- wlug - list.wlug.org.nz

AGM tomorrow
by Peter Reutemann 24 Nov '19

24 Nov '19

Hi everyone Just a friendly reminder that our AGM is on tomorrow: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19.2
by tom butz 23 Nov '19

23 Nov '19

Re: Linux Mint 19.2 The latest update ('new' package-manager) seems to disable Bluetooth. That also happened to me when I updated from 19.1 to 19.2 WITHOUT a complete reinstall. There are two workarounds: EITHER: back-up the whole system every night, and restore it if Bluetooth disappears again (=no icon in the panel after an update) - skipping updates. OR: use another system such as SparkyLinux, e.g. on a bootable sdcard for Bluetooth-transfers and stick with Mint 19.2 for anything else. I use this 'veteran' Linux because it features OpenShot 1.4 - my (favourite) moviemaker. My Toshiba laptop has 128 GB of RAM-HD, so copying/restoring to/from an image-file doesn't take all that long. Tom Butz

2 1

Server Management Recommendations
by Stu Meads 22 Nov '19

22 Nov '19

Hi all, I'm setting up a new Ubuntu 19.04LTS LAMP server in the next few months, I normally do it all myself, manage all the security myself etc, but I'm finding I don't have time and am looking for a reputable person or company to help me with initial setup, making sure everything is really secure, and be available for upgrades, security audits etc. My preference is a New Zealand based company in the hope that I will get a better quality service, easier communication etc, but will go for whatever's best for my employer Any recommendations either privately or via this list welcome

3 3

The Ad Tracker Arms Race Continues
by Lawrence D'Oliveiro 22 Nov '19

22 Nov '19

Web advertisers are resorting to a new technique <https://www.theregister.co.uk/2019/11/21/ublock_origin_firefox_unblockable_…> to bypass restrictions on third-party cookies for tracking users’ browsing behaviour: use first-party cookies instead. A detailed example can be found in this GitHub issue <https://github.com/uBlockOrigin/uBlock-issues/issues/780>: the site www.liberation.fr includes links to f7ds.liberation.fr, which is notionally under the same domain. However, that is actually a CNAME (alias) for the third-party tracker site liberation.eulerian.net. So cookies that are supposed to be restricted to *.liberation.fr are passed to that site as well. Just to be clear, this is not a browser “bug” by any means; it’s just part of how the DNS is supposed to work. The good news is, Firefox offers an API that adblocker addons can use to detect this sort of thing going on and stop it.

1 0

System76 Will Start Designing and Building Its Own Linux Laptops Beginning January 2020
by Peter Reutemann 21 Nov '19

21 Nov '19

'Denver-based PC manufacturer and Pop!_OS Linux developer System76 plans to follow-up its custom Thelio desktop PC with an in-house laptop beginning next year, according to founder and CEO Carl Richell. During a recent interview, Richell was quick to emphasize that the entire process of designing, prototyping and iterating the final product could take two to three years. But the company is eager to break into this market and put the same signature "stamp" on its laptop hardware that graces its custom-built Thelio desktop. System76 sells an extensive lineup of laptops, but the machines are designed by the likes of Sager and Clevo. The company doesn't merely buy a chassis and slap Pop!_OS on it, but Richell tells me he's confident that with the experience gained from developing Thelio -- and the recent investment into a factory at the company's Denver headquarters -- System76 is capable of building a laptop from the ground up that meets market needs and carries a unique value proposition. Richell says the company's first priority is locking down the aesthetic of the laptop and how various materials look and feel. It will simultaneously begin working on the supply chain aspects and speaking with various display and component manufacturers. System76 will design and build a U-class laptop first (basically an Ultrabook form factor like the existing Darter and Galago) and then evaluate what it might do with higher-end gaming and workstation notebooks with dedicated graphics.' -- source: https://hardware.slashdot.org/story/19/11/20/2241223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Where the Wi-Fi sucks” is where a new wireless protocol does its magic
by Peter Reutemann 21 Nov '19

21 Nov '19

'Researchers at Brigham Young University have created a new RF protocol that runs on top of existing consumer Wi-Fi at significantly greater range. But before you get too excited, the protocol's bandwidth is extremely low—so much so that it makes LoRa look like an OC-24. The protocol, called ONPC—short for On-Off Noise Power Communication—currently only specifies a single bit per second. Although ONPC only conveys one bit per second of data, its range is 60m or more beyond Wi-Fi—and it runs in software alone, on unmodified Wi-Fi hardware. An ONPC device can connect to standard Wi-Fi when range permits, fall back to ONPC mode if the connection drops, and then re-connect to the Wi-Fi when it becomes available again.' -- source: https://arstechnica.com/gadgets/2019/11/where-the-wi-fi-sucks-is-where-a-ne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google outlines plans for mainline Linux kernel support in Android
by Peter Reutemann 20 Nov '19

20 Nov '19

'It seems like Google is working hard to update and upstream the Linux kernel that sits at the heart of every Android phone. The company was a big participant in this year's Linux Plumbers Conference, a yearly meeting of the top Linux developers, and Google spent a lot of time talking about getting Android to work with a generic Linux kernel instead of the highly-customized version it uses now. It even showed an Android phone running a mainline Linux kernel. But first, some background on Android's current kernel mess.Currently, three major forks happen in between the "mainline" Linux kernel and a shipping Android device (note that "mainline" here has no relation to Google's own "Project Mainline"). First, Google takes the an LTS (Long Term Support) Linux kernel and turns it into the "Android Common kernel"—the Linux kernel with all the Android OS-specific patches applied. Android Common is shipped to the SoC vendor (usually Qualcomm) where it gets its first round of hardware-specific additions, first focusing on a particular model of SoC. This "SoC Kernel" then gets sent to a device manufacturer for even more hardware-specific code that supports every other piece of hardware, like the display, camera, speakers, usb ports, and any extra hardware. This is the "Device Kernel," and it's what actually ships on a device.' -- source: https://arstechnica.com/gadgets/2019/11/google-outlines-plans-for-mainline-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google and Samsung Fix Android Spying Flaw. Other Makers May Still Be Vulnerable
by Peter Reutemann 20 Nov '19

