files
by Peter Reutemann 19 Jul '20

19 Jul '20

'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all." A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.' -- source: https://it.slashdot.org/story/20/07/17/2338230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

LibreOffice Ructions
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

From <https://www.theregister.com/2020/07/16/libreoffice_ecosystem_beyond_utterly…>: Michael Meeks: “Words fail me to express how beyond-utterly-broken the existing TDF / desktop model is for the ecosystem around selling desktop LibreOffice.” As you may know, LibreOffice is overseen by The Document Foundation, which is a charity registered in Germany. And it currently has about €1.5 million in the bank. However, owing to peculiarities of German law (or maybe just the way they are interpreting it), none of that money is actually allowed to be spent on software development.

1 0

The Pros & Cons Of Virtual Meetings
by Lawrence D'Oliveiro 17 Jul '20

17 Jul '20

<https://www.theregister.com/2020/07/16/virtual_internet_governance_meeting_…>: The move to virtual meetings among internet governance bodies has had mixed results ... “Previously, physical intergovernmental meetings were represented by a select few per economy that could afford to travel to these closed-door meetings. Economies with smaller travel budgets and small delegations tend to be at a disadvantage in terms of getting their views adequately represented.” But smaller nations may have another problem: unreliable internet access. ... “In addition, virtual meetings do not lend themselves well to effective ‘corridor chats’, where many private conversations and negotiations take place at the sidelines of the meeting. ...” “Remote participants in a virtual meeting generally come with pre-baked positions that sometimes become intractable due to the lack of opportunities for proper engagement ... [resulting in] the inability to reach a compromise in an effective and efficient manner.”

1 0

New Pine64 phones with upgraded hardware begin shipping in August
by Peter Reutemann 17 Jul '20

17 Jul '20

'Yesterday, Pine64 announced the end of the PinePhone UBPorts Community Edition campaign—but more importantly, the company declared the beginning of the postmarketOS Community Edition campaign. The base version of the new run of PinePhones shares the same $149 price point and the same basic technical specs as the original developer edition—but there's also a new, upgraded "Convergence Package" available at $199. Before anyone gets too excited, we need to make something clear—these devices, while attractively priced, should be considered beta gadgets for tinkerers to experiment and play with. They are not yet fully functional phones, and in their current development status, they are unlikely to be anyone's full-time daily-usage smartphone. The apps don't all work yet—including making calls—and battery life still leaves a lot to be desired.' -- source: https://arstechnica.com/gadgets/2020/07/pine64-launches-postmarketos-editio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 84 Arrives With SameSite Cookie Changes, Web OTP API and Web Animations
by Peter Reutemann 17 Jul '20

17 Jul '20

'Google today launched Chrome 84 for Windows, Mac, Linux, Android, and iOS. Chrome 84 resumes SameSite cookie changes, includes the Web OTP API and Web Animations API, and removes older Transport Layer Security (TLS) versions. [...] First deprecated with Chrome 81 in April, TLS 1.0 and TLS 1.1 have now been completely removed with Chrome 84. This is notable for anyone who manages a website, even if they donâ(TM)t use Chrome at home or at work. TLS is a cryptographic protocol designed to provide communications security over a computer network -- websites use it to secure all communications between their servers and browsers. TLS also succeeds Secure Sockets Layer (SSL) and thus handles the encryption of every HTTPS connection.' -- source: https://it.slashdot.org/story/20/07/16/1444257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA On Securing VPNs
by Lawrence D'Oliveiro 16 Jul '20

16 Jul '20

Bruce Schneier reports <https://www.schneier.com/blog/archives/2020/07/nsa_on_securing.html> on an advisory from the US National Security Agency on how to secure your VPN setup. The document is available in a 10-page or 2-page version. The tips can be summarized as * Reduce the VPN gateway attack surface * Verify on CNSSP-15-compliant algorithms are in use * Avoid using default settings * Remove unused or non-compliant cryptography suites * Apply vendor-provided updates The one about not using default settings I found interesting, the explanation given being that “many vendors provide default configurations, automated configuration scripts, or graphical user interface wizards to aid in the deployment of VPNs”, but that these tools/defaults may prioritize ease of setup over security, and therefore enable extra options that should not be enabled. The longer version gives detailed configuration examples.

