- wlug - list.wlug.org.nz

Choosing 2FA authenticator apps can be hard. Ars did it so you don’t have to
by Peter Reutemann 28 May '20

28 May '20

'Last year, Sergio Caltagirone found himself in a tough spot. While traveling, his phone broke and stopped working completely. With no access to his Google and Microsoft authenticator apps, he lost access to two-factor authentication when he needed it most—when he was logging in from IP addresses not recognized by the 30 to 40 sites he had enrolled. “I had a whole bunch of sites [that] I had to go through a massively long account restoration process because I lost my 2FA,” said Caltagirone, who is senior VP of threat intelligence at security firm Dragos. “Every time, I had to contact customer service. I had different levels of requirements I had to go through for them to effectively disable 2FA on my account. Some required address verification. [For others,] I had to send a last bill. The number of those I went through was just insane.” The experience shows the double-edged sword of multi-factor authentication. Requiring users to enter a password that’s pseudorandomly generated every 30 seconds makes account takeovers significantly harder, even when an attacker has phished or otherwise obtained the password. But in the event that second factor (in this case, the “something you have,” that is, the phone) isn’t available, that same protection can block legitimate users from logging in for unacceptably long periods of time. When Caltagirone relayed his experience last September, a quick survey of the available consumer and small-business authenticators left much to be desired. Only a few of them made it possible to back up the unique cryptographic seeds that each phone uses to generate a time-based one-time password, or TOTP. Websites—including Google, Github, Facebook, and hundreds of others that implement the Time-Based One-Time Password Algorithm standard—require the temporary password to log in users who opt in to 2FA. The result? When your device was stolen, lost, or stopped working, you had to go through the same painful and time-consuming account recoveries Caltagirone did. The lack of a backup and recovery mechanism meant the only viable way to hedge against a device loss or malfunction was to print, scan, or photograph each QR code or the underlying Web link (for instance, http://USERNAME(a)salesforce.com/?secret=LZZIKRWX736EH2IQ&issuer=Slack) it represented. That was time consuming. Even worse, it was cumbersome and insecure to store them, particularly when traveling.' -- source: https://arstechnica.com/information-technology/2020/05/choosing-2fa-authent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenSSH To Deprecate SHA-1 Logins Due To Security Risk
by Peter Reutemann 28 May '20

28 May '20

'OpenSSH, the most popular utility for connecting to and managing remote servers, has announced today plans to drop support for its SHA-1 authentication scheme. From a report: The OpenSSH team cited security concerns with the SHA-1 hashing algorithm, currently considered insecure. The algorithm was broken in a practical, real-world attack in February 2017, when Google cryptographers disclosed SHAttered, a technique that could make two different files appear as they had the same SHA-1 file signature. At the time, creating an SHA-1 collision was considered computationally expensive, and Google experts thought SHA-1 could still be used in practice for at least half a decade until the cost would go down. However, subsequent research released in May 2019 and in January 2020, detailed an updated methodology to cut down the cost of an SHA-1 chosen-prefix collision attack to under $110,000 and under $50,000, respectively. ' -- source: https://it.slashdot.org/story/20/05/27/1830211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Tech’s Volkswagen Moment”
by Lawrence D'Oliveiro 27 May '20

27 May '20

Love the use of the phrase “Volkwagen moment”. A researcher investigating Trend Micro’s antimalware software <https://www.theregister.co.uk/2020/05/20/trend_accused_microsoft_cheating/> has discovered a routine in it which appears to be able to tell when the software is running within Microsoft’s WHQL test suite, so the code can behave one way during testing and certification, and a different way while running on ordinary punters’ PCs. Trend Micro’s response seems to be trying to have it both ways, on the one hand denying it is doing such a thing, on the other trying to cast aspersions on the researcher for going public without contacting them first. But as a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/20/trend_accused_microso…> points out, such a “responsible-disclosure” process is supposed to apply to security bugs. However, this appears to be a deliberate feature.

1 1

India Open Sources Its Contact-Tracing App
by Peter Reutemann 27 May '20

27 May '20

'India has released the source code of its contact-tracing app, Aarogya Setu, to the relief of privacy and security experts who have been advocating for this ever since the app launched in early April. >From a report: Ministry of Electronics and Information Technology Secretary Ajay Prakash Sawhney made the announcement on Tuesday, dubbing the move "opening the heart" of the Aarogya Setu app to allow engineers to inspect and tinker with the code. The app has amassed over 114 million users in less than two months -- an unprecedented scale globally. The source code of Aarogya Setu's Android app is live on GitHub with code of iOS and KaiOS apps slated to release in a "few weeks." Nearly 98% of the app's users are on the Android platform. Sawhney said the government will also offer cash prizes of up to $1,325 to security experts for identifying and reporting bugs and vulnerabilities. "Open-sourcing Aarogya Setu is a unique feat for India. No other government product anywhere in the world has been open-sourced at this scale," said Amitabh Kant, chief executive of government-run think-tank NITI Aayog, in a press conference today.' -- source: https://news.slashdot.org/story/20/05/26/1954212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android Vulnerability Strandhogg 2.0 Exploits User Trust
by Peter Reutemann 27 May '20