20 Nov '19

'Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. From a report: The weakness, which was discovered by researchers from security firm Checkmarx, represented a potential privacy risk to high-value targets, such as those preyed upon by nation-sponsored spies. Google carefully designed its Android operating system to bar apps from accessing cameras and microphones without explicit permission from end users. An investigation published Tuesday showed it was trivial to bypass those restrictions. The investigation found that an app needed no permissions at all to cause the camera to shoot pictures and record video and audio. To upload the images and video -- or any other image and video stored on the phone -- to an attacker-controlled server, an app needed only permission to access storage, which is among one of the most commonly given usage rights. The weakness, which is tracked as CVE-2019-2234, also allowed would-be attackers to track the physical location of the device, assuming GPS data was embedded into images or videos. Google closed the eavesdropping hole in its Pixel line of devices with a camera update that became available in July. Checkmarx said Samsung has also fixed the vulnerability, although it wasn't clear when that happened. Checkmarx said Google has indicated that Android phones from other manufacturers may also be vulnerable. The specific makers and models haven't been disclosed.' -- source: https://tech.slashdot.org/story/19/11/19/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World's Fastest Supercomputers Hit Higher Speeds Than Ever With Linux
by Peter Reutemann 19 Nov '19

19 Nov '19

'In the latest Top 500 supercomputer ratings, the average speed of these Linux-powered racers is now an astonishing 1.14 petaflops. The fastest of the fast machines haven't changed since the June 2019 Top 500 supercomputer list. Leading the way is Oak Ridge National Laboratory's Summit system, which holds top honors with an HPL result of 148.6 petaflops. This is an IBM-built supercomputer using Power9 CPUs and NVIDIA Tesla V100 GPUs. In a rather distant second place is another IBM machine: Lawrence Livermore National Laboratory's Sierra system. It uses the same chips, but it "only" hit a speed of 94.6 petaflops. Close behind at No. 3 is the Sunway TaihuLight supercomputer, with an HPL mark of 93.0 petaflops. TaihuLight was developed by China's National Research Center of Parallel Computer Engineering and Technology (NRCPC) and is installed at the National Supercomputing Center in Wuxi. It is powered exclusively by Sunway's SW26010 processors. Sunway's followed by the Tianhe-2A (Milky Way-2A). This is a system developed by China's National University of Defense Technology (NUDT). It's deployed at the National Supercomputer Center in China. Powered by Intel Xeon CPUs and Matrix-2000 accelerators, it has a top speed of 61.4 petaflops. Coming at No. 5, the Dell-built, Frontera, a Dell C6420 system is powered by Intel Xeon Platinum processors. It speeds along at 23.5 petaflops. It lives at the Texas Advanced Computing Center of the University of Texas. The most powerful new supercomputer on the list is Rensselaer Polytechnic Institute Center for Computational Innovations (CCI)'s AiMOS. It made the list in the 25th position with 8.0 petaflops. The IBM-built system, like Summit and Sierra, is powered by Power9 CPUs and NVIDIA V100 GPUs. In closing, ZDNet's Steven J. Vaughan-Nichols writes: "Regardless of the hardware, all 500 of the world's fastest supercomputers have one thing in common: They all run Linux."' -- source: https://linux.slashdot.org/story/19/11/18/2128212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel To Remove Old Drivers and BIOS Updates From Its Site
by Peter Reutemann 19 Nov '19

19 Nov '19

'By Friday this week, Intel plans to remove old drivers and BIOS updates from its official website. From a report: "This download, BIOS Update [BLH6710H.86A] 0163, will no longer be available after November 22, 2019 and will not be supported with any additional functional, security, or other updates," reads a message posted to the download page of one of the impacted components. "Intel recommends that users of BIOS Update [BLH6710H.86A] 0163 uninstall and/or discontinue use as soon as possible," the message continues. The downloads are drivers and BIOS updates for Intel desktop components and motherboards the company released in the 90s and early-to-mid 2000s. Downloads for hundreds of components are believed to have been impacted, from motherboards to NIC cards and graphics cards. Most of the drivers are for Windows versions like 98, ME, XP, and older Windows Server editions -- old Windows OS versions that have themselves reached end-of-life (EOL) All components and motherboards reached (EOL) years ago, and Intel stopped delivering firmware updates as a result. Its website was merely hosting the older files for convenience.' -- source: https://it.slashdot.org/story/19/11/18/1646210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Announces Plan To Support DoH In Windows
by Peter Reutemann 19 Nov '19