1 0

Microsoft urges patching severe-impact, wormable server vulnerability
by Peter Reutemann 16 Jul '20

16 Jul '20

'Microsoft is urgently advising Windows server customers to patch a vulnerability that allows attackers to take control of entire networks with no user interaction and, from there, rapidly spread from computer to computer. The vulnerability, dubbed SigRed by the researchers who discovered it, resides in Windows DNS, a component that automatically responds to requests to translate a domain into the IP address computers need to locate it on the Internet. By sending maliciously formed queries, attackers can execute code that gains domain administrator rights and, from there, take control of an entire network. The vulnerability, which doesn’t apply to client versions of Windows, is present in server versions from 2003 to 2019. SigRed is formally tracked as CVE-2020-1350. Microsoft issued a fix as part of this month's Update Tuesday.' -- source: https://arstechnica.com/information-technology/2020/07/microsoft-urges-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank To Sell ARM?
by Lawrence D'Oliveiro 15 Jul '20

15 Jul '20

Just four years after acquiring it, SoftBank now wants to sell off Arm Holdings, the company that creates (and licenses) designs for ARM chips <https://www.theregister.com/2020/07/14/softbank_considering_arm_sale_report/>. Besides SoftBank’s well-known string of recent investment missteps, there was this interesting quote: Speaking to The Register, one company insider said SoftBank was dissatisfied with Arm's business model and wanted it to charge more for royalties. But if it does that, it just makes alternatives like RISC-V look more competitive.

1 0

Rust Code In The Linux Kernel?
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Looks like several kernel developers, up to and including Linus Torvalds himself, are receptive <https://www.theregister.com/2020/07/13/rust_code_in_linux_kernel/> towards including code written in Mozilla’s Rust language in the Linux kernel. Albeit Torvalds sees it being used, initially at least, in parts “not very central to the kernel itself”, like drivers. A principal feature of Rust is the strict way it manages memory pointers, to limit the scope for common mistakes like memory leaks and double-frees. But unlike other languages like Java, Go or Kotlin, it does not bake the overhead of garbage collection into the language itself. This makes it more suitable for high-performance and lower-level tasks than those languages. More info here: <https://www.rust-lang.org/>.

1 0

Microsoft’s Dotnet Core Runs Better On Linux Than Windows
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Microsoft now has a (pre-release) extension for Visual Studio <https://www.theregister.com/2020/07/13/microsoft_visual_studio_gets_net/> so that you can not only deploy your Dotnet Core application on Linux, you can now debug it on a genuine Linux environment as well, using WSL 2. Mentioned in passing in that report are a couple of stories of developers finding their apps run better on cloud Linux instances than on Windows ones. So it seems the only thing left running on Windows proper is Visual Studio itself.

1 0

Microsoft Dropping PHP For Windows
by Lawrence D'Oliveiro 13 Jul '20

13 Jul '20

I didn’t know that Microsoft had been offering “official” PHP builds for Windows versions up to 7.x, but that is now due to end <https://www.theregister.com/2020/07/10/microsoft_php/>: they will not supply builds for PHP 8.0 or later. Also interesting to note in the article that Windows IIS’ share of the web server market has fallen precipitously lately, and has become a poor third (or even fourth) behind Apache and Nginx. And Google!?

2 1

Linus Torvalds Hopes Intel's AVX-512 'Dies A Painful Death'
by Peter Reutemann 13 Jul '20

13 Jul '20

'"Linux creator Linus Torvalds had some choice words today on Advanced Vector Extensions 512 (AVX-512) found on select Intel processors," reports Phoronix: In a mailing list discussion stemming from the Phoronix article this week on the compiler instructions Intel is enabling for Alder Lake (and Sapphire Rapids), Linus Torvalds chimed in. The Alder Lake instructions being flipped on in GCC right now make no mention of AVX-512 but only AVX2 and others, likely due to Intel pursuing the subset supported by both the small and large cores in this new hybrid design being pursued. The lack of seeing AVX512 for Alder Lake led Torvalds to comment: I hope AVX512 dies a painful death, and that Intel starts fixing real problems instead of trying to create magic instructions to then create benchmarks that they can look good on. I hope Intel gets back to basics: gets their process working again, and concentrate more on regular code that isn't HPC or some other pointless special case. I've said this before, and I'll say it again: in the heyday of x86, when Intel was laughing all the way to the bank and killing all their competition, absolutely everybody else did better than Intel on FP loads. Intel's FP performance sucked (relatively speaking), and it matter not one iota. Because absolutely nobody cares outside of benchmarks. The same is largely true of AVX512 now - and in the future... After several more paragraphs, Torvalds reaches his conclusion. "Stop with the special-case garbage, and make all the core common stuff that everybody cares about run as well as you humanly can." Phoronix notes that Torvalds' comments came "just weeks after he switched to AMD Ryzen Threadripper for his primary development rig."' -- source: https://linux.slashdot.org/story/20/07/12/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Whither Dotnet Core?
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