27 May '20

'A Norwegian infosec firm discovered a new Android vulnerability, which they've dubbed Strandhogg 2.0. Security firm Promon says "Strandhogg" is an old Norse strategy for coastline raids and abductions, and today's vulnerability is the "evil twin" of a similar one discovered in 2019. The original Strandhogg used an Android feature called taskAffinity to hijack applications -- by setting the taskAffinity of one of its activities to match the packageName of any other app, then setting allowTaskReparenting="true" in its own manifest, the Strandhogg app would be launched in place of the target app. Strandhogg's 1.0 major weakness was the need to declare taskAffinity in the Android Manifest. The Manifest is a plain XML file and must be included in the package hosted at the Play Store itself -- it can't simply be downloaded later, after the app is installed. This made it relatively simple to scan the Play store for apps with sketchy-looking taskAffinity declarations. Strandhogg 2.0 doesn't require any special settings in a package's Android Manifest -- meaning the attacking code doesn't need to be present on the Play Store to be scanned at all. Instead, the attacker can download the attack code later, once the trojan app or game is already installed on a user's device. In addition to the obvious credential-stealing attacks, Strandhogg can be used to trick users into escalating its privileges based on the trust they have for the apps it hijacks. For example, a user tapping Camera is asked if they want to grant it permission to access the camera and microphone -- if the user taps Yes, they've actually given those privileges to the malware app, not the Camera app it covered up on the screen. Strandhogg 2.0 affects all versions of Android prior to 10 -- which translates to roughly 90 percent of the Android userbase. Google rolled out a patch to close the Strandhogg 2.0 vulnerability, CVE-2020-0096, in May's Android Security Update. This is good news for Pixel users -- but as always, carriers and OEMs may delay those upgrades significantly.' -- source: https://it.slashdot.org/story/20/05/26/211241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Dumps Intel For 32-core AMD Ryzen On His Personal PC
by Peter Reutemann 26 May '20

26 May '20

'Linus Torvalds released Linux 5.7 rc7 today, saying it "looks very normal... none of the fixes look like there's anything particularly scary going on." But then he added something else: [T]he biggest excitement this week for me was just that I upgraded my main machine, and for the first time in about 15 years, my desktop isn't Intel-based. No, I didn't switch to ARM yet, but I'm now rocking an AMD Threadripper 3970x. My 'allmodconfig' test builds are now three times faster than they used to be, which doesn't matter so much right now during the calming down period, but I will most definitely notice the upgrade during the next merge window. The Register writes: Torvalds didn't divulge any further details about his new rig, but the 3970x is quite the beast, boasting 32 cores and 64 threads at 3.7GHz with the ability to burst up to 4.5GHz, all built on TSMC's 7nm FinFET process... Torvalds has probably acquired a whole new PC, as the Threadripper range requires a sTRX4 socket and those debuted on motherboards from late 2019. Whatever he's running, it has more cores than Intel currently offers in a CPU designed for PCs. Even Chipzilla's high-end CoreX range tops out at 18 cores. AMD will be over the moon that such a high profile IT pro has adopted their kit and pointed to its performance. Or, as long-time Slashdot reader williamyf puts it, "Good endorsement for AMD, a PR blow for Intel."' -- source: https://linux.slashdot.org/story/20/05/25/020240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Thousands of Enterprise Systems Infected by New Blue Mockingbird Malware Gang
by Peter Reutemann 26 May '20

26 May '20

'Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird. From a report: Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019. Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component. Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence. Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.' -- source: https://tech.slashdot.org/story/20/05/25/1913201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

eBay Port Scans Visitors' Computers For Remote Access Programs
by Peter Reutemann 26 May '20

26 May '20

'When visiting the eBay.com site, a script will run that performs a local port scan of your computer to detect remote support and remote access applications. Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more. After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.' -- source: https://it.slashdot.org/story/20/05/25/161246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Security Report Finds Library-Induced Flaws in 70% of Applications
by Peter Reutemann 25 May '20

25 May '20

' The State of Software Security (SOSS): Open Source Edition "analyzed the component open source libraries across the Veracode platform database of 85,000 applications which includes 351,000 unique external libraries," reports TechRepublic. "Chris Eng, chief research officer at Veracode, said open source software has a surprising variety of flaws." "An application's attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies," he said. The study found that 70% of applications have a security flaw in an open source library on an initial scan. Other findings from the report: - The most commonly included libraries are present in over 75% of applications for each language. - 47% of those flawed libraries in applications are transitive. - More than 61% of flawed libraries in JavaScript contain vulnerabilities without corresponding common vulnerabilities and exposures (CVEs). - Fixing most library-introduced flaws can be done with a minor version upgrade. - Using any given PHP library has a greater than 50% chance of bringing a security flaw along with' -- source: https://developers.slashdot.org/story/20/05/23/2330244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromium Project Finds 70% of Its Serious Security Bugs Are Memory Safety Problems
by Peter Reutemann 25 May '20

25 May '20

'"Around 70% of our serious security bugs are memory safety problems," the Chromium project announced this week. "Our next major project is to prevent such bugs at source." ZDNet reports: The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating. The number is identical to stats shared by Microsoft. Speaking at a security conference in February 2019, Microsoft engineers said that for the past 12 years, around 70% of all security updates for Microsoft products addressed memory safety vulnerabilities. Both companies are basically dealing with the same problem, namely that C and C++, the two predominant programming languages in their codebases, are "unsafe" languages.... Google says that since March 2019, 125 of the 130 Chrome vulnerabilities with a "critical" severity rating were memory corruption-related issues, showing that despite advances in fixing other bug classes, memory management is still a problem... Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components... While software companies have tried before to fix C and C++'s memory management problems, Mozilla has been the one who made a breakthrough by sponsoring, promoting and heavily adopting the Rust programming language in Firefox... Microsoft is also heavily investing in exploring C and C++ alternativesâ¦ But this week, Google also announced similar plans as well... Going forward, Google says it plans to look into developing custom C++ libraries to use with Chrome's codebase, libraries that have better protections against memory-related bugs. The browser maker is also exploring the MiraclePtr project, which aims to turn "exploitable use-after-free bugs into non-security crashes with acceptable performance, memory, binary size and minimal stability impact." And last, but not least, Google also said it plans to explore using "safe" languages, where possible. Candidates include Rust, Swift, JavaScript, Kotlin, and Java.' -- source: https://developers.slashdot.org/story/20/05/24/1349204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'FOSS Responders' Want to Help Open-Source Groups Survive
by Peter Reutemann 25 May '20

