- wlug - list.wlug.org.nz

Coffee Run--Blender Open Movie
by Lawrence D'Oliveiro 08 Jun '20

08 Jun '20

The latest annual short-feature project from the Blender Animation Studio came out week before last <https://www.youtube.com/watch?v=PVGeM40dABA>. At just about 3 minutes long, this one is done in the style of a 2D-rendered video game. But beware: there are some less-than-lighthearted elements behind the surface.

2 1

Brave Browser Mistake Adds Its Referrer Code For Cryptocurrency Sites
by Peter Reutemann 08 Jun '20

08 Jun '20

'The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it "a mistake we're correcting." Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser's autocompleting feature should not have added any new affiliate codes. "The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions," Eich wrote in the thread. "Sorry for this mistake — we are clearly not perfect, but we correct course quickly," he added. Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser's GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months. The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase's program provides "direct access to your campaign's performance data," while Trezor offers a "detailed overview of purchases." Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, "For what it's worth there's a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to. "Good to hear from supporters who'll enable it."' -- source: https://it.slashdot.org/story/20/06/07/2217224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ars Technica: We put Western Digital’s dreaded SMR Red drive to the test
by Peter Reutemann 08 Jun '20

08 Jun '20

'Western Digital has been receiving a storm of bad press—and even lawsuits—concerning their attempt to sneak SMR disk technology into their "Red" line of NAS disks. To get a better handle on the situation, Ars purchased a Western Digital 4TB Red EFAX model SMR drive and put it to the test ourselves.' -- source: https://arstechnica.com/gadgets/2020/06/western-digitals-smr-disks-arent-gr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Java-Based Ransomware Targets Linux and Windows Systems
by Peter Reutemann 08 Jun '20

08 Jun '20

'"A newly uncovered form of ransomware is going after Windows and Linux systems," reports ZDNet, "in what appears to be a targeted campaign." Named Tycoon after references in the code, this ransomware has been active since December 2019 and looks to be the work of cyber criminals who are highly selective in their targeting. The malware also uses an uncommon deployment technique that helps stay hidden on compromised networks. The main targets of Tycoon are organisations in the education and software industries. Tycoon has been uncovered and detailed by researchers at BlackBerry working with security analysts at KPMG. It's an unusual form of ransomware because it's written in Java, deployed as a trojanised Java Runtime Environment and is compiled in a Java image file (Jimage) to hide the malicious intentions... [T]he first stage of Tycoon ransomware attacks is less uncommon, with the initial intrusion coming via insecure internet-facing Remote Desktop Protocol servers. This is a common attack vector for malware campaigns and it often exploits servers with weak or previously compromised passwords. Once inside the network, the attackers maintain persistence by using Image File Execution Options (IFEO) injection settings that more often provide developers with the ability to debug software. The attackers also use privileges to disable anti-malware software using ProcessHacker in order to stop removal of their attack... After execution, the ransomware encrypts the network with files encrypted by Tycoon given extensions including .redrum, .grinch and .thanos — and the attackers demand a ransom in exchange for the decryption key. The attackers ask for payment in bitcoin and claim the price depends on how quickly the victim gets in touch via email. The fact the campaign is still ongoing suggests that those behind it are finding success extorting payments from victims. ' -- source: https://linux.slashdot.org/story/20/06/06/0445235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Dropped for Open Source Again in Germany: Hamburg Follows Munich's Lead
by Peter Reutemann 08 Jun '20

08 Jun '20

'"The trend towards open-source software on government computers is gathering pace in Germany," reports ZDNet: In the latest development, during coalition negotiations in the city-state of Hamburg, politicians have declared they are ready to start moving its civil service software away from Microsoft and towards open-source alternatives. The declaration comes as part of a 200-page coalition agreement between the Social Democratic and Green parties, which will define how Hamburg is run for the next five years. It was presented on Tuesday but has yet to be signed off. The political parties in charge in Hamburg are the same as those in Munich, who recently agreed to revert back to that city's own open-source software. "With this decision, Hamburg joins a growing number of German states and municipalities that have already embarked on this path," said Peter Ganten, chairman of the Open Source Business Alliance, or OSBA, based in Stuttgart. He's referring to similar decisions made in Schleswig-Holstein, Thuringia, Bremen, Dortmund, and Munich. But, he adds: "The Hamburg decision is nevertheless remarkable because the city has always been more aggressively oriented towards Microsoft. "In the future we will aim to have more open-source software in digital management [systems] and we also want to develop our own code, which will remain open," the head of the local Hamburg-Mitte branch of the Greens, Farid Mueller, wrote on his website. Hamburg wants to be a leading example of digital independence, he stated. The article also adds a final interesting detail. A Microsoft spokeperson told a Germany technology site "that the company didn't see the desire for more open-source software as an attack on itself. Microsoft now also uses and develops a lot of open source and welcomed fair competition, the spokesperson added."' -- source: https://linux.slashdot.org/story/20/06/07/0147255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Eyes Decentralized Web-Based Videoconferencing Platform 'Meething'
by Peter Reutemann 08 Jun '20

08 Jun '20

'Last month Techcrunch reported that Mozilla had gone "full incubator" by holding a startup lab called Fix the Internet, followed by "a formal program dangling $75,000 investments in front of early-stage companies..." Fix the Internet had many key themes, including collaboration and decentralization (as well as user-controlled data and privacy-protecting social networks). That event "drew the interest of some 1,500 people in 520 projects, and 25 were chosen to receive the full package and stipend during the development of their minimum viable product (MVP). Below that, as far as pecuniary commitment goes, is the 'MVP Lab,' similar to the spring program but offering a total of $16,000 per team." And one of those MVP Lab teams is Meething, a new video conferencing and collaboration platform from the innovation lab ERA. Meething "aims to be more secure than existing video conferencing tools and run on a decentralized database engine and leverage peer-to-peer networking" according to ZDNet. In their video interview with CEO Mark Nadal, he outlined the following selling points: - Browser based video conferencing gives customers better options for security as well as branding. - Open source architecture is a win and the peer-to-peer networking is more efficient on compute costs. - Meething doesn't require downloads or apps that increase the security attack surface. The total addressable market for video conferencing is large and can support multiple players. Their press release quotes Mark Mayo, a former Chief Product Officer at Mozilla who served as Meething's mentor, arguing that video conferencing on the web "has long promised to enable a whole new world of online collaboration. Frankly, it hasn't delivered. It's been way too hard to build cool products with video and Meething aims to be the zero-barrier-to-entry platform that realizes this future. Soon, video conferencing won't suck!"' -- source: https://tech.slashdot.org/story/20/06/07/1739228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How SpaceX Uses Linux, Chromium, C++ and Open Source Libraries
by Peter Reutemann 07 Jun '20