19 Nov '19

'Microsoft's Core Network team just announced they plan on supporting DoH in the Windows resolver. In the blog post, the company writes: Providing encrypted DNS support without breaking existing Windows device admin configuration won't be easy. However, at Microsoft we believe that "we have to treat privacy as a human right. We have to have end-to-end cybersecurity built into technology." We also believe Windows adoption of encrypted DNS will help make the overall Internet ecosystem healthier. There is an assumption by many that DNS encryption requires DNS centralization. This is only true if encrypted DNS adoption isn't universal. To keep the DNS decentralized, it will be important for client operating systems (such as Windows) and Internet service providers alike to widely adopt encrypted DNS. With the decision made to build support for encrypted DNS, the next step is to figure out what kind of DNS encryption Windows will support and how it will be configured. Here are our team's guiding principles on making those decisions: Windows DNS needs to be as private and functional as possible by default without the need for user or admin configuration because Windows DNS traffic represents a snapshot of the user's browsing history. To Windows users, this means their experience will be made as private as possible by Windows out of the box. For Microsoft, this means we will look for opportunities to encrypt Windows DNS traffic without changing the configured DNS resolvers set by users and system administrators. Privacy-minded Windows users and administrators need to be guided to DNS settings even if they don't know what DNS is yet. Many users are interested in controlling their privacy and go looking for privacy-centric settings such as app permissions to camera and location but may not be aware of or know about DNS settings or understand why they matter and may not look for them in the device settings. Windows users and administrators need to be able to improve their DNS configuration with as few simple actions as possible. We must ensure we don't require specialized knowledge or effort on the part of Windows users to benefit from encrypted DNS. Enterprise policies and UI actions alike should be something you only have to do once rather than need to maintain. Windows users and administrators need to explicitly allow fallback from encrypted DNS once configured. Once Windows has been configured to use encrypted DNS, if it gets no other instructions from Windows users or administrators, it should assume falling back to unencrypted DNS is forbidden.' -- source: https://yro.slashdot.org/story/19/11/18/1929229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WLUG AGM next week
by Peter Reutemann 18 Nov '19

18 Nov '19

Hi everyone Just a friendly reminder that our AGM is on next week on Monday, with the current agenda: - President's Report - Treasurer's Report - Election of 2020 Committee - Move AGM to January (after financial year ends) to have a complete treasurer's report for AGM - Alternatives to meetup.com due to payment changes - General business - Consumption of pizza Details (location etc): https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Firefox Fights for the Future of the Web
by Peter Reutemann 18 Nov '19

18 Nov '19

'"Mozilla is no longer fighting for market share of its browser: it is fighting for the future of the web," writes the Guardian, citing Mozilla Project co-founder Mitchell Baker: Baker's pitch is that only Mozilla is motivated, first and foremost, to make using the web a pleasurable experience. Google's main priority is to funnel user data into the enormous advertising engine that accounts for most of its revenue. Apple's motivation is to ensure that customers continue to buy a new iPhone every couple of years and don't switch to Android...." Firefox now runs sites such as Facebook in "containers", effectively hiving the social network off into its own little sandboxed world, where it can't see what's happening on other sites. Baker says: "It reduces Facebook's ability to follow you around the web and track you when you're not on Facebook and just living your life...." Mozilla has launched Monitor, a data-breach reporting service; Lockwise, a password manager; and Send, a privacy-focused alternative to services such as WeSendit. It's also beta-testing a VPN (virtual private network) service, which it hopes to market to privacy-conscious users... Apple's iOS (mobile operating system) is an acknowledged disaster for Mozilla. Safari is the default and, while users can install other browsers, they come doubly hindered: they can never be set as the default, meaning any link clicked in other applications will open in Safari; and they must use Safari's "rendering engine", a technical limitation that means that even the browsers that Firefox does have on the platform are technically just fancy wrappers for Apple's own browser, rather than full versions of the service that Mozilla has built over the decades... "Even if you do download a replacement, iOS drops you back into the default. I don't know why that's acceptable. Every link you open on a phone is the choice of the phone maker, even if you, as a user, want something else." Summarizing Baker's concerns, the Guardian writes that "It is perfectly possible to build a browser that prevents advertising companies from aggregating user data. But it is unlikely that any browser made by an advertising company would offer such a feature..." And an activist for the Small Technology Foundation tells them that Google "wants the web to go through Google. It already mostly does: with eyes on 70% to 80% of the web."' -- source: https://news.slashdot.org/story/19/11/17/1614222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wikipedia's Co-Founder Takes On Facebook With Ad-Free Social Network
by Peter Reutemann 15 Nov '19

15 Nov '19

'Wikipedia co-founder Jimmy Wales has launched a social network called WT:Social. It has no financial association with Wikipedia and operates on donations, not advertising. The Next Web reports: WT:Social went live last month and is currently nearing 50,000 users. The company is rolling out access slowly; when I signed up, I was approximately number 28,000 on the waitlist. Alternatively, you can pay 13 bucks a month or 100 a year to get access right away. In comments to the Financial Times, Wales said "The business model of social media companies, of pure advertising, is problematic. It turns out the huge winner is low-quality content." You don't say. WT:Social's interface is rather sparse at the moment, featuring a simple feed comprised of news stories and comments below them. News is a big part of the network; it's a spinoff of Wales' previous project, WikiTribune, which sought to be a global news site comprised of professional journalists and citizen contributors. Both WikiTribune and WT:Social emphasize combatting fake news, highlighting evidence-based coverage over the focus on "engagement" seen on other networks. Each story posted to the network makes prominent where the article comes from, as well as sources and references. You can also join various "SubWikis" that are essentially like Facebook groups or subreddits, which filter content to stories of a given topic. You can also add hashtags to a post or follow hashtags for more specific interests that might span more than one SubWiki. Posts are currently sorted chronologically, but the site plans to add an upvote system for users to promote quality stories.' -- source: https://news.slashdot.org/story/19/11/14/223256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows and Linux Get Options To Disable Intel TSX To Prevent Zombieload v2 Attacks
by Peter Reutemann 15 Nov '19