25 May '20

'"Thanks to the coronavirus, technology events have been canceled left and right," writes ZDNet. "This, in turn, is damaging the finances of companies and groups that depend on these events." Some open-source groups, such as The Linux Foundation, can deal with it. Others aren't so fortunate. Some, such as Drupal Foundation, the Open Source Initiative (OSI), Open Source Matters (Joomla), and Ajv JSON Schema validator, are in real trouble. FOSS Responders is trying to help these and other groups and individuals... Nuritzi Sanchez, a FOSS Responder co-founder and GitLab senior open-source program manager, said: We "started out around mid-March as a response to COVID-19 event cancellations. It's a group of open source leaders from companies like Indeed, Facebook, Google, Red Hat, GitHub, GitLab, etc." They've set up a process to help both open-source individuals and organizations facing financial trouble. So far, Sanchez said, "organizations are the ones that have been reaching out most so far." They're also consolidating information on how to plan and execute virtual events and provide a place where people can look for and offer help. FOSS Responders has already had some success in raising donations. Alyssa Wright, Open Collective's director of social engineering, reports that it's raised funds from Indeed, Open Source Collective, Linux Fund, GitHub, Google, Sentry, Ethereum Foundation, and the Sloan Foundation. As a result "FOSS Responders is contributing over $100K to open-source organizations that are experiencing financial strain because of the COVID-19 pandemic." "The main focus of philanthropic efforts will be elsewhere, as they should be," noted LWN.net back in March, "but it is nice to see our community finding ways to help itself out internally."' -- source: https://news.slashdot.org/story/20/05/23/2351224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Patent Troll Sent Packing
by Lawrence D'Oliveiro 22 May '20

22 May '20

<https://www.theregister.co.uk/2020/05/21/gnome_foundation_settles_patent_tr…>: In an article comment on this story, [CEO Neil] McGovern said: "For those asking about payment, I can confirm we paid RPI and Leigh Rothschild a grand total of $0.00 for the settlement."

1 0

Check Point Releases Open-Source Fix For Common Linux Memory Corruption Security Hole
by Peter Reutemann 22 May '20

22 May '20

'For years, there's been a known security vulnerability hiding in the GNU C Library (glibc). This library, which is critical for Linux and many other operating systems and programs, had a dynamic memory management security hole that could be used for denial of service (DoS) attacks. Now, the security company, Check Point, has issued an open-source patch, which will make it much more difficult to exploit this memory allocation (malloc) problem. Check Point re-encountered this known problem when it discovered that so-called smart light bulbs could be used to hack into networks by exploiting unprotected single-linked-lists. The double-linked-list version of this problem had been fixed back in 2005 with Safe-Unlinking. But, the single-linked-list version, which is present in the memory primitive functions Fast-Bins and Thread Cache (TCache), remained vulnerable. Now, the fix is in for this problem. This new built-in security mechanism is called Safe-Linking. It protects malloc by signing its single-linked-list pointers with random numbers derived from Linux's Address Space Layout Randomization (ASLR) functionality. Combined with memory chunk alignment integrity checks, it protects the memory pointers from hijacking attempts and thus the system itself. The patch is now being integrated with the most common standard C library implementation, glibc. Safe-Linking will be released in glibc 2.32 in August 2020. It's already up and running in glibc's popular embedded counterpart: uClibc-NG.' -- source: https://linux.slashdot.org/story/20/05/21/2018256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Beta Firmware Brings True USB Boot for High-Speed Storage, No microSD Required
by Peter Reutemann 22 May '20

22 May '20

'Owners of a Raspberry Pi 4 Model B single-board computer looking to make the most of the device's high-speed USB 3.0 connectivity by turning it into the device's primary storage can now do so — at least, if they're willing to help out with beta-testing the latest firmware. The Raspberry Pi 4 launched last year with a range of improvements over its predecessor, including the option of up to four times as much memory and high-speed USB 3.0 connectivity for peripherals, but with a couple of regressions: The loss of the ability, present in the Raspberry Pi 3 range, to boot from a network server or USB Mass Storage device.' -- source: https://www.hackster.io/news/raspberry-pi-4-beta-firmware-brings-true-usb-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Term Of The Week: “RPA”
by Lawrence D'Oliveiro 21 May '20

21 May '20

Came across this phrase “robotic process automation” (RPA) <https://www.theregister.co.uk/2020/05/05/sba_rpa_ban/> which seems to be just another name for “web-scraping”. The site in question also offers APIs that can be used more directly to make requests and receive info. It’s just that the scraping works on a GUI designed for human users and human response times and data rates, so it creates a lot more overhead on the servers when being driven automatically with a lot of requests. Some outfits try to say that using such technology on their site is a violation of their terms of service. As one of the reader comments points out, if a company is banned from using a scraper bot that is batching its requests, and has to resort to hiring an army of humans, creating a concomitant swarm of separate login sessions, to enter the same data, the result can be even worse load on the servers.