07 Jun '20

'Long-time Slashdot reader mrflash818 ("Linux geek since 1999") shared a ZDNet article pointing out that SpaceX's Falcon 9 rocket has an onboard operating system that's "a stripped-down Linux running on three ordinary dual-core x86 processors. The flight software itself runs separately on each processor and is written in C/C++." Interestingly, back in 2018 a Slashdot headline asked whether C++ was "a really terrible language," and Elon Musk replied on Twitter with his single-word answer. "Yes." ZDNet points out that "ordinary" processors are often needed because of the multi-year development time for the spacecraft they power. Their article notes that the International Space Station actually runs on 1988-vintage 20 MHz Intel 80386SX CPUs: Of course, while those ancient chips work for the station's command and control multiplexer/demultiplexer, they're not much good for anything else. For ordinary day-in and day-out work, astronauts use HP ZBook 15s running Debian Linux, Scientific Linux, and Windows 10. The Linux systems act as remote terminals to the control multiplexer/demultiplexer, while the Windows systems are used for email, the web, and fun. Usually, though, chips that go into space aren't ordinary chips. CPUs that stay in space must be radiation-hardened. Otherwise, they tend to fail due to the effects of ionizing radiation and cosmic rays. These customized processors undergo years of design work and then more years of testing before they are certified for spaceflight. For instance, NASA expects its next-generation, general-purpose processor, an ARM A53 variant you may know from the Raspberry Pi 3, to be ready to run in 2021... The Dragon spacecraft's touchscreen interface is rendered using Chromium and JavaScript. If something were to go wrong with the interface, the astronauts have physical buttons to control the spacecraft. Today the SpaceX software team answered questions on Reddit, revealing they use Chromium with a reactive library developed in-house, and that "All of our on-board computers either run Linux (with the PREEMPT_RT patch) or are microcontrollers that run bare-metal code...." Later they emphasized that for the Falcon 9 and Dragon software, "All of the application-level autonomous software is written in C++. We generally use object oriented programming techniques from C++, although we like to keep things as simple as possible. "We do use open source libraries, primarily the standard C++ library, plus some others. However, we limit our use of open source libraries to only extremely high quality ones, and often will opt to develop our own libraries when it is feasible so that we can control the code quality ourselves."' -- source: https://science.slashdot.org/story/20/06/06/2023249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Mint Dumps Ubuntu Snap
by Peter Reutemann 07 Jun '20

07 Jun '20

'ZDNet reports: Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, has dropped support for Ubuntu's Snap software packing system. [...] So, what's not to like? Well, a lot, thinks Clem. As he wrote in July 2019, the idea is fine: "When snap was announced it was supposed to be a solution, not a problem. It was supposed to make it possible to run newer apps on top of older libraries and to let third-party editors publish their software easily towards multiple distributions, just like Flatpak and AppImage." But, he said, "What we didn't want it to be was for Canonical to control the distribution of software between distributions and third-party editors, to prevent direct distribution from editors, to make it so software worked better in Ubuntu than anywhere else and to make its store a requirement." Clem was worried then that Canonical was moving in that direction because: "Ubuntu is planning to replace the Chromium [Google's open-source browser and foundation for Chrome] repository package with an empty package, which installs the Chromium snap. In other words, as you install APT [Debian's program for installing and managing DEB files] updates, Snap becomes a requirement for you to continue to use Chromium and installs itself behind your back. This breaks one of the major worries many people had when Snap was announced and a promise from its developers that it would never replace APT. A self-installing Snap Store which overwrites part of our APT package base is a complete NO-NO. It's something we have to stop and it could mean the end of Chromium updates and access to the snap store in Linux Mint." Fast forward to now, and that's still the case with Chromium, and Clem has had enough: "In the Ubuntu 20.04 package base, the Chromium package is indeed empty and acting, without your consent, as a backdoor by connecting your computer to the Ubuntu Store. Applications in this store cannot be patched, or pinned. You can't audit them, hold them, modify them, or even point snap to a different store. You've as much empowerment with this as if you were using proprietary software, i.e. none. This is in effect similar to a commercial proprietary solution, but with two major differences: It runs as root, and it installs itself without asking you." ' -- source: https://news.slashdot.org/story/20/06/05/2148219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lenovo Will Pre-load Ubuntu and Red Hat on All Its Workstations
by Peter Reutemann 07 Jun '20

07 Jun '20

'TechRepublic calls it "a tectonic shift in the landscape... a massive company showing serious support for both Ubuntu Linux and Red Hat Enterprise Linux." Forbes reports: Beginning this month, Lenovo will certify its ThinkStation PCs and ThinkPad P Series laptops for both Ubuntu LTS and Red Hat Enterprise Linux. Every single model, every single configuration across the entire workstation portfolio. [ZDNet adds that the two Linux distros will also be preloaded.] And it doesn't end there. "Going beyond the box, this also includes full web support, dedicated Linux forums, configuration guidance and more," says Rob Herman, General Manager, Executive Director Workstation & Client AI Group at Lenovo. We're not talking about just hardware certification, either. Lenovo will offer both Red Hat Enterprise Linux and Ubuntu LTS distributions pre-installed... "What's more, Lenovo will also upstream device drivers directly to the Linux kernel, to help maintain stability and compatibility throughout the life of the workstation," says Herman. Lenovo and Fedora are already working together to enable fingerprint sensor support on select ThinkPads, and send that support upstream to benefit all Linux distributions (including firmware being available through LVFS). When I spoke to Mark Pearson, the Senior Linux Software Engineer even mentioned porting certain Windows-only PC management tools to Linux to aid in the overall effort. TechRepublic notes the news "comes on the heels of a number of new Linux desktop support news. This year we've seen the rise of Purism, Tuxedo Computers, Pine64, Juno Computers, Vikings, Dell's continued support with the XPS Dev edition laptop and the Precision line, and now Lenovo." They also argue for continued support for the smaller vendors of Linux hardware. "Companies like System76 are a big reason why desktop Linux continued climbing up that steep mountain called 'Acceptance.'" But their article concludes that "No matter which path you take, you now (as a Linux user) have more options."' -- source: https://linux.slashdot.org/story/20/06/06/0113250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will The Transition To IPv6 Take 5 to 10 Years?
by Peter Reutemann 07 Jun '20

07 Jun '20

'The Register: IPv4 is here to stay with us for a good few years yet, reckons the the Réseaux IP Européens Network Coordination Centre's (RIPE NCC) public policy manager, eight years after IPv6 was supposed to replace it. Marco Hogewoning, public policy for the Amsterdam, Netherlands-based European regional internet registry, told The Register that despite the best efforts of IPv6 proponents over the last eight years, it might take "five to 10 years" before the world starts to truly abandon the IPv4 address space. IPv6 was first defined in 1996, but with Friday marking the 8th anniversary of (the second) IPv6 "Launch" Day, RIPE NCC was keen to talk up the tech, whose chief benefit is that it provides a much greater pile of internet addresses for all the stuff humanity has dumped online in the last few decades...Musing that "little pockets of IPv4" and some government services hosted on IPv4 are two of the things holding the world back, Hogewoning told The Register: "It's impossible for me to file my taxes over IPv6. As much as I want, I can't get rid of IPv4 in the end because I need to file my taxes. That's a dialogue we try to have with the governments... It's an important step to go to, enabling IPv6 [instead of] IPv4 to make sure we don't force people to have that backwards compatibility."' -- source: https://tech.slashdot.org/story/20/06/06/0245248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