From <https://www.theregister.com/2020/07/09/net_core_still_a_microsoft/>, people are wondering why there isn’t a greater uptake of Microsoft’s cross-platform, open-source versions of Dotnet and C#: "What's up with non-.NET developers thinking C# is a Windows only, corporate bloatware language? It's not 2005 any more." Yeah, but it’s not clear why we would want *cross-platform* bloatware ...

1 0

“I Am Not A Number!”
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

>From <https://www.theregister.com/2020/07/09/bork/>: Your updated gas balance is: £NaN “We want ... calculation.” “You won’t get it!” “By hook or by crook, we will.”

1 0

Chrome and Firefox Are Getting Support For the New AVIF Image Format
by Peter Reutemann 10 Jul '20

10 Jul '20

'The new lightweight and royalty-free AVIF image format is coming to web browsers. Work is almost complete on adding AVIF support to Google Chrome and Mozilla Firefox. From a report: The new image format is considered one of the lightest and most optimized image compression formats, and has already gained praise from companies such as Netflix, which considers it superior to existing image formats such as JPEG, PNG, and even the newer WebP. The acronym of AVIF stands for AV1 Image File Format. As its name hints, AVIF is based on AV1, which is a video codec that was developed in 2015, following a collaboration between Google, Cisco, and Xiph.org (who also worked with Mozilla). At the time, the three decided to pool their respective in-house video codecs (VPX, Thor, and Daala) to create a new one (AV1) that they planned to offer as an open-source and royalty-free alternative to all the commercial video codecs that had fragmented and clogged the video streaming market in the late 2000s and early 2010s.' -- source: https://news.slashdot.org/story/20/07/09/202235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Creates “Open Usage Commons”
by Lawrence D'Oliveiro 09 Jul '20

09 Jul '20

From <https://www.theregister.com/2020/07/08/google_trademarks_open_usage_commons/>, Google is creating an organization specifically to deal with trademark issues, entirely separate from code. FSF Europe’s Alexander Sander says: “Trademarks issues are becoming more and more relevant for Free Software. This development is mainly due to the fact that Free Software is increasingly and successfully used in the commercial sector.” True, that. Consider the stoush between Debian and Mozilla over the “Firefox” trademark and branding, and the consequent creation of the “Iceweasel” fork. (Looks like that was eventually resolved amicably.) However, note this counterpoint from the Linux Foundation: "Under US trademark law you are not able to effectively separate ownership of a project mark from control of the underlying open source project."

1 0

Over 100 Wi-Fi Routers Fail Major Security Test -- Protect Yourself Now
by Peter Reutemann 09 Jul '20

09 Jul '20

'Tom's Guide: Using its own analytical software, the [Fraunhofer Institute] tested the most recently available firmware for 117 home Wi-Fi models currently sold in Europe, including routers from ASUS, D-Link, Linksys, Netgear, TP-Link, Zyxel and the small German brand AVM. The models themselves were not physically tested. A full list of the tested models and firmware is on GitHub. The institute was not able to examine the firmware of 10 more models, mostly from Linksys. The report notes (PDF) that many firmware updates are issued without fixing known flaws. So what can you do? You can make sure that the next router you buy automatically installs firmware updates. You can check to see whether your current router does so, or makes it fairly easy to install firmware updates manually. You should also make sure that the administrative password for your router has been changed from the factory default password. (Check the list of default passwords at https://www.routerpasswords.com.) You should also check its administrative interface to make sure that UPnP and remote access are disabled. And if your router was first released more than 5 years ago, consider buying a newer model unless it meets all of the above criteria. Alternatively, you could try to "flash" your older router to run more secure open-source router firmware such as OpenWrt, DD-WRT or Tomato. "The worst case regarding high severity CVEs [widely known flaws] is the Linksys WRT54GL powered by the oldest kernel found in our study," the report said, noting that this model uses the 2.4.20 kernel from 2002. "There are 579 high severity CVEs affecting this product." "That particular model last had its firmware updated in January 2016, one of the oldest firmwares in the study," adds Tom's Guide. "The Linksys WRT54GL was first released in 2005 and is still sold today, even though it handles Wi-Fi protocols only up to 802.11g. However, the WRT54G series is possibly the best-selling family of Wi-Fi routers ever..."' -- source: https://mobile.slashdot.org/story/20/07/08/2058240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Google and Canonical Bring Flutter Apps To Linux and the Snap Store
by Peter Reutemann 09 Jul '20