1 1

Information Technology Asset Management (ITAM) Forum
by Lawrence D'Oliveiro 21 May '20

21 May '20

Choice quote from the founder/chairman <https://www.theregister.co.uk/2020/05/20/itam_forum_launches/>: “One of the reasons people have been interested in ITAM in the past is because they are sick of software audits and want to learn to defend themselves against audits...” Given the way the proprietary licence agreements are worded, it’s hard to see how you can avoid this and still use the same software. Further: “Ten years ago, people thought everything would be compliant in the cloud. Although software compliance is less of an issue, costs certainly aren’t planned. It is as complex as ever. Whether it's on the desktop, in the data centre or in the cloud, you’re looking at roughly 35 per cent waste across all of those platforms.” That’s a pretty high figure. It means that, when you buy proprietary software, you are paying about a 50% markup on the supposed price.

1 0

Samsung Smart TV - blocking ads
by Peter Reutemann 21 May '20

21 May '20

Hi everyone Just came across this tip on reddit for blocking ads on your Samsung Smart TV: https://www.reddit.com/r/YouShouldKnow/comments/gn7fw5/ysk_if_you_own_a_sam… Blocking "ads.samsung.com" (or similar) on the router seems to be sufficient... The above link has more domains listed for Samsung and LG. Not that I'm connecting my TV to the internet in the first place... ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

List Of Spreadsheet Horror Stories
by Lawrence D'Oliveiro 21 May '20

21 May '20

One of the things the European Spreadsheet Risks Interest Group likes to do is collect horror stories about the (mis)use of spreadsheets <http://eusprig.org/horror-stories.htm>. Found the link in a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/19/sap_analytics_cloud_o…> to this article <https://www.theregister.co.uk/2020/05/19/sap_analytics_cloud_office_integra…> about how software company SAP, creator of a complete business analytics suite, has felt compelled to include an interface to Microsoft Excel, just because that’s what most of its customers are familiar with.

4 5

SD Cards Version 8 Are Coming
by Lawrence D'Oliveiro 20 May '20

20 May '20

According to the pic linked from this article <https://www.theregister.co.uk/2020/05/20/sd_8_for_sd_express/>, the new SD card spec uses PCIe instead of the previous “SD Bus” interface to achieve around ... is it 4GB/s, or 4Gb/s? The article says it both ways, while the diagram uses capital B throughout. The current fastest SD cards have two rows of pins; this spec adds a third row.

1 0

Linux distro review: Fedora Workstation 32
by Peter Reutemann 20 May '20

20 May '20

'Today's Linux distro review is one I've been wanting to do for quite some time—Fedora Workstation. Fedora is one of the heavyweight desktop distros of the Linux world, with a vibrant community and a strong presence at every open source convention I've ever attended. (Remember physically attending events? Ars remembers.) I never felt particularly drawn to Fedora myself, because it's a bleeding-edge distro—one targeted to the very newest software, possibly at the expense of stability. That's not what I personally want in an operating system—I fix broken things professionally; I'd prefer not to fix them personally any more than I have to. But as one of the few distros using the next-generation Wayland display server by default, Fedora made me very curious indeed. Although the screenshots taken throughout this review are of virtual machines, my first installation of Fedora Workstation (ever!) was bare metal, on the HP Dragonfly Elite G1.' -- source: https://arstechnica.com/gadgets/2020/05/linux-distro-review-fedora-workstat… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

“To Fix Social Media, We Need To Introduce Digital Socialism”
by Lawrence D'Oliveiro 20 May '20

20 May '20

Some may find this opinion piece <https://www.aljazeera.com/indepth/opinion/fix-social-media-introduce-digita…> a bit too political, I don’t know. But he does mention some interesting open-source software projects, like the various “Fediverse” networks of decentralized social-media servers, and the “LibreSocial” project, which is trying to get rid of what little centralization still exists in those networks. Where I suppose it gets controversial is where he suggests that funding for such projects could be raised by taxing the existing Big Tech firms. But certainly many would agree the open-source projects he mentions are worth pursuing regardless.

1 0

OT: NZ COVID Tracer app
by Peter Reutemann 20 May '20

20 May '20

Hi everyone Just came through on my twitter feed: the NZ COVID Traver app is ready: https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 3

Microsoft Launches Windows Terminal 1.0, Unveils GPU Support and Linux GUI Apps in WSL
by Peter Reutemann 20 May '20

20 May '20

'At Build 2020 today, Microsoft gave developers a slew of new tools to coax them into using Windows over macOS or Linux. From a report: Windows Terminal is now out of preview for enterprises, and Windows Subsystem for Linux (WSL) 2 is getting support for GPUs, Linux GUI apps, and a simplified install experience. Microsoft even released a Windows Package Manager in preview. Windows 10 runs on 1 billion monthly active devices (PCs, Xbox One consoles, and HoloLens devices), making it a massive platform for developers to target. [...] Microsoft today released Windows Terminal 1.0, which means it is stable for enterprise use. The open source application features multiple tabs, panes, tear-away windows, shortcuts, Unicode and UTF-8 character support, emojis, ligatures, extensions, GPU-accelerated text rendering engine, and custom themes, styles, and configurations. Windows Terminal is for users of PowerShell, Cmd, WSL, and other command-line tools. Microsoft also unveiled WSL improvements today, including support for GPUs, Linux GUI apps, and a simplified install experience. WSL is a compatibility layer for running Linux binary executables natively on Windows. Microsoft first shared it was working on WSL 2 a year ago at Build 2019. WSL 2 is slated to arrive in the next major Windows 10 update coming later this month (brilliantly called the Windows 10 May 2020 Update), but it won't have these new features. In the second half of the year, WSL 2 will get support for GPU compute workflows. ' -- source: https://linux.slashdot.org/story/20/05/19/163224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 83 Released With Enhanced Privacy Controls, Tab Groups Feature
by Peter Reutemann 20 May '20