one week of arch
by Peter Reutemann 07 Jun '20

07 Jun '20

Hi everyone At last month's meeting, we also had a look at Manjaro, an Arch-based Linux distribution: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792009/ While preparing for the presentation, I played around with Manjaro and quite liked the arch package manager "pacman". Since then, Angus came across EndeavourOS, another Arch Linux distribution, which is a bit more up-to-date than Manjaro: https://endeavouros.com/ So, last weekend, I decided to bite the bullet and upgrade the aging LinuxMint 18.3 installation on my laptop at home. The EndeavourOS installer seemed less polished (showing lots of Space Shuttle Endeavour related imagery) than the likes of Mint or Ubuntu, but it did the job. Always glad that my home directory is on a separate partition. Makes the installation so much easier... :-) I've been using it now for a week and I must say, I quite like it. The MATE desktop, in contrast to Linux Mint, is far less polished, but it works absolutely fine. It feels really, really snappy (and that on a spinning drive!) and it doesn't seem to suffer from the same performance degradation over time like my old Mint installation did: as the days went by, the login screen would take longer and longer to show up after resuming from sleep, the Caja file browser would take longer to start up and everything just felt more and more sluggish. Last night, I flashed an old Samsung S4 with LineageOS (Android 9) and I didn't have to resort to compiling Heimdall myself, the Arch repositories already had packages built on the latest code from the repository. Nice! Only problem so far are the proprietary Brother printer drivers. Haven't been able to get printing working yet (the package for the printer in the arch repositories didn't do anything). Something to figure out on a rainy day... Anyway, looks like I'm sort of an Arch convert now. ;-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows 10 Is Hostile To Open Source
by Lawrence D'Oliveiro 06 Jun '20

06 Jun '20

From <https://www.theregister.com/2020/06/05/windows_10_microsoft_defender_smarts…>: A developer of a Windows utility has protested that "Microsoft Defender SmartScreen is hurting independent developers" because of the number of warnings and obstacles placed in front of users who download installers that are not signed or sufficiently well known. In the absence of a “Let’s Encrypt” equivalent for them, code-signing certificates cost money. And on top of that, SmartScreen’s warnings will not go away until that certificate has built up some (unspecified) minimum level of “reputation”. Because of this, many projects, like Ardour and Inkscape, don’t bother with signing, and rely on their users to negotiate the obstacle course of download and installation warnings.

1 0

Follow-up to the EFF .ORG petition
by Ian Stewart 06 Jun '20

06 Jun '20

You may remember, from over a month ago, there was circulation on WLUG email of a request to sign a petition<https://act.eff.org/action/help-stop-the-sale-of-public-interest-registry-t…> of Electronic Frontier Foundation to "Help Stop the Sale of Public Interest Registry to a Private Equity Firm"... "This month [November 2019] it was suddenly announced that the nonprofit that owns the .ORG domain registry was planning to sell it to a private equity firm, Ethos Capital. This could impact the millions of individuals and organizations that have a .ORG website, subjecting them to potential censorship and leaving the door open for price increases on domain registration and renewals." You may be wondering what happened. I've just looked at the wikipedia entry for .ORG, and it contains the following paragraph based on this article from the The Verge<https://www.theverge.com/2020/4/30/21241946/icann-dot-org-isoc-ethos-capita…>: "In November 2019, the Public Interest Registry (PIR) was to be sold by the Internet Society to shell company Ethos Capital for US$1.135 billion. The PIR also announced it would abandon its non-profit status to become a B Corporation. However, this move was criticized by non-profits and various digital rights groups on concerns that Ethos Capital, a private equity firm, would raise fees or censor the domain. The sale was blocked by Internet Corporation for Assigned Names and Numbers (ICANN) in April 2020 on the basis that transfer of control of the domain to the private equity firm would create "unacceptable uncertainty" for non-profits that relied on the .org domain." While Wikipedia's entry on .ORG<https://en.wikipedia.org/wiki/.org> has a brief history section, more details can be found at Wikipedias Public Interest Registry webpage<https://en.wikipedia.org/wiki/Public_Interest_Registry>. In case you find its TL;DR here are some snippets... the Internet Society proposed creating the Public Interest Registry as a separate 501(c)3 non-profit to manage .ORG when the Public Interest Registry was established, “our aim was to promote the non-commercial use of the internet" Public Interest Registry released an open letter on 1 May 2019, stating, “The .ORG Community always is considered in every decision we make here at Public Interest Registry. Rest assured, we will not raise prices unreasonably. In fact, we currently have no specific plans for any price increases for .ORG.” On 13 May 2019, ICANN announced that they would remove the price cap on .ORG registrations. ...former ICANN CEO Fadi Chehadé registered the domain name EthosCapital.com. On 14 May 2019, Ethos Capital was incorporated in Delaware On 13 November 2019 the Internet Society announced that it was divesting of the Public Interest Registry, and that Ethos Capital would be acquiring its assets Ethos Capital stated on their website, "Our plan is to live within the spirit of historic practice when it comes to pricing," which they later clarified to mean raising prices by an average of 10% per year. People who came out in opposition to the sale included Tim Berners-Lee... On 29 November 2019, it was revealed that the purchase price is $1.135 billion. On 30 April 2020, the ICANN Board, saying it was "the right thing to do," withheld its consent to the transfer of control of the Public Internet Registry to Ethos Capital, effectively killing the proposed deal. In Summary The .ORG remains in the hands of the "Public Interest Registry" which seems to sometimes get called the "Public Internet Registry"? The "Public Interest Registry" pir.org link takes you to https://thenew.org/org-people/ where, among other things, you can download the PIR 2018 Annual Report<https://thenew.org/app/uploads/2019/09/PIR-2018-Annual-Report.pdf> or their 2018 Form 990<https://thenew.org/app/uploads/2019/09/PIR-2017_2018-990.zip> "Return of Organization Exempt From Tax". For 2018 you will see their total revenue was $93 million. cheers, Ian.

1 0

Linux not Windows: Why Munich is shifting back from Microsoft to open source – again
by Peter Reutemann 05 Jun '20

05 Jun '20

'In a notable U-turn for the city, newly elected politicians in Munich have decided that its administration needs to use open-source software, instead of proprietary products like Microsoft Office. "Where it is technologically and financially possible, the city will put emphasis on open standards and free open-source licensed software," a new coalition agreement negotiated between the recently elected Green party and the Social Democrats says. The agreement was finalized Sunday and the parties will be in power until 2026. "We will adhere to the principle of 'public money, public code'. That means that as long as there is no confidential or personal data involved, the source code of the city's software will also be made public," the agreement states.' -- source: https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Signal Launches Face-Blurring Tool as US Protesters Embrace Encrypted Messaging
by Peter Reutemann 05 Jun '20

05 Jun '20

'Law enforcement officials across the U.S. have already revealed that they will leverage facial recognition technology to retroactively target protesters following the killing of George Floyd, with police asking the public for footage and photos. Against this backdrop, Signal is introducing a new feature that can automatically obfuscate faces shared within the encrypted messaging app, as the company says it's "working hard to keep up with the increased traffic" from protesters. From a report: Moving forward, Signal users will be able to activate a feature in the main photo editing toolbox that will automatically blur all faces it identifies in an image. As with many automated computer vision tools, Signal doesn't claim that its face-blurring smarts are 100% effective. It may not identify all faces in a photo, which is why users can manually obscure faces by drawing the blur brush across each face with their finger.' -- source: https://it.slashdot.org/story/20/06/04/1621201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Ringing Room Use BBB?
by Lawrence D'Oliveiro 04 Jun '20

04 Jun '20

Came across this site <https://ringingroom.com/> mentioned on the TV news this evening. It’s a “virtual bell tower” where fans of bell-ringing can gather to scratch their itch during lockdown in the UK and US. The thing that strikes me is, it look remarkably similar, at least in concept, to Web conferencing software BigBlueButton <https://bigbluebutton.org/>. I wonder if it’s an application/customization of the latter?

