- wlug - list.wlug.org.nz

GCHQ’s Advice For Securing Smart-Home Gadgets
by Lawrence D'Oliveiro 05 Mar '20

05 Mar '20

For those who can’t be bothered trying to understand the ins and outs of security concerns with “Internet-Of-Things” devices <https://www.theregister.co.uk/2020/03/03/ncsc_smart_gadget_security_tips/> such as cameras and baby monitors, GCHQ advises: * If your camera comes with a default password, change it to a secure one – connecting three random words which you'll remember is a good way to do this. You can usually change your password using the app you use to manage the device. * Keep your camera secure by regularly updating security software. Not only does this keep your devices secure, but often adds new features and other improvements. * If you do not use the feature that lets you remotely access the camera from the internet, it is recommended you disable it.

1 0

Let’s Encrypt discovers CAA bug, must revoke customer certificates
by Peter Reutemann 05 Mar '20

05 Mar '20

'On Leap Day, Let's Encrypt announced that it had discovered a bug in its CAA (Certification Authority Authorization) code. The bug opens up a window of time in which a certificate might be issued even if a CAA record in that domain's DNS should prohibit it. As a result, Let's Encrypt is erring on the side of security and safety rather than convenience and revoking any currently issued certificates it can't be certain are legitimate, saying: Unfortunately, this means we need to revoke the certificates that were affected by this bug, which includes one or more of your certificates. To avoid disruption, you'll need to renew and replace your affected certificate(s) by Wednesday, March 4, 2020. We sincerely apologize for the issue. If you're not able to renew your certificate by March 4, the date we are required to revoke these certificates, visitors to your site will see security warnings until you do renew the certificate.' -- source: https://arstechnica.com/information-technology/2020/03/lets-encrypt-revokin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Microsoft Retiring MCSA/MCSD/MCSE Certifications
by Lawrence D'Oliveiro 04 Mar '20

04 Mar '20

Came across this Microsoft article <https://www.microsoft.com/en-us/learning/community-blog-post.aspx?BlogId=8&…> (linked from this YouTube video <https://www.youtube.com/watch?v=laaGuJItNCM>) explaining that Microsoft is “retiring” its more broad-based MCSA, MCSD and MCSE certifications in favour of a range of narrower, “role-based” ones. You’ll notice in the diagram on that page that everything starts with the cloud now: Azure, Dynamics 365 and Microsoft 365. And as we know, Microsoft has previously admitted that Azure is more about Linux instances rather than Windows ones. Myself, I never understood the emphasis on vendor-specific certifications. They have a short shelf-life, requiring continual “refreshing” or “updating” to new product versions--basically another revenue stream for the vendor.

1 0

Cisco: Avoid Coronavirus, Stay Home, Use Webex
by Peter Reutemann 04 Mar '20

04 Mar '20

'Ars Technica: Networking giant Cisco is getting into the coronavirus monitoring and mitigation game with its Webex remote meeting property. The company notes that in the wake of mandates issued to employees to halt travel plans and/or work from home, traffic across its Webex backbone has increased significantly. Webex meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began; traffic in other Asian countries is up by 400 percent or more, and free signup rates in impacted countries have increased 700 percent or more. In response, Cisco is offering temporarily unlimited usage (with no time restrictions) in all countries where the service is available (full list here), not just the ones worst hit by coronavirus. The company is also offering free 90-day licenses to businesses that are not currently Webex customers and offering free upgrades to customers whose current plan is insufficient to accommodate increased traffic due to the outbreak. In the worst affected countries, telepresence and remote work software like Webex is currently the only alternative to a complete shutdown of activities. In its press release, Cisco highlights the Nesbitt Center, an organization working with disabled young adults in Hong Kong. All Hong Kong schools, including the Nesbitt Center, have been required to suspend day programs during the outbreak. Webex videoconferencing has allowed the Nesbitt Center to continue delivering educational sessions despite the lockdown. Ars Technica also recommends Jitsi, a "free and open source software, offering video call and screen sharing capabilities." There's also Jitsi Meet for people "who just need to get something done on-the-fly with no setup at all." Do you have a favorite remote work software?' -- source: https://tech.slashdot.org/story/20/03/03/2013226/cisco-avoid-coronavirus-st… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If You Like RSS, You'll Love Fraidycat
by Peter Reutemann 04 Mar '20

04 Mar '20

'J. Fergus, writing for Input: Someone finally did it. We can now follow who we want on our own terms and get that information chronologically. Fraidycat is an app and browser extension that allows just that. Though it launched in November 2019, Fraidycat recently got a massive update, widening its compatibility and adding a dark mode. The open-source tool, brought to you by Kicks Condor, is available for Linux, Mac, and Windows in addition to Mozilla Firefox and Chrome as an extension. Fraidycat definitely pulls from RSS feeds more easily, but it also works on Twitter, Instagram, and SoundCloud. You drop the link to the account you'd like to follow -- from Medium bloggers to Twitch streamers to vision board Pinterest-ers -- and set how frequently you'd like to see their posts. Label it, hit save, and posts will appear as often as you'd like. The recent update notably folds Kickstarter into the mix and collapses Twitter threads for readability.' -- source: https://tech.slashdot.org/story/20/03/03/1441254 Personally, I use the "Feeder" app on my phone for my RSS feeds: https://f-droid.org/en/packages/com.nononsenseapps.feeder/ But Fraidycat looks like an interesting project. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox: removing "Save link to Pocket" menu item
by Peter Reutemann 04 Mar '20

04 Mar '20

Hi everyone Ever got annoyed at the "Save link to Pocket" in Firefox's right-click popup menu? In case you don't use that feature (like me), here's how you can turn it off (and also re-enable): https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox It boils down to toggling the following setting ("about:config"): extensions.pocket.enabled Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Freedb.org Is Shutting Down
by Peter Reutemann 03 Mar '20