20 May '20

'Google has released today version 83 of its Chrome web browser, one of the most feature-packed Chrome updates released since the browser's initial launch back in 2009. From a report: Today's v83 release includes a slew of new features. These include enhanced privacy controls, new settings for managing cookie files, a new Safety Check option, support for tab groups, new graphics for web form elements, a new API for detecting barcodes, and a new anti-XSS security feature, among many many others. The reason why Chrome 83 includes so many features is because Google canceled the Chrome 82 release due to the ongoing coronavirus pandemic. As a result, some of the Chrome 82 features were pushed into Chrome 83, while others were rescheduled for later this year.' -- source: https://slashdot.org/story/20/05/19/185244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD 6.7 Released
by Peter Reutemann 20 May '20

20 May '20

'New OpenBSD version. String of good news. Some of the new changes, as highlighted by Phoronix, include: - FFS2 file-system improvements including using 64-bit timestamps and block numbers by default for new installs. - Support for the Raspberry Pi 4 on ARM64 while improving the Raspberry Pi 3 support too. Raspberry Pi 2/3 support has also improved for OpenBSD ARMv7. - Better support for Rockchip systems like the Pinebook Pro. - Various SMP improvements including better AMD SMT/Core/Package detection. - A wide variety of different hardware driver improvements, including Intel AX200 WiFi device support. - A FIDO driver introduced for FIDO/U2F security keys support. - Fixed handling of USB 2.0 devices when in use on different USB 3.0 controllers. - The PowerPC OpenBSD build switched over to Clang as its default code compiler. - Various dhclient fixes. - Various security improvements. ' -- source: https://tech.slashdot.org/story/20/05/19/1935202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 May '20

20 May '20

Hi everyone For the meeting next week, the idea was to have a distro showdown. Since not everyone had experience yet with BigBlueButton, I would like to offer a trial run on Sunday night 8pm for the presenters. That should give them a chance to sort out video and audio. I'll send out a test link to the presenters off-list later on in the week. So far, I've got: - Ian - Ubuntu 20.04 - Tom - GhostBSD - Peter - Manjaro (never used it, but we can explore it together) Anyone else wanting to demo a distro? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner
by Peter Reutemann 19 May '20

19 May '20

'This has been a long while in the making—it's test results time. To truly understand the fundamentals of computer storage, it's important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It's also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers. First, a quick note: This testing, naturally, builds on those fundamentals. We're going to draw heavily on lessons learned as we explore ZFS topologies here. If you aren't yet entirely solid on the difference between pools and vdevs or what ashift and recordsize mean, we strongly recommend you revisit those explainers before diving into testing and results. And although everybody loves to see raw numbers, we urge an additional focus on how these figures relate to one another. All of our charts relate the performance of ZFS pool topologies at sizes from two to eight disks to the performance of a single disk. If you change the model of disk, your raw numbers will change accordingly—but for the most part, their relation to a single disk's performance will not.' -- source: https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disk… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Re: wlug Digest, Vol 347, Issue 17 - DishTV Box
by tom butz 19 May '20

19 May '20

Hi John, I've been using the cheap one (99 dollars) and it works well. They expect the hard-disk/memory stick to be formatted FAT32. The system could do that for you. The recording format is proprietary: it's .mpg, but if you play it back, there is an enormous amount of jitter every 5 seconds or so. There is no documentation, maybe because FreeView told them to keep it secret. The USB-connection is USB2 and supplies 500 mA of power: that should be enough for a memory stick but not an ordinary HD (they usually draw about 1000 mA). I've kept an old HD out of a notebook and use it with an adapter. It's slow but I've never lost anything. Maybe there are Y-connectors around that would bump the HD's power to 1000 mA, but I've not managed to find one. The system records in ordinary density and doesn't use a lot of space. As everything is so proprietary I haven't found a way to transfer/add parts to another HD/stick. Everything sits in 1 directory with a few subdirectories. Transferring the stuff to a computer would work if you filmed the TV-screen. You would then also be able to cut out the ads. I've read somewhere that there are devices that would record HDMI-output (which the DishTV provides) on a USB-device, so that should do the job. Gameplayers use something like that to record their moves... Just an aside: recording OnDemand movies: easy if you use 'simplescreenrecorder' (Windows and Linux). It creates an MKV-file you can edit. Tom.

3 2

dish tv
by john 18 May '20

18 May '20

Hi all' Does anyone know the file format for the Dish TV sat box?? I have a replacement empty drive. No File allocation and wonder if the Dish box will format the disk to it's own system? Cheers John.

1 0

Slack Now Strips Location Data From Images
by Peter Reutemann 16 May '20

16 May '20

'Slack has started to strip uploaded photos of their metadata. What may seem like an inconsequential change to how the tech giant handles storing files on its servers, it will make it far more difficult to trace photos back to their original owners. From a report: Almost every digital file -- from documents on your computer to photos taken on your phone -- contains metadata. That's data about the file itself, such as how big the file is, when it was created, and by whom. Photos and videos often include the precise coordinates of where they were taken. But that can be a problem for higher-risk Slack users, like journalists and activists, who have to take greater security precautions to keep their sources safe. The metadata inside photos can out sources, deanonymize whistleblowers, or otherwise make it easier for unfriendly governments to target individuals. Even if a journalist removes the metadata from a photo before publishing, a copy of the photo -- with its metadata -- may remain on Slack's servers. Whether a hacker breaks in or a government demands the data, it can put sources at risk' -- source: https://yro.slashdot.org/story/20/05/11/2051209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

ddr2 ram
by john 16 May '20

16 May '20

Some years ago, Windows Vista offered users who plugged in a USB flash drive the option of using the device as extra ram. I never actually tried this due to large amount of doubt about the functional ability of the claim. However I now have a number of Linux machines with DDR2 that I am unable to increase the physical memory of and wonder if this is a feasible option for these machines. Cheers John

5 6

Standby Fares For Those Flying Cloud
by Lawrence D'Oliveiro 14 May '20

14 May '20

New concept: “Spot” VMs on cloud services <https://www.theregister.co.uk/2020/05/13/azure_spot_vms/>. These are offered for a very low price, but equally the jobs run at very low priority, and are liable to be evicted at short notice--as little as 30 seconds, according to the article. They are there to fill up unused capacity that cannot be sold at the regular rate. But as soon as a customer appears willing to pay that rate, out you go.