1 0

Zoom Won't Encrypt Free Calls Because it Wants To Comply With Law Enforcement
by Peter Reutemann 04 Jun '20

04 Jun '20

'If you're a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you're out of luck. From a report: Free calls won't be encrypted, and law enforcement will be able to access your information in case of 'misuse' of the platform. Zoom CEO Eric Yuan today said that the video conferencing app's upcoming end-to-end encryption feature will be available to only paid users.' -- source: https://yro.slashdot.org/story/20/06/03/1150245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

6 9

TrueNAS isn’t abandoning BSD—but it is adopting Linux
by Peter Reutemann 04 Jun '20

04 Jun '20

'To the surprise—and likely consternation—of BSD fans everywhere, FreeNAS vendor iXsystems is building a new version of its core product, TrueNAS, on top of Debian Linux. This week's TrueNAS Scale announcement builds on the company's March announcement that its commercial project TrueNAS and its community project FreeNAS would be merging into a common base. Effectively, all the NAS projects from iXsystems will be TrueNAS variants moving forward, with the free-to-use version being TrueNAS Core, the new Debian-based project becoming TrueNAS Scale, and the commercial project remaining simply TrueNAS.' -- source: https://arstechnica.com/gadgets/2020/06/truenas-isnt-abandoning-bsd-but-it-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Cold Boot Attack Affects Seven Years of LG Android Smartphones
by Peter Reutemann 04 Jun '20

04 Jun '20

'South Korean phone manufacturer LG has released a security update last month to fix a vulnerability that impacts its Android smartphones sold over the past seven years. From a report: The vulnerability, tracked under the identifier of CVE-2020-12753, impacts the bootloader component that ships with LG smartphones. In March this year, US software engineer Max Thomas discovered a vulnerability in the bootloader component that had been added to LG smartphones starting with the LG Nexus 5 series. In a technical breakdown of the vulnerability published on Tuesday, Thomas says the bootloader component's graphics package contains a bug that lets attackers sneak in their own code to run alongside the bootloader's graphics under certain conditions, such as when the battery dies out and when the device is in the bootloader's Download Mode. Thomas says that threat actors who perfectly time an attack can gain the ability to run their own custom code, which could allow them to take over the bootloader, and inherently the entire device.' -- source: https://mobile.slashdot.org/story/20/06/03/1830216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google fixes Android flaws that allow code execution with high system rights
by Peter Reutemann 03 Jun '20

03 Jun '20

'Google has shipped security patches for dozens of vulnerabilities in its Android mobile operating system, two of which could allow hackers to remotely execute malicious code with extremely high system rights. In some cases, the malware could run with highly elevated privileges, a possibility that raises the severity of the bugs. That’s because the bugs, located in the Android System component, could enable a specially crafted transmission to execute arbitrary code within the context of a privileged process. In all, Google released patches for at least 34 security flaws, although some of the vulnerabilities were present only in devices available from manufacturer Qualcomm.' -- source: https://arstechnica.com/information-technology/2020/06/google-fixes-android… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DOD's Third Attempt To Implement IPv6 Isn't Going Well
by Peter Reutemann 03 Jun '20

03 Jun '20

'The US Department of Defense is woefully behind on its plan to upgrade its IT infrastructure to support the newer IPv6 protocol, according to a government report published on Monday. From a report: This current effort is the third time the DOD attempts to upgrade its infrastructure to support IPv6 over in the past 17 years. The first two attempts took place in 2003 and 2010, respectively. The 2003 effort was abandoned with the DOD citing security risks and a lack of personnel trained in IPv6, while the second attempt was also abandoned, similarly on the grounds that IPv6 was not yet secure enough for the DOD's sensitive networks. On Monday, the Government Accountability Office (GAO), the auditing agency of the US government, said that the DOD's third attempt isn't doing any better either. GAO officials said the DOD failed to follow four basic requirements that were set out by the White House Office of Management and Budget (OMB) in 2006. The four requirements were part of an OMB guideline sent to all federal agencies detailing the proper procedure for upgrading networks from IPv4 to IPv6. "For its current [third] initiative, DOD has not completed three of four longstanding OMB requirements," GAO auditors said in a report published on Monday.' -- source: https://news.slashdot.org/story/20/06/02/1447254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 77 Arrives With Faster JavaScript Debugging and Optional Permissions
by Peter Reutemann 03 Jun '20

03 Jun '20

'Mozilla today launched Firefox 77 for Windows, Mac, and Linux. Firefox 77 includes faster JavaScript debugging, optional permissions for extensions, and Pocket recommendations in the U.K. You can download Firefox 77 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. [...] Other than Pocket recommendations arriving in the U.K. (they've been in Canada, Germany, and the U.S. since April 2018), this is primarily a developer release. Firefox's Debugger is now better at handling large web apps with all their bundling, live reloading, and dependencies. Mozilla is promising performance improvements that speed up pausing and stepping, as well as cutting down on memory usage over time. Source maps should also see performance boosts -- some inline source maps load 10 times faster -- and improved reliability for many configurations. The debugger will now also respect the currently selected stack when stepping, which is useful when you've stepped into a function call or paused in a library method further down in the stack.' -- source: https://news.slashdot.org/story/20/06/02/1530214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wallpaper crash explained: Here’s how a simple image can soft-brick phones
by Peter Reutemann 02 Jun '20

02 Jun '20

'How can a simple image crash an Android phone to the point that it becomes unusable? It’s a question that came out frequently over the past 24 hours, as news of a “cursed wallpaper” spread around the web. Here’s a recap: Setting a particular image as wallpaper can send some phones into a loop of crashes that makes them unusable. There are a few solutions, depending on how hard the phone is hit. Some users were able to change the wallpaper in the short interval between crashes. Others had success deleting the wallpaper using the recovery tool TWRP. But in most cases, the only solution was to reset the phone to factory settings, losing any data that’s not backed up. The issue was brought to light by Ice Universe, the Chinese Twitter users known for leaks. Based on user reports, many models from Samsung and Google are affected, while we’ve also seen some reports from users of OnePlus, Nokia, and Xiaomi devices (it’s not clear if these latter devices ran stock software or custom ROMs). From our own testing and looking at user reports, Huawei devices seem to be less exposed to the wallpaper crash issue.' -- source: https://www.androidauthority.com/android-wallpaper-crash-1124577/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Programmers Use 80 Characters Per Line!?
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

Are there still people writing their code to the constraints of 80-column CRT terminals which vanished into museums decades ago? Seems there are enough such around to rile Linus Torvalds <https://www.theregister.com/2020/06/01/linux_5_7/>. Even back in the days of those terminals, the printers you used for hard-copy listings could almost always do 132-column lines. And some of the terminals could be put into a mode with such a line length, by using a much narrower font (I remember it hurt my eyes to do much work in this mode). Nowadays I typically have my text-editor windows set to a width of 100 columns. And there is still enough room on my screen for two such views side-by-side.