03 Mar '20

'Freedb, the community-generated database of music CD metadata, is shutting down on March 31, 2020. The service was set up as a free alternative to CDDB. Many CD-ripping applications pull metadata from Freedb to save the user having to type it in manually, but the service has some major limitations and has now been superseded by MusicBrainz. This wouldn't be the first time Freedb shut down. In 2006, the site shut down due to a disagreement among its developers, only to be brought back to life a few months later. It's unclear why Freedb is shutting down after all these years.' -- source: https://developers.slashdot.org/story/20/03/02/2245216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Have I Been Pwned' Is No Longer For Sale
by Peter Reutemann 03 Mar '20

03 Mar '20

'Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced in a blog post today that his website is no longer being sold and will continue running independently. The news comes several months after Hunt announced he was actively looking for a buyer. Last June, Hunt wrote: "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat. It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own." Now, according to Hunt, "unexpected changes" with the business model of the party believed to be the purchaser of the service "made the deal infeasible." "It wasn't something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers," writes Hunt in today's blog post. Hunt goes on to explain what's been happening since April 2019 and how the service will operate in the future. ' -- source: https://it.slashdot.org/story/20/03/02/2148230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Update On Microsoft's 'GitHub Arctic Vault Program'
by Peter Reutemann 02 Mar '20

02 Mar '20

'news.com.au reports: The GitHub Arctic Vault program is part of the now Microsoft-owned code repository GitHub...aimed at preserving the information for generations to come... "We chose to store GitHub's public repositories in the Arctic World Archive in Svalbard [a Norwegian island] because it is one of the most remote and geopolitically stable places on Earth and is about a mile down the road from the famous Global Seed Vault," said GitHub vice president of special projects Thomas Dohmke. Mr Dohmke said open source code in particular was worth preserving... "Ultimately, it's time to create multiple durable backups of the software our world depends on..." Other treasures include the original source code for MS-DOS (the precursor to Microsoft Windows), the open source code that powers Bitcoin, Facebook's React, and the publishing platform Wordpress... "The Arctic Code Vault was just the beginning of the GitHub Archive Program's journey to secure the world's open source code," GitHub vice president of special projects Thomas Dohmke told news.com.au. "We've partnered with multiple organisations and advisers to help us maximise the GitHub Archive Program's value and preserve all open-source software for future generations." One of those partners is Norwegian archival experts Piql, who specialise in very-long-term data storage. The company uses around 200 silver halide and polyester film reels designed to last a thousand years to store the information... ' -- source: https://developers.slashdot.org/story/20/03/01/2015212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostcat Bug Impacts All Apache Tomcat Versions Released in the Last 13 Years
by Peter Reutemann 01 Mar '20

01 Mar '20

'Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.' -- source: https://apache.slashdot.org/story/20/02/28/184218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Domain Costs Going Up
by Lawrence D'Oliveiro 29 Feb '20

29 Feb '20

InternetNZ is seeing fewer registrations of .nz domains, so it is raising prices <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123126…>. Apparently some are using .kiwi, and others are simply setting up pages on Facebook instead.

1 0

How Melissa Di Donato Is Going To Reinvent SUSE
by Peter Reutemann 28 Feb '20

28 Feb '20

'SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.' -- source: https://www.linux.com/topic/open-source/how-melissa-di-donato-is-going-to-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Linux Computer Gets Twice the RAM and USB-C Power Fix
by Peter Reutemann 28 Feb '20

28 Feb '20

'Brian Fagioli, writing for BetaNews: The Raspberry Pi line has provided great little Linux computers to nerds -- its low price and small size makes it ideal for tinkering and doing projects. But also, the device has proven to be a solid media device, wonderful for watching videos and emulating classic video games. In other words, it has been a very versatile computer, serving as many things to many people. With the release of the Raspberry Pi 4, however, it finally became powerful enough to serve as a true desktop computer. By installing a Linux distribution, some people can use it for day-to-day computer use, such as web browsing, playing media, and word processing. Unfortunately, the $35 base model came with a paltry 1GB of RAM. Today, this changes, as the company has dropped the price of the 2GB version to $35, effectively doubling the memory for the base model.' -- source: https://linux.slashdot.org/story/20/02/27/1520258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quotes From RSA
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Among the plethora of pithy apothegms from the panel of crypto experts at the RSA Conference <https://www.theregister.co.uk/2020/02/26/rsa_2020_panel_discussion/>: “I give fusion power a higher chance of succeeding than quantum computing.” -- Ron Rivest “Blockchain is the wrong security technology for voting. I like to think of it as bringing a combination lock to a kitchen fire.” -- Ron Rivest “Intelligence is not about playing fair, it is about succeeding.” -- Whitfield Diffie, on the Crypto AG backdooring saga “I would like to understand how right to be forgotten could be for anything except to keep the little people in line. It is not the right to be forgotten by the secret police.” -- Whitfield Diffie Of course, there were some dissenting opinions to that last one ...

1 0

Smithsonian Releases 2.8 Million Images And 3D Models Into The Public Domain
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Just came across this news report <https://www.techdirt.com/articles/20200225/14150743985/smithsonian-releases…> about the Smithsonian Institution making a whole bunch of stuff available for free download and reuse under a Creative Commons CC0 licence. More info on their home page <https://www.si.edu/OpenAccess>. I had a quick look at one or two 3D models from <https://3d.si.edu/cc0>, and I see OBJ, glTF (OpenGL Transfer Format) and GLB (binary version of glTF) options available. These are all open formats, well-supported in non-proprietary software.