1 0

3D File Manager As A Service
by Lawrence D'Oliveiro 13 May '20

13 May '20

This company called Saganworks is offering a navigable 3D world for accessing your files stored on their servers <https://blocksandfiles.com/2020/05/12/saganworks-virtual-reality-rooms-for-…>. This sort of thing has been done lots of times before, famously on SGI workstations (and seen in the “Jurassic Park” movie). I suppose Microsoft Bob also counts, in a way. Quote: “We don’t live in a 2D world, yet that’s how we’ve been retaining knowledge and memories from the time of early cave dwellers until now.” Speak for yourself, non-command-line user. Yes, the name is a contrived acronym, and also a homage to Carl Sagan ...

1 0

Ventoy USB Image Multi-Bootloader
by Lawrence D'Oliveiro 13 May '20

13 May '20

Been watching this video <https://www.youtube.com/watch?v=MYJ8du9TaxE> about a bootloader called “Ventoy”. Basically you install it onto a suitably-large USB stick, then you can just copy .iso image files of all the distros you want to try, and when you boot off that stick, it will offer a list of which OS image you want to start up. This even includes some Microsoft Windows installation images. Not everything is fully-compatible, though.

1 0

Commercial Use Of Open Source: Good & Bad
by Lawrence D'Oliveiro 13 May '20

13 May '20

<https://www.theregister.co.uk/2020/05/12/open_source_bugs/> The good news: commercial adoption of Open Source is on the up: ... almost all (99 per cent) of the codebases examined have at least one open source component and that 70 per cent of the code overall is open source. That's about twice as much as the company's 2015 report, which found only 36 per cent of audited code was open source. The bad news: the companies concerned seem to have few or no procedures in place for keeping those open-source components up to date: Ninety-one percent of the audited applications had components that are either four years out of date or have exhibited no active development for two years. In 2019 – the time-period covered by the 2020 report – the percentage of codebases containing vulnerable components rose to 75 per cent, up from 60 per cent in 2018. They also seem to be a little bit careless about the legalities: The Synopsys report also found that 68 per cent of codebases exhibited an open source license conflict and that 33 per cent of them had no identifiable license.

1 0

Eclipse Foundation Moving Base To Europe
by Lawrence D'Oliveiro 13 May '20

13 May '20

The Eclipse Foundation is “re-domiciling the legal entity that controls The Eclipse Foundation from the US to Europe” <https://www.theregister.co.uk/2020/05/12/eclipse_moves_to_europe/>. Seems like Europe is already accounting for a much bigger chunk of contributions than the US: Membership dues will eventually be stated in Euros and a new version of the membership agreement will be coming down the line to reflect the foundation's new status as a Belgian entity. This reader comment <https://forums.theregister.co.uk/forum/all/2020/05/12/eclipse_moves_to_euro…> gives some other examples of Open Source projects where either their organizations or the bulk of their contributors are not (or no longer) US-centric. E.g. The Document Foundation (which runs the LibreOffice project) is based in Berlin.

1 0

Apache 101: 0-WordPress in 15 minutes
by Peter Reutemann 13 May '20

13 May '20

'Recently, we took a look at the Caddy Web server. Today, we're going to back things up a little bit and look at the A from the classic LAMP stack: the Apache Web server. Apache has a bad reputation for being old, crusty, and low-performance—but this idea mostly stems from the persistence of ancient guides that still show users how to set it up in extremely antiquated ways. In this guide, we're going to set up an Ubuntu 20.04 droplet at Digital Ocean with an Apache Web server set up properly and capable of handling serious levels of traffic.' -- source: https://arstechnica.com/information-technology/2020/05/apache-101-0-wordpre… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thunderbolt Bug Lets Hackers Steal Your Data in 'Five Minutes'
by Peter Reutemann 13 May '20

13 May '20

'A new set of flaws discovered in the Intel Thunderbolt port has put millions of machines at risk of local hacking. This new research by Eindhoven University's Bjorn Ruytenberg suggests that if a hacker gains access to a machine for just five minutes, they could bypass login methods to gain full data access. From a report: Thunderbolt ports are present in machines with Windows, Linux, and macOS. So, that covers a lot of computers. Ruytenberg said all Thunderbolt versions and systems shipped between 2011 to 2020 are affected and no software patch can fix these vulnerabilities. So, Intel would need to redesign silicon in order to fix these flaws. There's not much you can do here. However, with open-source software called Thunderspy, developed by Ruytenberg and their team, you can check if you're affected by the Thunderbolt bug.' -- source: https://it.slashdot.org/story/20/05/11/1450208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Microsoft Wants Notebooks
by Lawrence D'Oliveiro 12 May '20

12 May '20

One of the plans announced for Microsoft’s Visual Studio Code development environment <https://www.theregister.co.uk/2020/05/11/visual_studio_code_145_released/> is “notebooks” à la Jupyter: The team is also working on native support for notebooks, though rather than just support Jupyter notebooks (for which support already exists as part of the Python tools) the intention is to "build a Notebook solution that is unbiased and supports different styles of Notebooks". Of course, Jupyter itself already allows you to use other programming languages, not just Python. By the way, interesting to note that Jupyter is becoming the recognized reference for the notebook paradigm, as opposed to Mathematica which is where the idea originated.