1 0

Lawsuit Over Online Book Lending Could Bankrupt Internet Archive
by Lawrence D'Oliveiro 02 Jun '20

02 Jun '20

A group of book publishers is suing the Internet Archive over its recent loosening of restrictions on lending out copyrighted books <https://arstechnica.com/tech-policy/2020/06/publishers-sue-internet-archive…>. Choice description of the founder of the Internet Archive: "Brewster Kahle is what the Russians might call a holy fool—someone who acts without real regard for himself or the worldly things in the service of a higher calling," [copyright scholar James] Grimmelmann said.

1 0

Cisco Discloses Security Breach That Impacted VIRL-PE Infrastructure
by Peter Reutemann 01 Jun '20

01 Jun '20

'Thursday Cisco disclosed a security breach that impacted a small part of its backend infrastructure and two of its commercial products also bundling the SaltStack software package as part of their firmware. ZDNet reports: Cisco said that hackers used a vulnerability in the SaltStack software package, which Cisco bundles with some products, to gain access to six servers... The six servers provide the backend infrastructure for VIRL-PE (Internet Routing Lab Personal Edition), a Cisco service that lets users model and create virtual network architectures to test network setups before deploying equipment in real situations. "Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised," the company said Thursday. Cisco said it patched and remediated all hacked VIRL-PE servers on May 7, when it deployed updates for the SaltStack software. However, the issue isn't localized to Cisco's backend infrastructure alone. Cisco says that two of its commercial products also bundle the SaltStack software package as part of their firmware. These are the aforementioned Cisco VIRL-PE, and Cisco Modeling Labs Corporate Edition (CML), another network modeling tool. Both VIRL-PE and CML can be used in Cisco-hosted and on-premise scenarios. In case companies use the two products on location, Cisco says CML and VIRL-PE need to be patched.' -- source: https://tech.slashdot.org/story/20/05/30/055201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

An advanced and unconventional hack is targeting industrial firms
by Peter Reutemann 01 Jun '20

01 Jun '20

'Attackers are putting considerable skill and effort into penetrating industrial companies in multiple countries, with hacks that use multiple evasion mechanisms, an innovative encryption scheme, and exploits that are customized for each target with pinpoint accuracy. The attacks begin with emails that are customized for each target, a researcher at security firm Kaspersky Lab reported this week. For the exploit to trigger, the language in the email must match the localization of the target’s operating system. For example, in the case of an attack on a Japanese company, the text of the email and an attached Microsoft Office document containing a malicious macro had to be written in Japanese. Also required: an encrypted malware module could be decrypted only when the OS had a Japanese localization as well. Recipients who click on a request to urgently enable the document’s active content will see no indication anything is amiss. Behind the scenes, however, a macro executes a Powershell script. The reason it stays hidden: the command parameters: - ExecutionPolicy ByPass—to override organization policies - WindowStyle Hidden. This hides the PowerShell window - NoProfile, which executes the script with no end-user configuration.' -- source: https://arstechnica.com/information-technology/2020/05/an-advanced-and-unco… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Warns Java Developers of New Malware Poisoning NetBeans Projects
by Peter Reutemann 01 Jun '20

01 Jun '20

'GitHub issued a security alert Thursday warning about new malware spreading on its site via boobytrapped Java projects, ZDNet reports: The malware, which GitHub's security team has named Octopus Scanner, has been found in projects managed using the Apache NetBeans IDE (integrated development environment), a tool used to write and compile Java applications. GitHub said it found 26 repositories uploaded on its site that contained the Octopus Scanner malware, following a tip it received from a security researcher on March 9. But the article adds GitHub "believes that many more projects have been infected during the past two years." GitHub says that when other users would download any of the 26 projects, the malware would behave like a self-spreading virus and infect their local computers. It would scan the victim's workstation for a local NetBeans IDE installation, and proceed to burrow into the developer's other Java projects. The malware, which can run on Windows, macOS, and Linux, would then download a remote access trojan (RAT) as the final step of its infection, allowing the Octopus Scanner operator to rummage through an infected victim's computer, looking for sensitive information. GitHub says the Octopus Scanner campaign has been going on for years, with the oldest sample of the malware being uploaded on the VirusTotal web scanner in August 2018, time during which the malware operated unimpeded.' -- source: https://news.slashdot.org/story/20/05/30/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Zoom's New, Stronger Encryption May Only Protect Paying Clients
by Peter Reutemann 01 Jun '20

01 Jun '20

'"Zoom plans to strengthen the encryption of its service for paying customers," reports Newsweek, "but the upgrade will not be available to users of its free service." Zoom security consultant Alex Stamos later confirmed the details of the reported move in an interview with Reuters, which first reported the changes on Friday. But he also told the news outlet that Zoom's plans could still change. "The CEO is looking at different arguments," Stamos said. "The current plan is paid customers plus enterprise accounts where the company knows who they are." In the wake of privacy concerns, he added that Zoom was making significant efforts to upgrade safety and trust on its platform. In an emailed statement to Newsweek, a Zoom spokesperson said: "Zoom's approach to end-to-end encryption is very much a work in progress — everything from our draft cryptographic design, which was just published last week, to our continued discussions around which customers it would apply to." The tech company's plans to boost the encryption of video calls on its platform have been revealed a month after it was reported that half a million Zoom account credentials were being sold on the Dark Web. Zoom's increased usage during lockdowns brought increase scrutiny, reports CNET, which "revealed several Zoom security problems and the fact that an earlier Zoom boast of end-to-end encryption was baseless."' -- source: https://it.slashdot.org/story/20/05/30/2311256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Maintainers of Open Source Projects Be Paid?
by Peter Reutemann 01 Jun '20

01 Jun '20

'Matt Asay, a former COO of Canonical now working at AWS, writes "Over the last few weeks I've interviewed a range of open source project maintainers, most of which don't directly get paid for supporting their projects... Is this a bad thing?" It's not completely clear. Linux Foundation executive Chris Aniszczyk has been an outspoken opponent of open source "tip jars" that seek to sustain projects with donations. "These [open source developers] should be encouraged to start businesses or your business should hire them directly," he argues. But many such developers don't want a 9-to-5 corporate job, preferring the independence of contract work. Open source sustainability, in other words, is messy. Most open source project maintainers with whom I've spoken got started because it was a "fun" way to spend their free time. They had a variety of personal "itches" they needed to scratch. Exactly none started coding because they were hoping to get paid for that work. In fact, in some cases, it was specifically to create space from their employer that they started the project. For Datasette founder Simon Willison, for example, he "wanted a creative outlet." That is, a project that he got to have complete control over. In some ways, he said, it was perhaps "a way of blowing off steam," but really it was a place where he could express his creativity without a corporate overlord steering that creativity. See the problem...? Aniszczyk reasonably suggests that the most sustainable source of funding is a paycheck, but that's precisely what many of these developers don't want. Or, at least, they don't want a paycheck that comes with restrictions on their ability to code freely... [O]pen source sustainability will never have one, meta answer for all of open source. It's always a project-by-project analysis and, really, a founder-by-founder (or community-by-community) decision. ' -- source: https://news.slashdot.org/story/20/05/31/0138252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ardour 6.0 Is Out
by Lawrence D'Oliveiro 29 May '20

29 May '20

Most of us are happy with Audacity for our audio-editing needs, but if you need full on pro-quality audio production, Ardour is it <https://www.theregister.co.uk/2020/05/28/ardour_6_release/>. I did try running it briefly once, but like Blender, you really need an introductory tutorial or two to make at least some initial sense of it all--you cannot just dive in blindly and expect to figure it out by messing around.