2 1

Ars takes the new Opera R2020 browser for a spin
by Peter Reutemann 27 Feb '20

27 Feb '20

'Conclusion We've been briefly excited by lesser-known browsers many times in the last 20 years, only to eventually gravitate back to the most comfortable of the big, common options. But the tide may be turning for lesser-known options like Opera. Using the same Chromium open source browser upstream as Google Chrome and Microsoft Edge do, there aren't likely to be many compatibility surprises—at least for Windows and Mac users. The Good - Opera feels both fast and familiar (enough) for anyone accustomed to Google Chrome, Microsoft Edge, or Firefox - First-rate Linux installation and update experience - The stand-out features feel immediately useful—Snapshot, VPN, Workspaces, pinned Messengers, and My Flow all fit very neatly and obviously into our existing workflows - Chromium upstream base means sites render familiarly and accurately to Chrome or Edge users - Battery saver feature makes bloated sites feel less bloated and wasteful, even on a desktop The Bad - Unit and currency conversion is still a little wonky and limited - DRM is completely non-functional on Linux The Ugly - Many Linux users won't care about broken DRM for philosophical reasons—but they won't use a non-Libre browser, for the same philosophical reasons' -- source: https://arstechnica.com/gadgets/2020/02/browser-review-opera-r2020-and-oper… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw in Billions of Wi-Fi Devices Left Communications Open To Eavesdropping
by Peter Reutemann 27 Feb '20

27 Feb '20

'Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."' -- source: https://mobile.slashdot.org/story/20/02/26/165207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Mac and Linux To Get a New Security Sandbox System
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.' -- source: https://news.slashdot.org/story/20/02/25/2028214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Enable DNS-over-HTTPS by Default To US Users
by Peter Reutemann 26 Feb '20

26 Feb '20

'Mozilla will bring its new DNS-over-HTTPS security feature to all Firefox users in the U.S. by default in the coming weeks, the browser maker has confirmed. From a report: It follows a year-long effort to test the new security feature, which aims to make browsing the web more secure and private. Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send a user to a malicious site. These unencrypted DNS queries can also be used to snoop on which websites a user visits. DoH works at the app-level, and is baked into Firefox. The feature relies on sending DNS queries to third-party providers -- such as Cloudflare and NextDNS -- both of which will have their DoH offering baked into Firefox and will process DoH queries.' -- source: https://it.slashdot.org/story/20/02/25/1210223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PayPal Accounts Are Getting Abused En-masse For Unauthorized Payments
by Peter Reutemann 26 Feb '20

26 Feb '20

'Hackers have found a bug in PayPal's Google Pay integration and are now using it to carry out unauthorized transactions via PayPal accounts. From a report: Since last Friday, users have reported seeing mysterious transactions pop up in their PayPal history as originating from their Google Pay account. Issues have been reported on numerous platforms, such as PayPal's forums, Reddit, Twitter, and Google Pay's Russian and German support forums. Victims reported that hackers abused Google Pay accounts to buy products using linked PayPal accounts. According to screenshots and various testimonies, most of the illegal transactions are taking place at US stores, and especially at Target stores across New York. Most of the victims appear to be German users.' -- source: https://it.slashdot.org/story/20/02/25/1213209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Licences: What, Which & Why
by Lawrence D'Oliveiro 25 Feb '20

25 Feb '20

A good overview <https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-licens…> for anybody having anything to do with Open Source, not just those trying to decide what licence to choose for their own projects. Basic recommendation: stick to something approved by the Open Source Initiative, and above all avoid making up a licence of your own.

2 1

EU Commission To Staff: Switch To Signal Messaging App
by Peter Reutemann 25 Feb '20

25 Feb '20

'The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. From a report: The instruction appeared on internal messaging boards in early February, notifying employees that "Signal has been selected as the recommended application for public instant messaging." The app is favored by privacy activists because of its end-to-end encryption and open-source technology. "It's like Facebook's WhatsApp and Apple's iMessage but it's based on an encryption protocol that's very innovative," said Bart Preneel, cryptography expert at the University of Leuven. "Because it's open-source, you can check what's happening under the hood," he added. Signal was developed in 2013 by privacy activists. It is supported by a nonprofit foundation that has the backing of WhatsApp founder Brian Acton, who had left the company in 2017 after clashing with Facebook's leadership.' -- source: https://tech.slashdot.org/story/20/02/24/1430211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple To Release First ARM Mac Without Intel Processor in Next 18 Months, Predicts Kuo
by Peter Reutemann 25 Feb '20

25 Feb '20

Since we were talking about ARM chips at last night's meeting, this seems an interesting bit of news: 'Ming-Chi Kuo is out with a new analyst note today and the most interesting part of his forecast is that Apple will release its first Mac with an ARM processor in the first half of 2021. From a report: Kuo is predicting that one of Apple's new products to be released within the next 12-18 months will be a Mac with an in-house processor, instead of using an Intel CPU. There have been growing reports over the last couple of years about Apple making the switch to a custom-designed ARM processor for its Macs and today's report gives a concrete timeframe for when to expect that launch, which has actually held true since Kuo's prediction back in 2018. Since the coronavirus outbreak, Kuo highlights that Apple has been "more aggressive" with its funding for research, development, and production of 5nm process chips that are expected to show up in the first Macs with ARM CPUs. That's because 5nm chips will be integral to iPhone, iPad later this year, as well as Macs come 2021.' -- source: https://apple.slashdot.org/story/20/02/24/184242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tablet converted from Win10 to Linux
by Ian Stewart 25 Feb '20

25 Feb '20

Hi Guys, A correction to my story at last nights meeting about converting a tablet from running Win10 to running Debian LXDE. In looking back at the notes I made during this installation, the tablet was an ACER Switch 10 - Model SW5-012. It's CPU is an Intel Atom Processor Z3735F, 4x core, 64-bit, 1.33GHz. Last night I thought its CPU was an ARM chip. However it seems that this CPU has a similarity to ARM in that it needs to initially boot images written in 32-bit code in order to start booting the 64 bit Linux. Although I didn't succeed, in theory I could have installed a 64-bit Ubuntu LXDE 19.10 version, and got it to boot by putting 32 bit images into the /boot partition. That is according to this<https://www.instructables.com/id/Linux-Kiosk-Tablet-From-Acer-Aspire-Switch…> document. Instead I used the debian-live-10.2.0-i386-lxde.iso image and booted it from a USB stick to do an installation to the tablets MMC drive. At the moment the Debian Live team only produce i386 and AMD64 iso's. They do not produce an ARM iso. So the installation approach I took with this tablet, wouldn't work with Mike's PINEBook Pro (ARM) laptop. cheers, Ian.