1 0

ZFS 101—Understanding ZFS storage and performance
by Peter Reutemann 11 May '20

11 May '20

'As we all enter month three of the COVID-19 pandemic and look for new projects to keep us engaged (read: sane), can we interest you in learning the fundamentals of computer storage? Quietly this spring, we've already gone over some necessary basics like how to test the speed of your disks and what the heck RAID is. In the second of those stories, we even promised a follow-up exploring the performance of various multiple-disk topologies in ZFS, the next-gen filesystem you have heard about because of its appearances everywhere from Apple to Ubuntu. Well, today is the day to explore, ZFS-curious readers. Just know up front that in the understated words of OpenZFS developer Matt Ahrens, "it's really complicated." But before we get to the numbers—and they are coming, I promise!—for all the ways you can shape eight disks' worth of ZFS, we need to talk about how ZFS stores your data on-disk in the first place.' -- source: https://arstechnica.com/information-technology/2020/05/zfs-101-understandin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Which Linux Desktop Environment is the Best?
by Peter Reutemann 11 May '20

11 May '20

'Tom's Hardware "put five of the most popular desktop environments up against each other in a no-holds-barred, seven-round face-off. We've rated GNOME, KDE, Cinnamon, Awesome and Regolith on a 10-point scale based on Installation, Applications, User Experience, User Documentation, Performance, Extensions and Configurability." It's a good read, with a detailed and thoughtful 3,700-word analysis, especially about memory performance: When you use the standard desktops, Gnome and KDE, you will likely notice that you are using a lot of memory... If you haven't noticed yet, try running htop in a separate window while you try out your choices. You should see a substantial difference with Awesome, i3 and, if you are elite, dwm. The difference in memory footprint is staggering when you start measuring. GNOME starts with somewhere in the region of 3GB at boot. This can be trimmed down by serious tweaking, but not very much. In comparison, the Awesome window manager weighs in at around 600MB... You can put a lot of eye candy and daemons before you weigh down your system as much as the others... Getting the advantage comes at a cost, though: you need to learn a few new habits to use Awesome desktop environment. Among GNOME, KDE, and Cinnamon, the article ultimately calls KDE "the most polished... decorative and versatile of the bunch. This comes at a cost, though." Cinnamon has the best balance between extensions and ease of use, while it is also fast and responsive. At the same time, it is not that heavy on resources. You can also add a wide range of extensions in the shape of widgets that send you ongoing and updated information. Regolith requires a bit more training, but it does set itself up for you so you can continue as you did with GNOME. Adding extensions and other gadgets is a bit more tricky, however... With Awesome you have to set up and practice to use it! It's easily the hardest in the group to get started with. When you are up and running, Awesome does deliver the most benefits from a resource point of view... Overall Winner: Cinnamon...because of its strong combination of user experience, performance and customization. ' -- source: https://tech.slashdot.org/story/20/05/10/1552222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Source Code For Contact-Tracing Apps
by Lawrence D'Oliveiro 10 May '20

10 May '20

The UK and Australia have both published the source code for their contact-tracing apps on GitHub <https://www.theregister.co.uk/2020/05/09/coronavirus_tracing_app_source_cod…>. And of course a lot of people are going over them with a fine-toothed comb. Some are even suggesting that one for Apple’s platform, for example, might be violating the company’s rules on using Bluetooth while running in the background. It’s hard to see how these apps won’t be a big battery drain anyway. Maybe the NZ government is wise not to make this sort of thing a priority for now.

1 0

Do Working-From-Home Developers Risk Burning Out?
by Peter Reutemann 10 May '20

10 May '20

'"Software developers, like everyone else, have had to transition to a work-from-home world," writes InfoWorld. For the users of GitHub, the COVID-19 pandemic has meant changes in work cadence and collaboration, along with an increased risk of burnout, a GitHub study of usage patterns on the Microsoft-owned code sharing site has found." In an "Octoverse spotlight" analysis published May 6, 2020, GitHub compared the first three months of 2020 with the first three months of 2019... GitHub said its analysis shows that developers have been resilient to the change wrought by COVID-19, with activity holding consistent or increasing through the crisis. But their analysis also found: - Developers are working longer, by "up to an hour per day," seven days a week. - Slightly more pushes, pull requests, reviewed pull requests, and commented issues. - More collaboration on open source projects, and less time to merge pull requests into open source projects.' -- source: https://news.slashdot.org/story/20/05/09/0158217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

3D Printed N95 Montana Mask Design Released Under GPLv3
by Peter Reutemann 10 May '20

10 May '20

'Since the COVID-19 pandemic has made Personal Protective Equipment worth it's weight in gold, Makers have been trying to help bridge the gap. While sewn masks have been the most common solution, the 3D printing community has been pitching in as well. The Montana Mask has been one of the most popular designs... Thursday, the group Make the Masks announced that the design files and STLs to print the mask have been released under the GNU General Public License v3, allowing anyone to print, sell, remix or improve the design, as long as they conform to the license. Importantly, the GPLv3 includes an international non-exclusive patent grant, meaning that even if the inventors decide to apply for a patent, it will not restrict anyone from using the design.' -- source: https://science.slashdot.org/story/20/05/09/1859238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Where Does Ad Money Go?
by Lawrence D'Oliveiro 08 May '20

08 May '20

The accounting firm PwC (does that still stand for “Price Waterhouse Coopers”?) has done a study <https://www.theregister.co.uk/2020/05/07/ad_tech_fees_sucked/> of the online ad market, to see where all the money is going. Turns out only about half the money spent by advertisers makes it all the way to the publishers, with the rest siphoned off by various intermediaries along the way (not all of them legitimate), and 15% could not be accounted for at all. Much of this trading is now done “programmatically”, between automated systems, rather than by direct agreements between humans. And these systems are more complex (i.e. “having more stages where a percentage cut can be taken”) than they need to be.