09 Jul '20

'Google is partnering with the Ubuntu Desktop team at Canonical to bring Linux support to its open source UI framework Flutter. Today's Linux alpha announcement also means Flutter developers can now deploy their apps to the Snap Store. Flutter group product manager Tim Sneath argues this is a big milestone because UI frameworks rarely become versatile and powerful enough for an operating system to depend on. He pointed to Windows being written in C++ rather than .NET, even for applets like the Calculator. Sneath also believes this shows Canonical is willing to invest in a first-class way to build apps for Linux, making Flutter on Linux an official part of Ubuntu. Additionally, enterprises can feel confident about picking Flutter -- it's more evidence of its longevity and technical excellence, Sneath said.' -- source: https://linux.slashdot.org/story/20/07/08/1722203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Company SUSE Outbids Competitors for Fast-growing Startup Rancher Labs
by Peter Reutemann 09 Jul '20

09 Jul '20

'SUSE, a Linux distribution company controlled by private equity firm EQT, has agreed to acquire Rancher Labs, a start-up with technology that helps organizations run software in virtual containers across many servers. From a report: The companies announced the deal Wednesday but didn't disclose the terms. Two people familiar with the deal said SUSE is paying $600 million to $700 million. The transaction suggests that even during a recession, demand remains high for technology that can enable companies to operate more efficiently. Talks between the companies began in the spring, and the process became competitive with additional bids, Ursheet Parikh, a partner at Rancher backer Mayfield Fund, told CNBC on Tuesday. There were "lots of Zoom calls," Parikh said. In the past few years, with the rise of start-ups such as Docker, containers became a trendy alternative to more traditional virtualization technology for running applications on each computer server in a company data center. Amazon, Microsoft and other cloud providers came out with services that developers can use to place code in containers, and in 2017 SUSE introduced its own service for managing containers. The companies haven't finalized integration plans as the deal still faces regulatory approval.' -- source: https://linux.slashdot.org/story/20/07/08/147202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Suspends Firefox Send Service While It Addresses Malware Abuse
by Peter Reutemann 09 Jul '20

09 Jul '20

'Mozilla has temporarily suspended the Firefox Send file-sharing service as the organization investigates reports of abuse from malware operators and while it adds a "Report abuse" button. The browser maker took down the service today after ZDNet reached out to inquire about Firefox Send's increasing prevalence in current malware operations. Since last year, several malware operations have hosted payloads on the service. This includes ransomware gangs like REvil/Sodinokibi, financial crime crews like FIN7, the Zloader and Ursnif banking trojans operations, and government surveillance groups targeting human rights defenders. Reasons include the fact that Firefox Send doesn't have an Report Abuse mechanism, all file uploads are encrypted (useful to dodge malware scanners), and the Firefox URL is whitelisted in most orgs (useful for bypassing email filters).' -- source: https://news.slashdot.org/story/20/07/08/1811228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LibreOffice Getting More Commercial?
by Lawrence D'Oliveiro 08 Jul '20

08 Jul '20

Seems that a major policy announcement is coming up from The Document Foundation (the outfit behind LibreOffice) on July 15th. In the meantime, some hints have (unintentionally) leaked out <https://www.theregister.com/2020/07/07/libreoffice_community_protests_at_in…>, such as the about-box in LO 7.0 saying “The personal edition is supported by volunteers and intended for individual use”.