1 0

Gopher's Rise and Fall Shows How Much We Lost When Monopolists Stole the Net
by Peter Reutemann 23 Feb '20

23 Feb '20

'Science-fiction writer, journalist and longtime Slashdot reader, Cory Doctorow, a.k.a. mouthbeef, writes: The Electronic Frontier Foundation (EFF) just published the latest installment in my case histories of "adversarial interoperability" -- once the main force that kept tech competitive. Today, I tell the story of Gopher, the web's immediate predecessor, which burrowed under the mainframe systems' guardians and created a menu-driven interface to campus resources, then the whole internet. Gopher ruled until browser vendors swallowed Gopherspace whole, incorporating it by turning gopher:// into a way to access anything on any Gopher server. Gopher served as the booster rocket that helped the web attain a stable orbit. But the tools that Gopher used to crack open the silos, and the moves that the web pulled to crack open Gopher, are radioactively illegal today. If you wanted do to Facebook what Gopher did to the mainframes, you would be pulverized by the relentless grinding of software patents, terms of service, anticircumvention law, bullshit theories about APIs being copyrightable. Big Tech blames "network effects" for its monopolies -- but that's a counsel of despair. If impersonal forces (and not anticompetitive bullying) are what keeps tech big then there's no point in trying to make it small. Big Tech's critics swallow this line, demanding that Big Tech be given state-like duties to police user conduct -- duties that require billions and total control to perform, guaranteeing tech monopolists perpetual dominance. But the lesson of Gopher is that adversarial interoperability is judo for network effects.' -- source: https://tech.slashdot.org/story/20/02/21/2240222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Dongle!!
by john 21 Feb '20

21 Feb '20

Hi All, Anyone care to help me with this issue please?? I just bought a USB Bluetooth adapter the icon on the desktop states ' standard: Detected Distance:255;Current State:gone; Status:No bluetooth device configured... Simulation mode (locking disabled)' Output from terminal. lsusb. Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode) Output from "dmesg" 15.616762] Bluetooth: Core ver 2.22 [ 15.616785] NET: Registered protocol family 31 [ 15.616786] Bluetooth: HCI device and connection manager initialized [ 15.616790] Bluetooth: HCI socket layer initialized [ 15.616793] Bluetooth: L2CAP socket layer initialized [ 15.616800] Bluetooth: SCO socket layer initialized [ 18.714533] Bluetooth: BNEP (Ethernet Emulation) ver 1.3stan [ 18.714536] Bluetooth: BNEP filters: protocol multicast [ 18.714542] Bluetooth: BNEP socket layer initialized [ 20.153867] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.246093] r8169 0000:01:00.0 enp1s0: link down [ 20.246348] IPv6: ADDRCONF(NETDEV_UP): enp1s0: link is not ready [ 20.258191] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.289093] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 20.548998] IPv6: ADDRCONF(NETDEV_UP): wlx0019e08c5078: link is not ready [ 21.932491] wlx0019e08c5078: authenticate with 18:f1:45:96:63:4b [ 21.937373] wlx0019e08c5078: send auth to 18:f1:45:96:63:4b (try 1/3) [ 21.939214] wlx0019e08c5078: authenticated [ 21.939962] wlx0019e08c5078: associate with 18:f1:45:96:63:4b (try 1/3) [ 21.942561] wlx0019e08c5078: RX AssocResp from 18:f1:45:96:63:4b (capab=0x431 status=0 aid=1) [ 21.943456] wlx0019e08c5078: associated [ 21.981876] IPv6: ADDRCONF(NETDEV_CHANGE): wlx0019e08c5078: link becomes ready [ 26.871648] Bluetooth: RFCOMM TTY layer initialized [ 26.871656] Bluetooth: RFCOMM socket layer initialized [ 26.871663] Bluetooth: RFCOMM ver 1.11

2 1

Google launches the Android 11 Developer Preview today
by Peter Reutemann 21 Feb '20

21 Feb '20

'It's a bit earlier than the usual March release, but today Google is launching the first Android 11 Developer Preview. This first OS preview is coming to the Pixel 2, 3, 3a, and 4, along with generic system images for Project Treble devices. It also has a new name. Typically these releases have been denoted by a letter—Android 10 was the "Android Q Preview"—and while Android 11 is still called "Android R" internally, publicly this is the "Android 11 Developer Preview" to all us non-Googlers. True to form, Google has already started with the Spinal Tap references and starts the blog post with a dial that goes to 11. For now we're just working off a giant blog post with lots of bullet points, and nearly zero screenshots, so we're not sure what the scope of this release is really like. We'll have a hands-on later, but for now, here are some highlights. Android 10—The Ars Technica Review One of the most-used features of Android 11 will probably be a new "one-time permission" option for apps that want to access location, microphone, and camera data. In Android 10, Google added the ability to grant a permission to an app only when it was running in the foreground, and now users will be able to grant access to a permission a single time. This is already in iOS, and it makes a lot of sense for certain apps.' -- source: https://arstechnica.com/gadgets/2020/02/google-launches-the-android-11-deve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

The Linux Foundation Identifies Most Important Open-Source Software Components and Their Problems
by Peter Reutemann 21 Feb '20

21 Feb '20

'The Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH) have revealed -- in "Vulnerabilities in the Core, a preliminary report and Census II of open-source software" -- the most frequently used components and the vulnerabilities they share. From a report: This Census II analysis and report is the first major study of its kind but isn't a final analysis. It takes important first steps and lays out a methodology for understanding and addressing open-source software structural and security complexities. Specifically, it also identifies the most commonly used free and open-source software (FOSS) components in production applications and examines them for potential vulnerabilities. To create this work, CII and LISH partnered with Software Composition Analysis (SCAs) and application security companies such as Snyk and Synopsys Cybersecurity Research Center. They combined private usage data with publicly available datasets for identifying over 200 of the most used open-source software projects. These are not the programs -- Apache, MySQL, Linux -- that probably spring to your mind. For all their foundational importance, it's the small building block programs that are most widely used. They may be small, sometimes less than a hundred lines of code (LoC), but they're vital. As Frank Nagle, a professor at Harvard Business School and co-director of the Census II project, said: "FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy."' -- source: https://news.slashdot.org/story/20/02/20/1349241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Bring Its Defender Antivirus Software To iOS and Android
by Peter Reutemann 21 Feb '20

21 Feb '20

'Microsoft said today it plans to bring its antivirus software, Defender Advanced Threat Protection, to phones and other devices running Apple's iOS and Google's Android. From a report: The software, also called Defender ATP, is already available on Windows and MacOS. It offers features like preventive protection, post-breach detection and automated investigation and response, according to Microsoft. When it comes to mobile devices, Microsoft's Rob Lefferts said that the Defender software could help companies protect employees from things like malware and phishing attacks. Apple's and Google's app stores are "pretty safe," Lefferts said, but "malware does happen on those platforms."' -- source: https://it.slashdot.org/story/20/02/20/1928225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VPN
by john 20 Feb '20

20 Feb '20

Are any of the Mozilla add-ons listed in the attachment a good thing to add to Firefox? Cheers John...