2 1

Microsoft Announces The Official “Windows Package Manager”
by Lawrence D'Oliveiro 29 May '20

29 May '20

<https://www.theregister.co.uk/2020/05/20/microsoft_announces_official_windo…>: Among the best features of Linux is the availability of package managers, such as Debian's Apt, that can install, remove and manage dependencies for applications from the command line. It is not perfect – dependency version issues or broken configuration files can be a problem – but most of the time it makes it easy to get what you want, and is scriptable. Many users would like Windows to be equally convenient to use. Only it’s not quite there yet: More seriously, the current preview is limited to installation; it does not even have a remove option for packages. It does not auto-update packages or even have any mechanism to update them, and there is no specific dependency management. On the to-do list are features including uninstall, update, and Store app support. Hence the filing of a bug report pointing out that “All it does is downloading installers (which are not packages) and executing them (which is not management)”.

1 1

A $350 “anti-5G” device is just a 128MB USB stick, teardown finds
by Peter Reutemann 29 May '20

29 May '20

'Believers of 5G conspiracy theories have apparently been buying a $350 anti-5G USB key that—not surprisingly—appears to just be a regular USB stick with only 128MB of storage. As noted by the BBC today, the "5GBioShield" USB stick "was recommended by a member of Glastonbury Town Council's 5G Advisory Committee, which has called for an inquiry into 5G." The company that sells 5GBioShield claims it "is the result of the most advanced technology currently available for balancing and prevention of the devastating effects caused by non-natural electric waves, particularly (but not limited to) 5G, for all biological life forms." The product's website charges £283 for a single 5GBioShield, which converts to nearly $350. That's what it costs to get "protection for your home and family, thanks to the wearable holographic nano-layer catalyser, which can be worn or placed near to a smartphone or any other electrical, radiation or EMF emitting device." "The 5GBioShield makes it possible, thanks to a uniquely applied process of quantum nano-layer technology, to balance the imbalanced electric oscillations arising from all electric fog induced by all devices such as: laptops, cordless phones, wlan, tablets, etc.," the company says, adding that the USB stick "brings balance into the field at the atomic and cellular level restoring balanced effects to all harmful (ionized and non-ionized) radiation." The USB stick apparently doesn't need to be plugged in to anything to work its magic. "It is always ON and working—that's why we used quantum nano-layer technology," the company says in an FAQ. But the device allegedly produces a wider field of protection when it is plugged in. To answer the question of whether the stick needs to be "charged regularly," the FAQ says, "No—the input charge only expands the field effect from 4m radius to 20m + radius when plugged into an USB wall charger or a computer." Fortunately, you can use 5GBioShield without disabling your Wi-Fi. The USB key doesn't block Wi-Fi signals, the company says. Instead, the product "transmutes" the signals and "harmonizes all harmful frequencies into life affirming frequencies."' -- source: https://arstechnica.com/tech-policy/2020/05/5g-conspiracy-theorists-sell-35… Oh dear... Techno-babble to scam the uneducated always seems to work... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Using Curl to make REST API requests
by Peter Reutemann 29 May '20

29 May '20

'An application program interface (API) is a set of definitions and protocols that allows software programs to communicate with each other. The term REST stands for representational state transfer. It is an architectural style that consists of a set of constraints to be used when creating web services. RESTful API is an API that follows the REST architecture. Typically REST APIs use the HTTP protocol for sending and retrieving data and JSON formatted responses. You can use the standard HTTP methods to create, view, update, or delete resources through the API. To test and interact with the RESTful APIs, you can use any library or tool that can make HTTP requests. API requests are made up of four different parts: - The endpoint. This is the URL that the client uses to communicate with the server. - The HTTP method. It tells the server what action the client wants to perform. The most common methods are GET POST PUT DELETE and PATCH - The headers. Used to pass additional information between the server and the client, such as authorization. - The body. The data sent to the server. In this article, we’re going to discuss how to use curl to interact with RESTful APIs. curl is a command-line utility for transferring data from or to a remote server. It is installed by default on macOS and most Linux distributions.' -- source: https://linuxize.com/post/curl-rest-api/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Raspberry Pi 4 model comes with a ton of RAM: 8GB
by Peter Reutemann 29 May '20

29 May '20

'Hot off the launch of an interchangeable camera system earlier this month, Raspberry Pi is introducing a new configuration of the Pi4: a model with a whopping 8GB of RAM. The new, highest-end config for the Pi 4 will run you $75. The 8GB version of the Raspberry Pi 4 has been long rumored, thanks to Raspberry Pi itself leaking the existence of an 8GB model. The blog post reveals that an 8GB model was always a possibility and says, "We were so enthusiastic about the idea that the non-existent product made its way into both the Beginner’s Guide and the compliance leaflet." The Raspberry Pi 4 launched last year with a faster SoC, more RAM, dual micro-HDMI, USB 3.0 support, and a USB-C charging port. In addition to the usual server and hobbyist uses, Raspberry Pi promoted performance on par with an "entry-level x86 PC" and dual-monitor desktop uses.' -- source: https://arstechnica.com/gadgets/2020/05/new-raspberry-pi-4-model-comes-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian hackers are exploiting bug that gives control of US servers
by Peter Reutemann 29 May '20

29 May '20

'A Russian hacking group tied to power-grid attacks in Ukraine, the world’s most destructive data wiper worm, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners. In an advisory published on Thursday, the US National Security Agency said that the Sandworm group was actively exploiting a vulnerability in Exim, an open source mail transfer agent, or MTA, for Unix-based operating systems. Tracked as CVE-2019-10149, the critical bug makes it possible for an unauthenticated remote attacker to send specially crafted emails that execute commands with root privileges. With that, the attacker can install programs of their choosing, modify data, and create new accounts.' -- source: https://arstechnica.com/information-technology/2020/05/russian-hackers-are-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Digital Signage Moving To Linux?
by Lawrence D'Oliveiro 28 May '20

28 May '20

The Register regularly collects reports of computer-controlled public signage malfunctioning in an amusing way. In this latest instalment <https://www.theregister.co.uk/2020/05/27/bork/>, there is an interesting mention: The company went on to tell us that the units run Windows 10, but "we're about to upgrade all of our production machines to a custom Linux build to improve their stability and generally operate with more efficiency." One of the reader comments mentions a company called “Screenly”, which offers a product in both open-source and proprietary-paid forms.