1 0

New H.266 VCC Codec Up To 50% More Efficient Than Previous Standard
by Peter Reutemann 07 Jul '20

07 Jul '20

'The Fraunhofer Heinrich Hertz Institute on Tuesday announced the H.266 Versatile Video Coding codec, which will power more data-efficient video capture and transmission on future iPhones. AppleInsider reports: Apple adopted the predecessor to the new codec, H.265/HEVC, in iOS 11. The updated video codec, which was developed after years of research and standardization, will bring a number of tangible benefits to future iPhone users. In its announcement, the Fraunhofer HHI said that H.266 will reduce data requirements by around 50% thanks to improved compression. With the previous HEVC codec, it took about 10GB of data to transmit a 90-minute ultra-high definition (UHD) video. H.266 can do that with 5GB. The codec, as detailed in a 500-page specification, was designed from the ground up for use with 4K and 8K streaming. It'll allow users to store more high-definition video and reduce the amount of data on cellular networks.' -- source: https://apple.slashdot.org/story/20/07/06/219225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Likes His New AMD Threadripper System
by Peter Reutemann 06 Jul '20

06 Jul '20

'This week Linus Torvalds and Dirk Hohndel re-created their keynote conversation for a special all-virtual edition of the Open Source Summit and Embedded Linux Conference North America. ZDNet reports: While COVID-19 has slowed down many technologies, while speeding up other tech developments, it hasn't affected Linux development much at all. "None of my co-developers have been hugely impacted either. I was worried for a while because one of our developers was offline for a month or two.... [But,] it turned out that it was just RSI [repetitive strain injury], and RSI is kind of an occupational hazard to deal with." He added. "One of the things that is so interesting about the Linux community is how much it has always been email-based and remote, how rarely we get together in person...." Torvalds trusts this new build. Indeed, he ran his end of the videoconference from his new developer machine running the first release candidate of 5.8. Thinking of his new AMD Threadripper 3970x-based processor-powered developer desktop, Torvalds later added that, although he had been concerned about its fan noise it actually works well for him. Torvalds moved to this new homebrew computer because he needed the speed. "My 'allmodconfig' test builds are now three times faster than they used to be." That's important because Torvalds "strives to do about 20 to 30 [pull requests] a day, which is above my limit, ... [but] in order to do that, [he needs] a lot of computing power. ' -- source: https://linux.slashdot.org/story/20/07/03/2349231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Mexico Bans Home PC Repair, Non-OEM OS Installs
by Lawrence D'Oliveiro 04 Jul '20

04 Jul '20

The Mexican “Cámara de Diputados” (“Chamber of Deputies” or lower house of the Mexican Congress) has just passed a law, according to DistroTube <https://www.youtube.com/post/UgyENs4zc_xx-uyL3-N4AaABCQ> (referencing this <https://twitter.com/YourAnonCentral/status/1278172057486766080> Twitter thread), seemingly making any kind of modifications to your own electronic devices illegal. This includes things like changing the hard drive or installing a non-OEM OS (e.g. a Linux distro).

1 0

Ads Are Taking Over Samsung's Galaxy Smartphones
by Peter Reutemann 02 Jul '20

02 Jul '20

'Max Weinbach, writing for Android Police: I have been using Samsung phones every day for almost 4 years. It was because Samsung had fantastic hardware paired with --depending on the year -- good software. 2020 is the first year in a while I'm not using a Samsung phone as my daily driver. The reason? Ads. Ads in Samsung phones never really bothered me, at least not until the past few months. It started with the Galaxy Z Flip. A tweet from Todd Haselton of CNBC is what really caught my eye. Samsung had put an ad from DirectTV in the stock dialer app. This is really something I never would have expected from any smartphone company, let alone Samsung. It showed up in the "Places" tab in the dialer app, which is in partnership with Yelp and lets you search for different businesses directly from the dialer app so you don't need to Google somewhere to find the address or phone number. I looked into it, to see if this was maybe a mistake on Yelp's part, accidentally displaying an ad where it shouldn't have, but nope. The ad was placed by Samsung, in an area where it could blend in so they could make money. Similar ads exist throughout a bunch of Samsung apps. Samsung Music has ads that look like another track in your library. Samsung Health and Samsung Pay have banners for promotional ads. The stock weather app has ads that look like they could be news. There is also more often very blatant advertising in most of these apps as well. Samsung Music will give you a popup ad for Sirius XM, even though Spotify is built into the Samsung Music app. You can hide the SiriusXM popup, but only for 7 days at a time. A week later, it will be right back there waiting for you. Samsung will also give you push notification ads for new products from Bixby, Samsung Pay, and Samsung Push Service. ' -- source: https://slashdot.org/story/20/07/01/196224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 25 Android Apps Caught Stealing Facebook Credentials
by Peter Reutemann 01 Jul '20