15 Nov '19

'Both Microsoft and the Linux kernel teams have added ways to disable support for Intel Transactional Synchronization Extensions (TSX). From a report: TSX is the Intel technology that opens the company's CPUs to attacks via the Zombieload v2 vulnerability. Zombieload v2 is the codename of a vulnerability that allows malware or a malicious threat actor to extract information processed inside a CPU, information to which they normally shouldn't be able to access due to the security walls present inside modern-day CPUs. This new vulnerability was disclosed earlier this week. Intel said it would release microcode (CPU firmware) updates -- available on the company's Support & Downloads center. But, the reality of a real-world production environment is that performance matters. Past microcode updates for other attacks, such as Meltdown, Spectre, Foreshadow, Fallout, and Zombieload v1, have been known to introduce performance hits of up to 40%. Seeing that all the CPU attacks listed above are not only theoretical but also hard to pull off, some companies don't see this performance hit as an option.' -- source: https://tech.slashdot.org/story/19/11/14/1654247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Places Open-Source Code In Arctic Cave For Safekeeping
by Peter Reutemann 14 Nov '19

14 Nov '19

'GitHub's CEO Nat Friedman traveled to Svalbard in October to stash Linux, Android, and 6,000 other open-source projects in a permafrost-filled, abandoned coal mine. It's part of a project to safeguard the world's software from existential threats and also just to archive the code for posterity. As Friedman says, "If you told someone 20 years ago that in 2020, all of human civilization will depend on and run on open-source code written for free by volunteers in countries all around the world who don't know each other, and it'll just be downloaded and put into almost every product, I think people would say, 'That's crazy, that's never going to happen. Software is written by big, professional companies.' It's sort of a magical moment. Having a historical record of this will, I think, be valuable to future generations." GitHub plans to open several more vaults in other places around the world and to store any code that people want included.' -- source: https://news.slashdot.org/story/19/11/13/2155230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla, Intel, and More Form the Bytecode Alliance To Take WebAssembly Beyond Browsers
by Peter Reutemann 14 Nov '19

14 Nov '19

'Mozilla has been heavily invested in WebAssembly with Firefox, and today, the organization teamed up with a few others to form the new Bytecode Alliance, which aims to create "new software foundations, building on standards such as WebAssembly and WebAssembly System Interface (WASI)." Mozilla has teamed up with Intel, Red Hat, and Fastly to found the alliance, but more members are likely to join over time. The goal of the Bytecode Alliance is to create a new runtime environment and language toolchains which are secure, efficient, and modular, while also being available on as many platforms and devices as possible. The technologies being developed by the Bytecode Alliance are based on WebAssembly and WASI, which have been seen as a potential replacement for JavaScript due to more efficient code compiling, and the expanded capabilities of being able to port C and C++ code to the web. To kick things off, the founding members have already contributed a number of open-source technologies to the Bytecode Alliance, including Wasmtime, a lightweight WebAssembly runtime; Lucet, an ahead-of-time compiler; WebAssembly Micro Runtime; and Cranelift.' -- source: https://news.slashdot.org/story/19/11/13/1750234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPM-FAIL Vulnerabilities Impact TPM Chips In Desktops, Laptops, Servers
by Peter Reutemann 14 Nov '19

14 Nov '19

'A team of academics has disclosed today two vulnerabilities known collectively as TPM-FAIL that could allow an attacker to retrieve cryptographic keys stored inside TPMs. The first vulnerability is CVE-2019-11090 and impacts Intel's Platform Trust Technology (PTT). Intel PTT is Intel's fTPM software-based TPM solution and is widely used on servers, desktops, and laptops, being supported on all Intel CPUs released since 2013, starting with the Haswell generation. The second is CVE-2019-16863 and impacts the ST33 TPM chip made by STMicroelectronics. This chip is incredibly popular and is used on a wide array of devices ranging from networking equipment to cloud servers, being one of the few chips that received a CommonCriteria (CC) EAL 4+ classification — which implies it comes with built-in protection against side-channel attacks like the ones discovered by the research team. Unlike most TPM attacks, these ones were deemed practical. A local adversary can recover the ECDSA key from Intel fTPM in 4-20 minutes depending on the access level. We even show that these attacks can be performed remotely on fast networks, by recovering the authentication key of a virtual private network (VPN) server in 5 hou' -- source: https://it.slashdot.org/story/19/11/13/1837225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Bug Has Camera Activated While People Are Using the App
by Peter Reutemann 13 Nov '19

13 Nov '19

'When you're scrolling through Facebook's app, the social network could be watching you back, in more ways than just your data, concerned users have found. Multiple people have found and reported that their iPhone cameras were turned on in the background while looking at their feed. From a report: The issue came to light with several posts on Twitter, showing that their cameras were activated behind Facebook's app as they were watching videos or looking at photos on the social network. After clicking on the video to full screen, returning it back to normal would create a bug where Facebook's mobile layout was slightly shifted to the right. With the open space on the left, you could now see the phone's camera activated in the background. This was documented in multiple cases, with the earliest incident on November 2.' -- source: https://tech.slashdot.org/story/19/11/12/1630204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

As 5G Rolls Out, Troubling New Security Flaws Emerge
by Peter Reutemann 13 Nov '19