2 1

Mozilla's Standalone Firefox VPN is Now Available in Beta
by Peter Reutemann 20 Feb '20

20 Feb '20

'Mozilla has a new virtual private network service and if you have a Chromebook, a Windows 10 computer or an Android device in the US, you can start using a beta version now. From a report: Called Firefox Private Network, the new service is designed to function as a full-device VPN and give better protection when surfing the web or when using public Wi-Fi networks. The company offers two options: a free browser-extension version, which it launched in beta last year, that provides 12 one-hour VPN passes when using the Firefox browser and a Firefox account; and a second, $4.99-a-month option that provides a more complete VPN service across your whole device. The new paid option, which runs off of servers provided by Swedish open-source VPN company Mullvad, can protect up to five devices with one account. It allows for faster browsing and streaming, and gives you the ability to tap into servers located in "30-plus countries" for masking your location data.' -- source: https://news.slashdot.org/story/20/02/19/1910233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why fixing security vulnerabilities in medical devices, IoT is so hard
by Peter Reutemann 20 Feb '20

20 Feb '20

'When your family opened up that brand-new computer when you were a kid, you didn’t think of all of the third-party work that made typing in that first BASIC program possible. There once was a time when we didn't have to worry about which companies produced all the bits of licensed software or hardware that underpinned our computing experience. But recent malware attacks and other security events have shown just how much we need to care about the supply chain behind the technology we use every day. The URGENT/11 vulnerability, the subject of a Cybersecurity and Infrastructure Security Agency advisory issued last July, is one of those events. It forces us to care because it affects multiple medical devices. And it serves as a demonstration of how the software component supply chain and availability of support can affect the ability of organizations to update devices to fix security bugs—especially in the embedded computing space. URGENT/11 is a vulnerability in the Interpeak Networks TCP/IP stack (IPNet), which was licensed out to multiple vendors of embedded operating systems. IPNet also became the main networking stack in Wind River VxWorks, until Wind River acquired Interpeak in 2006 and stopped supporting IPNet. (Wind River itself was acquired by Intel in 2009 and spun off in 2018.) But the end of support didn’t stop several other manufacturers from continuing to use IPNet. When critical bugs were discovered in IPNet, it set off a scare among the numerous medical device manufacturers that run it as part of their product build.' -- source: https://arstechnica.com/information-technology/2020/02/medical-device-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 73 Attack Dog
by Lawrence D'Oliveiro 19 Feb '20

19 Feb '20

Did my roughly-monthly update of Debian Unstable yesterday, and got yet another new version of Firefox. Quite sobering to see the extra protections being triggered now, on sites that I regularly visit. I got a warning earlier today about fingerprinters on aljazeera.com, though on revisiting the site a minute ago these no longer show up. Still an amazing number of cross-site tracking cookies, also present on arstechnica.com. The report for the latter shows a couple of fingerprinters currently being blocked, even though I got no explicit warning about that. It also says that “cryptominers” are blocked by default, but when I visited a certain well-known torrent-search site which has a policy of mining bitcoins on users’ machines, it didn’t show any present on that site, even though I could still hear my machine’s fans cranking up from the increased CPU load (which went away when I closed that tab).

1 0

Google Confirms It Again Removed Alleged Spying Tool ToTok From Google Play
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google has confirmed that the popular messaging app ToTok, which is actually a spying tool used by the United Arab Emirates to track the activities of those who download it, has again been removed from the Play Store. But this time they declined to comment as to why. TechCrunch reports: Reached for comment, Google confirmed to TechCrunch that it removed the app from Google Play. In addition, Google noted the enforcement was not done in response to any external direction or request. That means the U.S. government did not get involved here, rather that Google chose to remove the app itself -- likely for a policy violation. According to The NYT's original report, ToTok had been downloaded millions of times from both Apple and Google's app stores by customers across the Middle East, Europe, Asia, Africa and North America in the few months since its launch. Citing unnamed U.S. intelligence sources, the report claimed the app had been used to track its users' "every conversation, movement, relationship, appointment, sound, and image." At the time of the app's removal, Google said the app had violated unspecified Google Play policies. The app had over 10 million installs by then, app intelligence firm Sensor Tower says. In January, ToTok's website announced the app was again available for download. The updated version submitted to Google Play included a new dialog that requested authorization to access and sync users' contact list, Vice reported. Oddly, this updated version of ToTok never ranked on Google Play's charts again.' -- source: https://yro.slashdot.org/story/20/02/17/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug In WordPress Plugin Can Let Hackers Wipe Up To 200,000 Sites
by Peter Reutemann 18 Feb '20

18 Feb '20

'WordPress site owners who use commercial themes provided by ThemeGrill are advised to update one of the plugins that come installed with these themes in order to patch a critical bug that can let attackers wipe their sites. The vulnerability resides in ThemeGrill Demo Importer, a plugin that ships with themes sold by ThemeGrill, a web development company that sells commercial WordPress themes. The plugin, which is installed on more than 200,000 sites, allows site owners to import demo content inside their ThemeGrill themes so they'll have examples and a starting point on which they can build their own sites. However, in a report published yesterday, WordPress security firm WebARX says that older versions of the ThemeGrill Demo Importer are vulnerable to remote attacks from unauthenticated attackers. Remote hackers can send a specially crafted payload to vulnerable sites and trigger a function inside the plugin. The vulnerable function resets the site's content to zero, effectively wiping the content of all WordPress sites where a ThemeGrill theme is active, and the vulnerable plugin is installed. Furthermore, if the site's database contains a user named "admin," then the attacker is granted access to that user with full administrator rights over the site.' -- source: https://it.slashdot.org/story/20/02/17/2111235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux distro review: Intel’s own Clear Linux OS
by Peter Reutemann 18 Feb '20