01 Jul '20

'Google has removed this month 25 Android apps from the Google Play Store that were caught stealing Facebook credentials. From a report: Before being taken down, the 25 apps were collectively downloaded more than 2.34 million times. The malicious apps were developed by the same threat group and despite offering different features, under the hood, all the apps worked the same. According to a report from French cyber-security firm Evina shared with ZDNet today, the apps posed as step counters, image editors, video editors, wallpaper apps, flashlight applications, file managers, and mobile games. The apps offered a legitimate functionality, but they also contained malicious code. Evina researchers say the apps contained code that detected what app a user recently opened and had in the phone's foreground. If the app was Facebook, the malicious app would overlay a web browser window on top of the official Facebook app and load a fake Facebook login page (see image below: blue bar = actual Facebook app, black bar = phishing page).' -- source: https://tech.slashdot.org/story/20/06/30/1411202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android's AirDrop Competitor Is Coming Soon
by Peter Reutemann 01 Jul '20

01 Jul '20

'Android's long-awaited "Nearby Sharing" feature, which allows you to share files between Android devices wirelessly, is rolling out to beta testers. Android Police reports: Nearby Sharing may appear slightly differently depending on the type of content you try to share. In all cases, it shows up as an app in the apps list on the share sheet, but you may also get a smaller prompt just under the content preview, more like it did in the previous Android 11 video leak. We tested it on a Pixel 4 XL and Pixel 3a running Android 10, but the appearance may also vary on other versions of Android. Note that Nearby Share works for both files like photos or videos, as well as other shareable content like Tweets and URLs. It probably works with a lot of things. Select Nearby Share in the share sheet as the target, and you're prompted to turn on the feature, if it's the first time you've used it. The quick setup process lets you configure your default device name and device visibility settings, though those can also be changed later. Once you have it enabled, Nearby Sharing starts looking for other nearby devices. The interface is pretty simple: A big X in the top left corner backs you out, your avatar on the right takes you to a settings pane that lets you configure things like your device name, visibility, and which mechanism to use to make the transfer (i.e., whether to use your internet connection for small files, to stick to Wi-Fi, or to always share offline). Google says Nearby Share is currently in limited testing via the Play Services beta: "We're currently conducting a beta test of a new Nearby Share feature that we plan to share more information on in the future. Our goal is to launch the feature with support for Android 6+ devices as well as other platforms."' -- source: https://mobile.slashdot.org/story/20/06/30/2014259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Declined To Implement 16 Web APIs in Safari Due To Privacy Concerns
by Peter Reutemann 30 Jun '20

30 Jun '20

'Apple said last week that it declined to implement 16 new web technologies (Web APIs) in Safari because they posed a threat to user privacy by opening new avenues for user fingerprinting. Technologies that Apple declined to include in Safari because of user fingerprinting concerns include: Web Bluetooth - Allows websites to connect to nearby Bluetooth LE devices. Web MIDI API - Allows websites to enumerate, manipulate and access MIDI devices. Magnetometer API - Allows websites to access data about the local magnetic field around a user, as detected by the device's primary magnetometer sensor. Web NFC API - Allows websites to communicate with NFC tags through a device's NFC reader. Device Memory API - Allows websites to receive the approximate amount of device memory in gigabytes. Network Information API - Provides information about the connection a device is using to communicate with the network and provides a means for scripts to be notified if the connection type changes. Battery Status API - Allows websites to receive information about the battery status of the hosting device. Web Bluetooth Scanning - Allows websites to scan for nearby Bluetooth LE devices. Ambient Light Sensor - Lets websites get the current light level or illuminance of the ambient light around the hosting device via the device's native sensors. [...] The vast majority of these APIs are only implemented in Chromium-based browsers, and very few on Mozilla's platform. Apple claims that the 16 Web APIs above would allow online advertisers and data analytics firms to create scripts that fingerprint users and their devices. ' -- source: https://apple.slashdot.org/story/20/06/29/1456247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1