13 Nov '19

'It's not yet prime time for 5G networks, which still face logistical and technical hurdles, but they're increasingly coming online in major cities worldwide. Which is why it's especially worrying that new 5G vulnerabilities are being discovered almost by the dozen. From a report: At the Association for Computing Machinery's Conference on Computer and Communications Security in London today researchers are presenting new findings that the 5G specification still has vulnerabilities. And with 5G increasingly becoming a reality, time is running out to catch these flaws. The researchers from Purdue University and the University of Iowa are detailing 11 new design issues in 5G protocols that could expose your location, downgrade your service to old mobile data networks, run up your wireless bills, or even track when you make calls, text, or browse the web. They also found five additional 5G vulnerabilities that carried over from 3G and 4G. They identified all of those flaws with a new custom tool called 5GReasoner. One purported benefit of 5G is that it protects phone identifiers, like your device's "international mobile subscriber identity," to help prevent tracking or targeted attacks. But downgrade attacks like the ones the researchers found can bump your device down to 4G, or put it into limited service mode, then force it to send its IMSI number unencrypted. Increasingly, networks use an alternative ID called a Temporary Mobile Subscriber Identity that refreshes periodically to stymie tracking. But the researchers also found flaws that could allow them to override TMSI resets, or correlate a device's old and new TMSI, to track devices. Mounting those attacks takes only software-defined radios that cost a few hundred dollars. The 5GReasoner tool also found issues with the part of the 5G standard that governs things like initial device registration, deregistration, and paging, which notifies your phone about incoming calls and texts. Depending on how a carrier implements the standard, attackers could mount "replay" attacks to run up a target's mobile bill by repeatedly sending the same message or command. It's an instance of vague wording in the 5G standard that could cause carriers to implement it weakly.' -- source: https://tech.slashdot.org/story/19/11/12/1845229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Cascade Lake CPUs Impacted By New Zombieload v2 Attack
by Peter Reutemann 13 Nov '19

13 Nov '19

'The Zombieload vulnerability disclosed earlier this year in May has a second variant that also works against more recent Intel processors, not just older ones, including Cascade Lake, Intel's latest line of high-end CPUs -- initially thought to have been unaffected. From a report: Intel is releasing microcode (CPU firmware) updates today to address this new Zombieload attack variant, as part of its monthly Patch Tuesday -- known as the Intel Platform Update (IPU) process. Back in May, two teams of academics disclosed a new batch of vulnerabilities that impacted Intel CPUs. Collectively known as MDS attacks, these are security flaws in the same class as Meltdown, Spectre, and Foreshadow. The attacks rely on taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance. Vulnerabilities like Meltdown, Spectre, and Foreshadow, showed that the speculative execution process was riddled with security holes. Disclosed in May, MDS attacks were just the latest line of vulnerabilities impacting speculative execution. They were different from the original Meltdown, Spectre, and Foreshadow bugs disclosed in 2018 because they attacked different areas of a CPU's speculative execution process.' -- source: https://hardware.slashdot.org/story/19/11/12/1924232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Connect / GSConnect: How To Lock/Unlock Your Linux Desktop Using An Android Device
by Peter Reutemann 11 Nov '19

11 Nov '19

'KDE Connect and GSConnect support running commands from an Android device to your Linux desktop. This article explains how to lock and unlock your Linux desktop using a single tap on your Android device, via the KDE Connect Android app. You'll also find a workaround for GNOME 3.34 which has its session managed by systemd, and complicates this a bit.' -- source: https://www.linuxuprising.com/2019/11/kde-connect-gsconnect-how-to-lockunlo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Budget-friendly Linux Smartphone PinePhone Will be Available to Pre-order Next Week
by Peter Reutemann 11 Nov '19

11 Nov '19

'Do you remember when It’s FOSS first broke the story that Pine64 was working on a Linux-based smartphone running KDE Plasma (among other distributions) in 2017? It’s been some time since then but the good news is that PinePhone will be available for pre-order from 15th November. Let me provide you more details on the PinePhone like its specification, pricing and release date. PinePhone: Linux-based budget smartphone The PinePhone developer kit is already being tested by some devs and more such kits will be shipped by 15th November. You can check out some of these images by clicking the photo gallery below: The developer kit is a combo kit of PINE A64 baseboard + SOPine module + 7″ Touch Screen Display + Camera + Wifi/BT + Playbox enclosure + Lithium-Ion battery case + LTE cat 4 USB dongle. These combo kits allow developers to jump start PinePhone development. The PINE A64 platform already has mainline Linux OS build thanks to the PINE64 community and the support by KDE neon.' -- source: https://itsfoss.com/pinephone/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reactions To the News That Microsoft's Edge Browser Is Coming to Linux
by Peter Reutemann 11 Nov '19

11 Nov '19

'"Microsoft is bringing Edge to Linux, for all the Microsoft fans running Linux," jokes the headline at the Inquirer. ("We can just imagine the amount of bunting and party poppers that the Linux community has just ordered. After all, why wouldn't you want a browser from the company that you joined Linux to get away from?") And the headline at Liliputting quips that the Edge browser "is coming to Linux (whether you want it or not)," calling the move "the latest evidence that Microsoft's relationship to Linux has changed a lot in recent years. But TechRadar had an even more sardonic headline. "Hell freezes over as Microsoft Edge comes to Linux." One other thing to consider is that the introduction of Edge to Linux is something of a thorny subject in that the folks who choose a Linux distro often do so to break away from the chains of Microsoft and Windows (or indeed Apple). So certainly some of the more fervent open source types out there may not welcome a Microsoft browser with open arms, and doubtless it will be regarded with suspicion in some quarters. No matter how much Microsoft has been banging the open source drum in many different ways in recent times. That said, there will doubtless be Linux users who are curious, and may want to pick up a mainstream alternative to Firefox on Linux which, when compared to Chrome -- with its famous memory hogging antics -- makes a far preferable choice in some respects. Edge will also do streaming better (by default Chrome limits you to 720p when you're trying to watch a spot of Netflix). All the testing feedback about Edge has been pretty positive in the main thus far, too, so maybe that will persuade even doubters to at least consider it. One thing's for sure: it will certainly be interesting to see the reaction Microsoft's browser gets when it is deployed to Linux. Edge may face a rocky reception. "I am not feeling a tingling all over at the thought of Edge coming to Linux," posted one commenter on Beta News. "It's not really necessary to bring Linux down to the level of Windows 10."' -- source: https://linux.slashdot.org/story/19/11/11/0249222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