18 Feb '20

'Intel's Clear Linux distribution has been getting a lot of attention lately, due to its incongruously high benchmark performance. Although the distribution was created and is managed by Intel, even AMD recommends running benchmarks of its new CPUs under Clear Linux in order to get the highest scores. Recently at Phoronix, Michael Larabel tested a Threadripper 3990X system using nine different Linux distros, one of which was Clear Linux—and Intel's distribution got three times as many first-place results as any other distro tested. When attempting to conglomerate all test results into a single geometric mean, Larabel found that the distribution's results were, on average, 14% faster than the slowest distributions tested (CentOS 8 and Ubuntu 18.04.3). There's not much question that Clear Linux is your best bet if you want to turn in the best possible benchmark numbers. The question not addressed here is, what's it like to run Clear Linux as a daily driver? We were curious, so we took it for a spin.' -- source: https://arstechnica.com/gadgets/2020/02/linux-distro-review-intels-own-clea… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Samsung's Changes To Android Are Making Its Phones Less Secure, Says Google
by Peter Reutemann 18 Feb '20

18 Feb '20

'Google scolded Samsung this week for an issue discovered on the Korean phone maker's Galaxy A50. From a report: Google says Samsung made "unnecessary changes to Android's core kernel," adding the changes Samsung made threaten rather than strengthen the phone's security. The tech giant has a vested interest in making sure Android is secure for OEMs and end users alike. Earlier this week Google announced it has made measurable efforts to limit malicious apps on its Google Play Store and it's clamping down on the permissions apps can request, resulting in a 98% reduction in requests for access to user's call history and text messages. It's also been tackling more worrying bugs, like self-reinstalling ones. But in this instance, it's a hardware partner that's causing the problems. In a detailed blog post from Google's Project Zero Team, researcher Jann Honn outlines the exact issue with Samsung's changes to the Android kernel on the A50. Samsung's changes included a security feature to restrict an attacker from reading or modifying user data, but Honn says the move is "futile" and rather than bolstering security, it introduces vulnerabilities that could increase an attacker's ability to arbitrarily execute code.' -- source: https://tech.slashdot.org/story/20/02/17/1656204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 17 Feb '20

17 Feb '20

Hi everyone We have a WLUG meeting next Monday: "Michael Cree will demo his Pinebook Pro and talk about his experiences with it, as well as challenges that he has (or still has to) overcome." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266791995/ https://gettogether.community/events/3275/wlug-meeting/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Alternative Browser 'Waterfox' Acquired By System1
by Peter Reutemann 17 Feb '20

17 Feb '20

'Waterfox is an open-source web browser for x64, ARM64, and PPC64LE systems, "intended to be speedy and ethical, and maintain support for legacy extensions dropped by Firefox, from which it is forked," according to Wikipedia. (Its tabs also still have angled sides with rounded corners.) Friday Waterfox's original creator, 24-year-old Alexandros Kontos, announced that the browser "now has funding and a development team, so Waterfox can finally start to grow!" after its acquisition by a company called System1. I started Waterfox when I was 16. It was a way for me to understand how large software projects worked and the Mozilla documentation was a great introduction... I've touted Waterfox as an ethical and privacy friendly browser... I never wanted Waterfox to be a part of the hyper-privacy community. It would just feel like standards that would be impossible to uphold, especially for something such as a web browser on the internet. Throughout the years people have always asked about Waterfox and privacy, and if they've ever wanted more than it can afford, I've always pushed them to use Tor. Waterfox was here for customisations and speed, with a good level of privacy... I wasn't doing anything with Waterfox except developing it and making some money via search. Why I kept going throughout the years, I'll never know... System1 has been to Waterfox a search syndication partner. Essentially a way to have a search engine partnership (such as Bing) is through them, because companies such as Microsoft are too big and too busy to talk to small players such as Waterfox... It's probably the one easy way a browser can make money without doing anything dodgy, and it's a way I've been happy to do it without having to compromise Waterfox (and will be the same way System1 makes money from Waterfox -- nothing else). People also don't seem to understand what System1 does... "Now I can finally focus on making Waterfox into a viable alternative to the big browsers," Kontos concludes. Long-time Slashdot reader Freshly Exhumed contextualized the news with this brief history of the alternate browser ecosystem: As the usage share of web browsers continues to show a lopsideded dominance by Google Chrome, many previously-independent browsers have fallen by the wayside or have been reinvented as Chrome variants (i.e. Opera, Edge, Brave). Apple forges on with its Safari browser while other, smaller projects tend to be quite limited for multi-platform users, such as Dolphin and Bromite. Mozilla continues independently with Firefox for almost every platform, while variants such as Pale Moon and Sea Monkey have attempted to provide products that avoid drastic and/or controversial changes made by Mozilla but sometimes do not match the multi-platform support of Firefox. Let us not forget Tor, the Firefox-based anonymity-focused browser. Alex Kontos is a developer who attempted to provide continuity with dropped Firefox capabilities in his multi-platform Waterfox browser, proudly declaring that Firefox's user data sharing and telemetry collection was not included. For that privacy focus a certain popularity of Waterfox occurred. Now Kontos has revealed that his Waterfox project has been sold to System1, a company describing itself as "a consumer internet and applications company with the most powerful audience expansion platform in the industry." ' -- source: https://tech.slashdot.org/story/20/02/16/2146256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Will Soon Start Blocking Insecure Downloads
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Google has revealed plans to initially warn Chrome users about 'insecure' downloads and eventually block them outright," reports The Verge. The warnings will begin in April: "Today we're announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files," Joe DeBlasio of the Chrome security team wrote in a blog post. "Insecurely-downloaded files are a risk to users' security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users' insecurely-downloaded bank statements." Beginning with Chrome 82, due for release in April, Chrome will warn users if they're about to download mixed content executables from a secure website. Then, when version 83 is released, those executable downloads will be blocked and the warning will be applied to archive files. PDFs and .doc files will get the warning in Chrome 84, with audio, images, text, and video files displaying it by version 85. Finally, all mixed content downloads — a non-secure file coming from a secure site — will be blocked as of the release of Chrome 86. Right now, Google is estimating an October release for that build of the popular web browsing.' -- source: https://tech.slashdot.org/story/20/02/16/1926231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Talk About 'Cloud Neutrality'?
by Peter Reutemann 17 Feb '20