1 0

meeting next month
by Peter Reutemann 28 May '20

28 May '20

Hi everyone Just got contacted by the timetabling people that look after the room bookings for WLUG (and also Python). No evening bookings are allowed till the campus fully operational again. At least the June meetings will be virtual ones again. Having said that, would you like to present something during June? Then please contact me (can be off-list). :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Choosing 2FA authenticator apps can be hard. Ars did it so you don’t have to
by Peter Reutemann 28 May '20

28 May '20

'Last year, Sergio Caltagirone found himself in a tough spot. While traveling, his phone broke and stopped working completely. With no access to his Google and Microsoft authenticator apps, he lost access to two-factor authentication when he needed it most—when he was logging in from IP addresses not recognized by the 30 to 40 sites he had enrolled. “I had a whole bunch of sites [that] I had to go through a massively long account restoration process because I lost my 2FA,” said Caltagirone, who is senior VP of threat intelligence at security firm Dragos. “Every time, I had to contact customer service. I had different levels of requirements I had to go through for them to effectively disable 2FA on my account. Some required address verification. [For others,] I had to send a last bill. The number of those I went through was just insane.” The experience shows the double-edged sword of multi-factor authentication. Requiring users to enter a password that’s pseudorandomly generated every 30 seconds makes account takeovers significantly harder, even when an attacker has phished or otherwise obtained the password. But in the event that second factor (in this case, the “something you have,” that is, the phone) isn’t available, that same protection can block legitimate users from logging in for unacceptably long periods of time. When Caltagirone relayed his experience last September, a quick survey of the available consumer and small-business authenticators left much to be desired. Only a few of them made it possible to back up the unique cryptographic seeds that each phone uses to generate a time-based one-time password, or TOTP. Websites—including Google, Github, Facebook, and hundreds of others that implement the Time-Based One-Time Password Algorithm standard—require the temporary password to log in users who opt in to 2FA. The result? When your device was stolen, lost, or stopped working, you had to go through the same painful and time-consuming account recoveries Caltagirone did. The lack of a backup and recovery mechanism meant the only viable way to hedge against a device loss or malfunction was to print, scan, or photograph each QR code or the underlying Web link (for instance, http://USERNAME(a)salesforce.com/?secret=LZZIKRWX736EH2IQ&issuer=Slack) it represented. That was time consuming. Even worse, it was cumbersome and insecure to store them, particularly when traveling.' -- source: https://arstechnica.com/information-technology/2020/05/choosing-2fa-authent… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

OpenSSH To Deprecate SHA-1 Logins Due To Security Risk
by Peter Reutemann 28 May '20

28 May '20

'OpenSSH, the most popular utility for connecting to and managing remote servers, has announced today plans to drop support for its SHA-1 authentication scheme. From a report: The OpenSSH team cited security concerns with the SHA-1 hashing algorithm, currently considered insecure. The algorithm was broken in a practical, real-world attack in February 2017, when Google cryptographers disclosed SHAttered, a technique that could make two different files appear as they had the same SHA-1 file signature. At the time, creating an SHA-1 collision was considered computationally expensive, and Google experts thought SHA-1 could still be used in practice for at least half a decade until the cost would go down. However, subsequent research released in May 2019 and in January 2020, detailed an updated methodology to cut down the cost of an SHA-1 chosen-prefix collision attack to under $110,000 and under $50,000, respectively. ' -- source: https://it.slashdot.org/story/20/05/27/1830211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Tech’s Volkswagen Moment”
by Lawrence D'Oliveiro 27 May '20

27 May '20

Love the use of the phrase “Volkwagen moment”. A researcher investigating Trend Micro’s antimalware software <https://www.theregister.co.uk/2020/05/20/trend_accused_microsoft_cheating/> has discovered a routine in it which appears to be able to tell when the software is running within Microsoft’s WHQL test suite, so the code can behave one way during testing and certification, and a different way while running on ordinary punters’ PCs. Trend Micro’s response seems to be trying to have it both ways, on the one hand denying it is doing such a thing, on the other trying to cast aspersions on the researcher for going public without contacting them first. But as a reader comment <https://forums.theregister.co.uk/forum/all/2020/05/20/trend_accused_microso…> points out, such a “responsible-disclosure” process is supposed to apply to security bugs. However, this appears to be a deliberate feature.

1 1

India Open Sources Its Contact-Tracing App
by Peter Reutemann 27 May '20

27 May '20

'India has released the source code of its contact-tracing app, Aarogya Setu, to the relief of privacy and security experts who have been advocating for this ever since the app launched in early April. >From a report: Ministry of Electronics and Information Technology Secretary Ajay Prakash Sawhney made the announcement on Tuesday, dubbing the move "opening the heart" of the Aarogya Setu app to allow engineers to inspect and tinker with the code. The app has amassed over 114 million users in less than two months -- an unprecedented scale globally. The source code of Aarogya Setu's Android app is live on GitHub with code of iOS and KaiOS apps slated to release in a "few weeks." Nearly 98% of the app's users are on the Android platform. Sawhney said the government will also offer cash prizes of up to $1,325 to security experts for identifying and reporting bugs and vulnerabilities. "Open-sourcing Aarogya Setu is a unique feat for India. No other government product anywhere in the world has been open-sourced at this scale," said Amitabh Kant, chief executive of government-run think-tank NITI Aayog, in a press conference today.' -- source: https://news.slashdot.org/story/20/05/26/1954212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Android Vulnerability Strandhogg 2.0 Exploits User Trust
by Peter Reutemann 27 May '20

27 May '20

'A Norwegian infosec firm discovered a new Android vulnerability, which they've dubbed Strandhogg 2.0. Security firm Promon says "Strandhogg" is an old Norse strategy for coastline raids and abductions, and today's vulnerability is the "evil twin" of a similar one discovered in 2019. The original Strandhogg used an Android feature called taskAffinity to hijack applications -- by setting the taskAffinity of one of its activities to match the packageName of any other app, then setting allowTaskReparenting="true" in its own manifest, the Strandhogg app would be launched in place of the target app. Strandhogg's 1.0 major weakness was the need to declare taskAffinity in the Android Manifest. The Manifest is a plain XML file and must be included in the package hosted at the Play Store itself -- it can't simply be downloaded later, after the app is installed. This made it relatively simple to scan the Play store for apps with sketchy-looking taskAffinity declarations. Strandhogg 2.0 doesn't require any special settings in a package's Android Manifest -- meaning the attacking code doesn't need to be present on the Play Store to be scanned at all. Instead, the attacker can download the attack code later, once the trojan app or game is already installed on a user's device. In addition to the obvious credential-stealing attacks, Strandhogg can be used to trick users into escalating its privileges based on the trust they have for the apps it hijacks. For example, a user tapping Camera is asked if they want to grant it permission to access the camera and microphone -- if the user taps Yes, they've actually given those privileges to the malware app, not the Camera app it covered up on the screen. Strandhogg 2.0 affects all versions of Android prior to 10 -- which translates to roughly 90 percent of the Android userbase. Google rolled out a patch to close the Strandhogg 2.0 vulnerability, CVE-2020-0096, in May's Android Security Update. This is good news for Pixel users -- but as always, carriers and OEMs may delay those upgrades significantly.' -- source: https://it.slashdot.org/story/20/05/26/211241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds Dumps Intel For 32-core AMD Ryzen On His Personal PC
by Peter Reutemann 26 May '20