uBlock on Firefox 70.0.1 - memory hungry?
by Peter Reutemann 11 Nov '19

11 Nov '19

Hi everyone Since the last Firefox update to 70.0.1, I noticed that my Firefox was getting sluggish, sometimes taking several seconds before finishing rendering a page and allowing me to click on links. After looking in the processes, turns out that WebExtensions was gobbling up nearly 21GB, not to mention several other processes for rendering the tabs! It was probably swapping memory all the time... After turning off my uBlock addon (and restarting the browser, of course), Firefox is now as responsive as I was used to and WebExtensions is now ~2.5GB. Not sure whether this is due to the newly introduced privacy protection facility within core Firefox, that uBlock ballooned/slowed down like that. Anyway, still got my NoScript and PrivacyBadger addons active. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Microsoft Defender ATP' Antivirus is Coming to Linux
by Peter Reutemann 11 Nov '19

11 Nov '19

'Microsoft is planning to bring its Defender antivirus to Linux systems next year, reports ZDNet: Microsoft announced the brand change from Windows Defender to Microsoft Defender in March after giving security analysts the tools to inspect enterprise Mac computers for malware via the Microsoft Defender console. Rob Lefferts, corporate vice president for Microsoft's M365 Security, told ZDNet that Microsoft Defender for Linux systems will be available for customers in 2020. In October TechSpot reported that Defender placed in the top 10 among all major antivirus programs, narrowly beating established software like Bitdefender, Kaspersky, and Mcafee with an online protection rate of 99.96%, according to testing by independent lab AV-Comparative' -- source: https://linux.slashdot.org/story/19/11/10/0352237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Are Forced Subscriptions Driving 3D Users To Open Source Tools?
by Peter Reutemann 11 Nov '19

11 Nov '19

'Slashdot reader dryriver writes: More and more professional 3D software like 3DMax, Maya, AutoCAD (Autodesk) and Substance Painter (Adobe) is now only available on a monthly or yearly subscription basis — you cannot buy any kind of perpetual license for these industry standard 3D tools anymore, cannot offline install or activate the tools, and the tools also phone home every few days over the internet to see whether you have "paid your rent". Stop paying your rent, and the software shuts down, leaving you unable to even look at any 3D project files you may have created with software. This has caused so much frustration, concern and anxiety among 3D content creators that, increasingly, everybody is trying to replace their commercial 3D software with Open Source 3D tools. Thankfully, open source 3D tools have grown up nicely in recent years. Some of the most popular FOSS 3D tools are the complete 3D suite Blender, polygon modeling tool Wings 3D, polygon modeling tool Dust3D, CAD modeling tool FreeCAD, PBR texturing tool ArmorPaint, procedural materials generator Material Maker, image editing tool GIMP, painting tool Krita, vector illustration tool Inkscape and the 2D/3D game engine Godot Engine. Along with these tools comes a beguiling possibility — while working with commercial 3D tools pretty much forced you to use Windows X in terms of OS choice in the past, all of the FOSS 3D tool alternatives have Linux versions. This means that for the first time, professional 3D users can give Windows a miss and work with Linux as their OS instead. In a comment on the original submission, dryriver offers some anecdotal evidence: Go on any major 3D software forum on the Internet and it is filled with enraged 3D users revolting against forced software subscriptions and threatening to switch to FOSS Blender as soon as possible. Some major 3D animation studios are also working Blender into their CGI pipeline. Companies like EPIC and Nvidia have begun donating to the Blender foundation. Its happening. The move away from commercial closed source tools - which are expensive, stagnant and don't offer you permanent licenses anymore - is in full swing. The fact that Blender has an innovative GPU accelerated realtime render engine called EEVEE that none of the commercial software has has only accelerated this trend. Blender is widely believed to have 2 - 3 million active users already, and the fact that V 2.80 comes with a much more usable UI is only accelerating things.' -- source: https://news.slashdot.org/story/19/11/09/064248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Scammers Are Actively Exploiting A Firefox Bug
by Peter Reutemann 10 Nov '19

10 Nov '19

'Scammers are actively exploiting a bug in Firefox that causes the browser to lock up after displaying a message warning the computer is running a pirated version of Windows that has been hacked... The message then advises the person to call a toll-free number in the next five minutes or face having the computer disabled... Jérôme Segura, head of threat intelligence at security provider Malwarebytes, said the Firefox bug is being exploited by several sites... On Monday, Segura reported the bug to the Bugzilla forum. He said he has since received word Mozilla is actively working on a fix. In a statement sent seven hours after this post went live, a Mozilla representative wrote: "We are working on a fix to the authentication prompt bug that we expect to land in the next couple of releases (either in Firefox 71 or 72).' -- source: https://news.slashdot.org/story/19/11/09/0358237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DNS-over-HTTPS Will Eventually Roll Out in All Major Browsers, Despite ISP Opposition
by Peter Reutemann 09 Nov '19