17 Feb '20

'"A multibillion-dollar, privately-owned infrastructure is now essential to the modern internet economy," writes Wired. And if you care about net neutrality, "That should freak you out." [T]here's an even bigger issue brewing, and it's time to start talking about it: cloud neutrality. "While its name sounds soft and fluffy," Microsoft president and general counsel Brad Smith and coauthor Carol Ann Browne write in their recent book, Tools and Weapons: The Promise and the Peril of the Digital Age, "in truth the cloud is a fortress...." Each data center costs hundreds of millions of dollars to build and many millions more to maintain; and you pretty much can't build a successful new company without them. So, thank goodness for Microsoft, right? The book means to portray this might and power as both a source of wonder and an enabling feature of the modern economy. To me, it reads like a threat. The cloud economy exists at the pleasure, and continued profit, of a handful of companies. The internet is no longer the essential enabler of the tech economy. That title now belongs to the cloud. But the infrastructure of the internet, at least, was publicly financed and subsidized. The government can set rules about how companies have to interact with their customers. Whether and how it sets and enforces those rules isn't the point, for now. It can. That's not the case with the cloud. This infrastructure is solely owned by a handful of companies with hardly any oversight. [Besides Microsoft, the article also notes Google and Amazon.] The potential for abuse is huge, whether it's through trade-secret snooping or the outright blocking, slowing, or hampering of transmission. No one seems to be thinking about what could happen if these behemoths decide it's against their interests to have all these barnacles on their flanks. They should be. Cloud companies "are essentially incubating and hosting their competition..." the article points out. "The problem is that few have the resources to replicate the cloud infrastructure, should the landlords suddenly turn on their tenants."' -- source: https://tech.slashdot.org/story/20/02/16/1847204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenPower Foundation Releases a Friendly EULA For IBM's Power ISA RISC
by Peter Reutemann 17 Feb '20

17 Feb '20

'Michael Larabel, of Phoronix, writes that the OpenPower Foundation has released a license agreement for Hardware Vendors to implement the Power ISA RISC instruction set in their processors. Hugh Blemings, the Director of OpenPower, was responsible for ensuring that the EULA is favourable and friendly towards Libre and Open Hardware projects and businesses. Of particular interest is that IBM's massive patent portfolio is automatically granted, royalty-free as long as two conditions apply: firstly, the hardware must be fully and properly Power ISA compliant, and secondly, the implementor must not "try it on" as a patent troll. Innovation in the RISC space just got a little more interesting. "Amidst the fully free and open RISC-V ISA making headway into the computing market, and ARM feeling pressured to loosen up its licensing, it seems they figured that it's best to join the party early," argues Hackaday.' -- source: https://news.slashdot.org/story/20/02/16/1743222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox, Wordpress Move to Support Lazy Loading of Images and iFrames
by Peter Reutemann 17 Feb '20

17 Feb '20

'"Lazy Loading" would augment HTML's <img> tag (and <iframe> tag) with two new attributes -- "eager" (to load immediately) and "lazy" (to load only when it becomes relevant in the viewport). Felix Arntz, a developer programs engineer at Google (and a WordPress core committer) notes the updates in the HTML specification for the lazy loading attributes, adding that it's "already supported by several browsers, including Chrome and Edge" and also the Android browser and Opera. And lazy loading can now also be toggled on for Firefox 75 Nightly users, reports Neowin, though it's disabled by default: It's not clear if it will be enabled by the time Firefox 75 reaches the stable branch but according to comments on the Bugzilla thread, it's in high demand. Previously, websites could employ lazy loading by using JavaScript but now lazy loading syntax is supported directly in the web browser. The implementation in Firefox comes after Google added the feature to its browser. Google's Arntz has also written a post describing a proposal to begin lazy-loading images by default in Wordpress. The proposed solution is available as a feature plugin WP Lazy Loading in the plugin repository. The plugin is being developed on GitHub. Your testing and feedback will be much appreciated.' -- source: https://news.slashdot.org/story/20/02/16/0229240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FSF Sends Microsoft A Blank Hard Drive For Sending Back The Windows 7 Source Code
by Peter Reutemann 16 Feb '20

16 Feb '20

'The Free Software Foundation sent Microsoft a hard drive for Valentine's Day -- along with a petition calling for the release of the source code for Windows 7 (which is no longer supported by Microsoft): It's as easy as copying the source code, giving it a license notice, and mailing it back to us. As the author of the most popular free software license in the world, we're ready to give them all of the help we can. All they have to do is ask. We want them to show exactly how much love they have for the "open source" software they mention in their advertising. If they really do love free software -- and we're willing to give them the benefit of the doubt -- they have the opportunity to show it to the world. We hope they're not just capitalizing on the free software development model in the most superficial and exploitative way possible: by using it as a marketing tool to fool us into thinking that they care about our freedom. Together, we've stood up for our principles. They can reject us, or ignore us, but what they cannot do is stop us. We'll go on campaigning, until all of us are free.' -- source: https://tech.slashdot.org/story/20/02/15/0213242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux is Ready for the End of Time
by Peter Reutemann 16 Feb '20