26 May '20

'Linus Torvalds released Linux 5.7 rc7 today, saying it "looks very normal... none of the fixes look like there's anything particularly scary going on." But then he added something else: [T]he biggest excitement this week for me was just that I upgraded my main machine, and for the first time in about 15 years, my desktop isn't Intel-based. No, I didn't switch to ARM yet, but I'm now rocking an AMD Threadripper 3970x. My 'allmodconfig' test builds are now three times faster than they used to be, which doesn't matter so much right now during the calming down period, but I will most definitely notice the upgrade during the next merge window. The Register writes: Torvalds didn't divulge any further details about his new rig, but the 3970x is quite the beast, boasting 32 cores and 64 threads at 3.7GHz with the ability to burst up to 4.5GHz, all built on TSMC's 7nm FinFET process... Torvalds has probably acquired a whole new PC, as the Threadripper range requires a sTRX4 socket and those debuted on motherboards from late 2019. Whatever he's running, it has more cores than Intel currently offers in a CPU designed for PCs. Even Chipzilla's high-end CoreX range tops out at 18 cores. AMD will be over the moon that such a high profile IT pro has adopted their kit and pointed to its performance. Or, as long-time Slashdot reader williamyf puts it, "Good endorsement for AMD, a PR blow for Intel."' -- source: https://linux.slashdot.org/story/20/05/25/020240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Thousands of Enterprise Systems Infected by New Blue Mockingbird Malware Gang
by Peter Reutemann 26 May '20

26 May '20

'Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird. From a report: Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019. Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component. Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence. Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.' -- source: https://tech.slashdot.org/story/20/05/25/1913201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

eBay Port Scans Visitors' Computers For Remote Access Programs
by Peter Reutemann 26 May '20

26 May '20

'When visiting the eBay.com site, a script will run that performs a local port scan of your computer to detect remote support and remote access applications. Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more. After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.' -- source: https://it.slashdot.org/story/20/05/25/161246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Security Report Finds Library-Induced Flaws in 70% of Applications
by Peter Reutemann 25 May '20

25 May '20

' The State of Software Security (SOSS): Open Source Edition "analyzed the component open source libraries across the Veracode platform database of 85,000 applications which includes 351,000 unique external libraries," reports TechRepublic. "Chris Eng, chief research officer at Veracode, said open source software has a surprising variety of flaws." "An application's attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies," he said. The study found that 70% of applications have a security flaw in an open source library on an initial scan. Other findings from the report: - The most commonly included libraries are present in over 75% of applications for each language. - 47% of those flawed libraries in applications are transitive. - More than 61% of flawed libraries in JavaScript contain vulnerabilities without corresponding common vulnerabilities and exposures (CVEs). - Fixing most library-introduced flaws can be done with a minor version upgrade. - Using any given PHP library has a greater than 50% chance of bringing a security flaw along with' -- source: https://developers.slashdot.org/story/20/05/23/2330244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromium Project Finds 70% of Its Serious Security Bugs Are Memory Safety Problems
by Peter Reutemann 25 May '20

25 May '20

'"Around 70% of our serious security bugs are memory safety problems," the Chromium project announced this week. "Our next major project is to prevent such bugs at source." ZDNet reports: The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating. The number is identical to stats shared by Microsoft. Speaking at a security conference in February 2019, Microsoft engineers said that for the past 12 years, around 70% of all security updates for Microsoft products addressed memory safety vulnerabilities. Both companies are basically dealing with the same problem, namely that C and C++, the two predominant programming languages in their codebases, are "unsafe" languages.... Google says that since March 2019, 125 of the 130 Chrome vulnerabilities with a "critical" severity rating were memory corruption-related issues, showing that despite advances in fixing other bug classes, memory management is still a problem... Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components... While software companies have tried before to fix C and C++'s memory management problems, Mozilla has been the one who made a breakthrough by sponsoring, promoting and heavily adopting the Rust programming language in Firefox... Microsoft is also heavily investing in exploring C and C++ alternativesâ¦ But this week, Google also announced similar plans as well... Going forward, Google says it plans to look into developing custom C++ libraries to use with Chrome's codebase, libraries that have better protections against memory-related bugs. The browser maker is also exploring the MiraclePtr project, which aims to turn "exploitable use-after-free bugs into non-security crashes with acceptable performance, memory, binary size and minimal stability impact." And last, but not least, Google also said it plans to explore using "safe" languages, where possible. Candidates include Rust, Swift, JavaScript, Kotlin, and Java.' -- source: https://developers.slashdot.org/story/20/05/24/1349204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'FOSS Responders' Want to Help Open-Source Groups Survive
by Peter Reutemann 25 May '20

25 May '20

'"Thanks to the coronavirus, technology events have been canceled left and right," writes ZDNet. "This, in turn, is damaging the finances of companies and groups that depend on these events." Some open-source groups, such as The Linux Foundation, can deal with it. Others aren't so fortunate. Some, such as Drupal Foundation, the Open Source Initiative (OSI), Open Source Matters (Joomla), and Ajv JSON Schema validator, are in real trouble. FOSS Responders is trying to help these and other groups and individuals... Nuritzi Sanchez, a FOSS Responder co-founder and GitLab senior open-source program manager, said: We "started out around mid-March as a response to COVID-19 event cancellations. It's a group of open source leaders from companies like Indeed, Facebook, Google, Red Hat, GitHub, GitLab, etc." They've set up a process to help both open-source individuals and organizations facing financial trouble. So far, Sanchez said, "organizations are the ones that have been reaching out most so far." They're also consolidating information on how to plan and execute virtual events and provide a place where people can look for and offer help. FOSS Responders has already had some success in raising donations. Alyssa Wright, Open Collective's director of social engineering, reports that it's raised funds from Indeed, Open Source Collective, Linux Fund, GitHub, Google, Sentry, Ethereum Foundation, and the Sloan Foundation. As a result "FOSS Responders is contributing over $100K to open-source organizations that are experiencing financial strain because of the COVID-19 pandemic." "The main focus of philanthropic efforts will be elsewhere, as they should be," noted LWN.net back in March, "but it is nice to see our community finding ways to help itself out internally."' -- source: https://news.slashdot.org/story/20/05/23/2351224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Patent Troll Sent Packing
by Lawrence D'Oliveiro 22 May '20

22 May '20

<https://www.theregister.co.uk/2020/05/21/gnome_foundation_settles_patent_tr…>: In an article comment on this story, [CEO Neil] McGovern said: "For those asking about payment, I can confirm we paid RPI and Leigh Rothschild a grand total of $0.00 for the settlement."

1 0