09 Nov '19

' All major browsers -- including Chrome, Firefox, Safari, Opera, Microsoft Edge, Vivaldi, Brave -- have plans to support DNS-over-HTTPS (or DoH), a protocol that encrypts DNS traffic and helps improve a user's privacy on the web. From a report: The DoH protocol has been one of the year's hot topics. It's a protocol that, when deployed inside a browser, it allows the browser to hide DNS requests and responses inside regular-looking HTTPS traffic. Doing this makes a user's DNS traffic invisible to third-party network observers, such as ISPs. But while users love DoH and have deemed it a privacy boon, ISPs, networking operators, and cyber-security vendors hate it. A UK ISP called Mozilla an "internet villain" for its plans to roll out DoH, and a Comcast-backed lobby group has been caught preparing a misleading document about DoH that they were planning to present to US lawmakers in the hopes of preventing DoH's broader rollout. However, this may be a little too late. ZDNet has spent the week reaching out to major web browser providers to gauge their future plans regarding DoH, and all vendors plan to ship it, in one form or another.' -- source: https://it.slashdot.org/story/19/11/08/189243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Turns 15
by Peter Reutemann 09 Nov '19

09 Nov '19

'On November 9 2004, a new version of Mozilla's browser called Firefox shipped. It was taking on one of the most daunting monopolies in tech: Microsoft's Internet Explorer, which had more than 90 percent market share. But Firefox was really good, and it became an instant hit, ending Microsoft's dominance of the web. Over at Fast Company, Sean Captain took a look at the browser's original rise, the challenges it faced after Google's Chrome arrived on the scene, and the moves it's currently making to put user privacy first.' -- source: https://news.slashdot.org/story/19/11/08/162243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitLab Director Resigns, Says It's Engaging In 'Retaliatory Behavior'
by Peter Reutemann 09 Nov '19

09 Nov '19

'Candice Ciresi, GitLab's director of risk and global compliance, has resigned after less than six months on the job, apparently saying that the $2.75 billion startup is "engaging in discriminatory and retaliatory behavior." Business Insider reports: Notably, Ciresi resigned in public: GitLab espouses a culture of transparency, whereby all major product and corporate policy decisions are announced and discussed where anybody can see. She posted her resignation in response to one such discussion -- an active debate over a proposed GitLab policy, in which it would ban the hiring of people who live in China or Russia for any role that would require access to customer data. At the time of writing, Ciresi's post announcing her resignation had been reviewed and then "redacted" by GitLab, citing concerns that it would "further inflame this situation." However, Ciresi's comment went out via email to GitLab users who had subscribed to this particular discussion. Per a screenshot posted to Reddit, Ciresi wrote: "As I believe GitLab is engaging in discriminatory and retaliatory behavior, I have tendered my resignation." "We did decide to moderate this post for review, as there have already been credible personal and physical threats against GitLab employees in this issue thread," GitLab says, in part, in place of Ciresi's comment. "While this particular post did not contain a personal threat to anyone, we were concerned it would further inflame this situation." GitLab confirmed Ciresi's departure but didn't comment any further' -- source: https://developers.slashdot.org/story/19/11/08/2216219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome OS 78 Rolling Out With Picture-In-Picture Support For YouTube, Split Browser/Device Settings, More
by Peter Reutemann 08 Nov '19

08 Nov '19

'The latest version of Chrome OS, version 78, adds separate browser and device settings, click-to-call, and picture-in-picture support for YouTube. It also introduces virtual desktop support for the operating system with a feature called Virtual Desks. 9to5Google reports: Chrome is getting another cross-device sharing feature after "Send this page" widely rolled in September. With "click-to-call," you can right-click on phone number links -- like tel:800-800-8000 -- to have them sent to your Android device. It's quicker than manually entering those digits or transferring via email. Chrome OS 78 will separate browser and device settings. The former is accessible directly at chrome://settings and what opens when clicking "Settings" at the bottom of the Overflow menu in the top-right corner of any browser window. It opens as a tab and provides web-related preferences. Meanwhile, chrome://os-settings opens as its own window, and can be accessed from the quick settings sheet. It provides device options like Wi-Fi, Bluetooth, and Assistant in a white Material Theme UI with an icon in the launcher/app shelf. YouTube for Android now supports picture-in-picture with Chrome OS 78. After starting a video in the mobile client, switching to another window, covering, or minimizing the app will automatically open a PiP in the bottom-right corner. Available controls include switching to audio, play/pause, and skipping to the next track. In the top-left, you can expand the window and a settings gear on the other side allows you to open system settings. Tapping in the center expands and returns you to the YouTube Android app. Chrome OS 78 simplifies the printing experience by automatically listing compatible printers without any prior setup required. There are also a number of Linux on Chrome OS enhancements in this version: - Backups of Linux apps and files can now be saved to local storage, external drive, or Google Drive. That copy can be then restored when setting up a new computer. - Crostini GPU support will be enabled by default for a "crisp, lower-latency experience." - You'll be warned when using a Linux app that does not support virtual keyboard in tablet mode.' -- source: https://linux.slashdot.org/story/19/11/07/2341228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Ring Doorbells Exposed Home Wi-Fi Passwords To Hackers
by Peter Reutemann 08 Nov '19

08 Nov '19

'Security researchers have discovered a vulnerability in Ring doorbells that exposed the passwords for the Wi-Fi networks to which they were connected. Bitdefender said the Amazon-owned doorbell was sending owners' Wi-Fi passwords in cleartext as the doorbell joins the local network, allowing nearby hackers to intercept the Wi-Fi password and gain access to the network to launch larger attacks or conduct surveillance. "When first configuring the device, the smartphone app must send the wireless network credentials. This takes place in an unsecure manner, through an unprotected access point," said Bitdefender. "Once this network is up, the app connects to it automatically, queries the device, then sends the credentials to the local network." But all of this is carried out over an unencrypted connection, exposing the Wi-Fi password that is sent over the air. Amazon fixed the vulnerability in all Ring devices in September, but the vulnerability was only disclosed today.' -- source: https://mobile.slashdot.org/story/19/11/07/2125208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Project Silica offers robust thousand-year storage
by Peter Reutemann 08 Nov '19