1 0

Inkscape Approaches Version 1.0
by Lawrence D'Oliveiro 08 May '20

08 May '20

Inkscape v1.0 is tentatively due to be released on May 1st. Here <https://www.theregister.co.uk/2020/04/14/16_years_inkscape_v1/> is a backgrounder on how development has been progressing. There seems to be this assumption that Apple users are important: Mac support is hugely important, thanks to the wide use of Macs in the artistic and designer community. while on the other hand, They know that macOS usage has been very small. The new version is using GTK+3, and the UI is more customizable than before. The command shell has also been improved. Finally: Is the open-source business model, or lack of it, holding back Inkscape? "We would advance much faster with even one or two full-time people," said Jeanmougin. "That has been some frustration because we only rely on donations. We get much less than what we would need to hire people."

1 2

MPA and Amazon Ask GitHub To Suspend Kodi Add-On Developer's Account
by Peter Reutemann 08 May '20

08 May '20

'The MPA, MPA-Canada, and Amazon have filed a request with Github requesting that a Kodi add-on developer's account be deleted from the platform. Citing a copyright case and a permanent injunction handed down by Canada's Federal Court, the content companies claim that the account is still being used to infringe their rights. Github has left the account intact, however. TorrentFreak reports: In February 2018, a developer known online as 'Blamo' (aka 'Mr. Blamo') revealed that he, in common with several of his counterparts, had been threatened by content companies. From there the trail went cold but according to a complaint filed against Github this week, legal action in Canada followed. On September 7, 2018, a dozen companies including the studios of the MPA/MPA-Canada plus Amazon and Netflix launched a copyright infringement lawsuit at Canada's Federal Court against an individual "doing business" as Mr. Blamo. "In the context of that action, our clients alleged that [Blamo] notably developed, hosted, promoted and distributed infringing add-ons for the Kodi media center, which provided unauthorized access to motion pictures and television content for which the copyright is owned by our clients," the MPA writes. According to Federal Court records, Blamo did not mount any kind of defense so as a result, the matter was decided in his absence. On January 15, 2019, the Federal Court handed down a final judgment, including a declaration of infringement and a permanent injunction. "The permanent injunction enjoins and restrains [Blamo] from, inter alia, hosting, distributing or promoting infringing Kodi add-ons and their repositories, including notably the 'Blamo' repository and the "Chocolate Salty Balls' infringing add-ons," the MPA adds. The problem here is that, according to the MPA and associated companies, Blamo has a Github account where it is claimed he continues to "host and distribute infringing Kodi add-ons and their repository, including notably the Chocolate Salty Balls infringing add-on and the Blamo repository." This, the MPA says, amounts to contempt of court. What's particularly interesting here, however, is that the MPA isn't asking for the specified URLs to be deleted. Instead, it asks for Blamo's entire Github account to be deactivated instead.' -- source: https://yro.slashdot.org/story/20/05/07/2018227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple IOS XML Bug
by Lawrence D'Oliveiro 08 May '20

08 May '20

>From <https://www.schneier.com/blog/archives/2020/05/ios_xml_bug.html>: So Siguza's exploit -- which granted an app full access to the entire file system, and more - uses malformed XML comments constructed in a way that one of iOS's XML parsers sees its declaration of entitlements one way, and another XML parser sees it another way. The XML parser used to check whether an application should be allowed to launch doesn't see the fishy entitlements because it thinks they're inside a comment. The XML parser used to determine whether an already running application has permission to do things that require entitlements sees the fishy entitlements and grants permission. Further: Implementing 4 different parsers is just asking for trouble, and the "fix" is of the crappiest sort, bolting on more crap to check they're doing the right thing in this single case. None of this is encouraging. Conway’s Law comes to mind: “any piece of software reflects the organizational structure that produced it”. 3 different XML parsers sounds like 3 different groups working on those parts of the OS, while the addition of a fourth to block the hole suggests that nobody with any responsibility for security was able to get through to any of those groups to fix their parsing.

1 0

Microsoft's GitHub Account Allegedly Hacked, 500GB Stolen
by Peter Reutemann 08 May '20

08 May '20

'A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer reports. From the report: This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. The individual told us that they then downloaded 500GB of private projects and initially planned on selling it, but has now decided to leak it for free. Based on the file stamps in the leaked files, the breach may have occurred on March 28th, 2020.' -- source: https://developers.slashdot.org/story/20/05/07/1850248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Google Authenticator's First Android Update in Years Lets You Move Your Account Between Devices
by Peter Reutemann 08 May '20

08 May '20

'Google Authenticator, the company's code-based authentication app, has received its first update in three years, updating the app's interface for larger screens with more modern aspect ratios and delivering one of the platform's most-needed features. From a report: The Android version was last updated on August 22nd, 2017, while the iOS one was updated around a year ago to adjust it for iPhone X screens. Now, for the first time, Authenticator users will be able to easily transfer their account from one device to another without needing to manually transfer each code or disable and reenable two-factor authentication (2FA) on each account. The update introduces this feature through an import / export tool that lets you choose which accounts to include and transfer using a single QR code scan. It's a feature that competitor Authy has provided for quite some time, so it's refreshing to see it come to Authenticator, even if it's years late.' -- source: https://tech.slashdot.org/story/20/05/07/1450227 Finally... Could have used that a while ago... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0