16 Feb '20

'January 19, 2038 is for Linux what Y2K was for mainframe and PC computers in 2000, reports ZDNet. It's the day that the value for time "runs out of numbers" and, in the case of 32-bit Unix-based operating systems like Linux and older versions of macOS, "starts counting time with negative numbers..." "But the fixes are underway to make sure all goes well when that fatal time rolls around." nickwinlund77 shared their report: Linux developers have seen this coming for decades. So, Linux kernel developer Arnd Bergmann and others have been working on a repair. These corrections are now in the forthcoming Linux 5.6 kernel. Bergmann explained, "Linux-5.6, or my backport of the patches to 5.4, should be the first release that can serve as a base for a 32-bit system designed to run beyond year 2038." There are some caveats: - All user space must be compiled with a 64-bit time_t, which will be supported in the coming musl-1.2 and glibc-2.32 releases, along with installed kernel headers from Linux-5.6 or higher. - Applications that use the system call interfaces directly need to be ported to use the time64 syscalls added in Linux-5.1 in place of the existing system calls. - Applications that use a private copy of kernel uapi header files or their contents may need to update to the Linux-5.6 version. - A few remaining interfaces cannot be changed to pass a 64-bit time_t in a compatible way, so they must be configured to use CLOCK_MONOTONIC times... After we fix this, we won't have to worry about 64-bit Linux running out of seconds until 15:30:08 GMT Sunday, December 4, 29,227,702,659. Personally, I'm not going to worry about that one.' -- source: https://linux.slashdot.org/story/20/02/15/0247201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Signal Is Finally Bringing Its Secure Messaging To the Masses
by Peter Reutemann 15 Feb '20

15 Feb '20

'[Cryptographer and coder known as Moxie Marlinspike] has always talked about making encrypted communications easy enough for anyone to use. The difference, today, is that Signal is finally reaching that mass audience it was always been intended for -- not just the privacy diehards, activists, and cybersecurity nerds that formed its core user base for years -- thanks in part to a concerted effort to make the app more accessible and appealing to the mainstream. That new phase in Signal's evolution began two years ago this month. That's when WhatsApp cofounder Brian Acton, a few months removed from leaving the app he built amid post-acquisition clashes with Facebook management, injected $50 million into Marlinspike's end-to-end encrypted messaging project. Acton also joined the newly created Signal Foundation as executive chairman. The pairing up made sense; WhatsApp had used Signal's open source protocol to encrypt all WhatsApp communications end-to-end by default, and Acton had grown disaffected with what he saw as Facebook's attempts to erode WhatsApp's privacy. Since then, Marlinspike's nonprofit has put Acton's millions -- and his experience building an app with billions of users -- to work. After years of scraping by with just three overworked full-time staffers, the Signal Foundation now has 20 employees. For years a bare-bones texting and calling app, Signal has increasingly become a fully featured, mainstream communications platform. With its new coding muscle, it has rolled out features at a breakneck speed: In just the last three months, Signal has added support for iPad, ephemeral images and video designed to disappear after a single viewing, downloadable customizable "stickers," and emoji reactions. More significantly, it announced plans to roll out a new system for group messaging, and an experimental method for storing encrypted contacts in the cloud. Many of those features might sound trivial. They certainly aren't the sort that appealed to Signal's earliest core users. Instead, they're what Acton calls "enrichment features." They're designed to attract normal people who want a messaging app as multifunctional as WhatsApp, iMessage, or Facebook Messenger but still value Signal's widely trusted security and the fact that it collects virtually no user data. Wired explains how adding simple-sounding enhancements can require significant feats of security engineering to fit within Signal's privacy constraints. Adding downloadable customizable stickers, for example, "required designing a system where every sticker 'pack' is encrypted with a 'pack key,'" reports Wired. "That key is itself encrypted and shared from one user to another when someone wants to install new stickers on their phone, so that Signal's server can never see decrypted stickers or even identify the Signal user who created or sent them." For Signal's new group messaging, Signal partnered with Microsoft Research to invent a novel form of "anonymous credentials" that let a server gatekeep who belongs in a group, but without ever learning the members' identities.' -- source: https://it.slashdot.org/story/20/02/14/2216214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UK West Midlands Police Warn Against Evils Of Kali Linux
by Lawrence D'Oliveiro 15 Feb '20

15 Feb '20

A poster was recently issued <https://www.theregister.co.uk/2020/02/14/silly_police_infosec_parental_advi…> by the West Midlands Regional Organised Crime Unit, also bearing the logo of the National Crime Agency, warning parents to watch out for certain signs of delinquency on their children’s computer, such as use of virtual machines, Kali Linux, Discord and various other things. The NCA have disavowed any knowledge of the poster.

1 0

An Old Android Virus is Reinstalling Itself Even After Factory Resets
by Peter Reutemann 14 Feb '20

14 Feb '20

'A particularly persistent malware infection has been spreading amongst Android phones -- and removing it only seems to bring it back with a vengeance. From a report: The Trojan xHelper, which Malwarebytes first wrote about last year, is reportedly re-spawning on devices where it's already been removed. If virus-removal software doesn't take care of a nasty infection, a hard reset will usually do the trick. But users report that even a full factory reset of an infected device doesn't wipe xHelper out completely. Within an hour the malware is usually back and ready to wreak havoc.' -- source: https://it.slashdot.org/story/20/02/13/1745252 The above news article has a link on how to remove it. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

500 Chrome Extensions Secretly Uploaded Private Data From Millions of Users
by Peter Reutemann 14 Feb '20

14 Feb '20

'More than 500 browser extensions downloaded millions of times from Google's Chrome Web Store surreptitiously uploaded private browsing data to attacker-controlled servers, researchers said on Thursday. Ars Technica reports: The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions. "In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users," Kaya and Duo Security Jacob Rickerd wrote in a report. "This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users' knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store's fraud detection mechanisms." The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves. The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections. The researchers say the campaign dates back to at least January 2019, but it's possible that the operators were active "as early as 2017."' -- source: https://yro.slashdot.org/story/20/02/13/2355237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Windows 10X
by Lawrence D'Oliveiro 13 Feb '20

13 Feb '20

A report <https://www.theregister.co.uk/2020/02/12/microsoft_previews_windows_10x/> on major new changes coming to the architecture of Microsoft Windows. This includes locking up all Win32 apps, that is to say the majority of Windows apps (now considered “legacy”), in a sandbox where they are strictly limited in what they can do to your OS, and even your documents. Access by the user to these apps is constrained through a channel very similar to RDP, which is normally only used for remote access. Interesting to see that, in 2020, Microsoft is still battling “OS rot”, which computer humourist Verity Stob was making fun of nearly two decades ago.

1 0