08 Nov '19

Not strictly Linux or open source related, but I wouldn't mind having a backup that lasts longer than just a few years! 'Ars spoke Tuesday with Dr. Ant Rowstron, a principal researcher at Microsoft Research in Cambridge, UK, about an innovative cold storage project called Silica. Silica aims to replace both tape and optical archival discs as the media of choice for large-scale, (very) long duration cold storage. Microsoft Research is partnering with film giant Warner Bros., which is directly interested in reducing costs and increasing reliability in its own cold storage programs. The medium in question is a block of high-purity glass, which has voxels etched into it with femtosecond lasers. Each voxel stores multiple bits in two properties, retardance and angle, which may in turn be read using microscope imaging and polarized light. Voxels may be written 100 or more layers deep in a 2mm-deep piece of glass, by focusing the laser to the desired depth within the block itself. The speed of both reads and writes to Silica currently leave something to be desired—it took approximately a week to etch Superman's roughly 76GB of data last year, and Rowstron estimates it would take about three days to re-read the data, with advances made since. The technology is still in its infancy, of course, and large decreases in time required for both writing and reading are expected moving forward. Rowstron says he still doesn't expect anyone is likely to try to actually play Superman directly from its Silica record—but that's not what it's intended for.' -- source: https://arstechnica.com/gadgets/2019/11/microsofts-project-silica-offers-ro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Original Google Pixel Will Get One Final Update In December
by Peter Reutemann 06 Nov '19

06 Nov '19

'Google has confirmed to The Verge that it will release "one final software update" next month for the original Google Pixel and Pixel XL. From the report: As of yesterday, it looked like the original Pixel was done getting updates, as Google released its November security update for most Pixel phones, but nothing for the Pixel or Pixel XL. Google tells The Verge that the Pixels won't get that November update, but it says December's "encapsulates a variety of updates" from the November and December updates that were issued for other Pixels. It wasn't too surprising to see that Google's original Pixels didn't get yesterday's update. When Google announced the phones in 2016, the company said they would get two years of guaranteed Android version updates and three years of security updates, which is also reflected on Google's support page. That said, Google surprised Pixel owners earlier this year by letting them run Android 10, which is one more year of Android than Google originally promised, and now, they have one final update to look forward to as well. ' -- source: https://mobile.slashdot.org/story/19/11/05/2133215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Bug Lets Hackers Plant Malware Via NFC Beaming
by Peter Reutemann 05 Nov '19

05 Nov '19

'Google patched last month an Android bug that can let hackers spread malware to a nearby phone via a little-known Android OS feature called NFC beaming. NFC beaming works via an internal Android OS service known as Android Beam. This service allows an Android device to send data such as images, files, videos, or even apps, to another nearby device using NFC (Near-Field Communication) radio waves, as an alternative to WiFi or Bluetooth. Typically, apps (APK files) sent via NFC beaming are stored on disk and a notification is shown on screen. The notification asks the device owner if he wants to allow the NFC service to install an app from an unknown source. But, in January this year, a security researcher named Y. Shafranovich discovered that apps sent via NFC beaming on Android 8 (Oreo) or later versions would not show this prompt. Instead, the notification would allow the user to install the app with one tap, without any security warning. The CVE-2019-2114 bug resided in the fact that the Android Beam app was also whitelisted, receiving the same level of trust as the official Play Store app. Google said this wasn't meant to happen, as the Android Beam service was never meant as a way to install applications, but merely as a way to transfer data from device to device. The October 2019 Android patches removed the Android Beam service from the OS whitelist of trusted sources. However, many millions of users remain at risk. If users have the NFC service and the Android Beam service enabled, a nearby attacker could plant malware (malicious apps) on their phones. Since most newly-sold devices have the NFC feature enabled by default, you'll have to disable Android Beam and NFC or update your phone to receive the October 2019 security updates if you want to protect yourself from this bug.' -- source: https://it.slashdot.org/story/19/11/04/216228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers hack Siri, Alexa, and Google Home by shining lasers at them
by Peter Reutemann 05 Nov '19

05 Nov '19

'Siri, Alexa, and Google Assistant are vulnerable to attacks that use lasers to inject inaudible—and sometimes invisible—commands into the devices and surreptitiously cause them to unlock doors, visit websites, and locate, unlock, and start vehicles, researchers report in a research paper published on Monday. Dubbed Light Commands, the attack works against Facebook Portal and a variety of phones. Shining a low-powered laser into these voice-activated systems allows attackers to inject commands of their choice from as far away as 360 feet (110m). Because voice-controlled systems often don’t require users to authenticate themselves, the attack can frequently be carried out without the need of a password or PIN. Even when the systems require authentication for certain actions, it may be feasible to brute force the PIN, since many devices don’t limit the number of guesses a user can make. Among other things, light-based commands can be sent from one building to another and penetrate glass when a vulnerable device is kept near a closed window. The attack exploits a vulnerability in microphones that use micro-electro-mechanical systems, or MEMS. The microscopic MEMS components of these microphones unintentionally respond to light as if it were sound. While the researchers tested only Siri, Alexa, Google Assistant, Facebook Portal, and a small number of tablets and phones, the researchers believe all devices that use MEMS microphones are susceptible to Light Commands attacks.' -- source: https://arstechnica.com/information-technology/2019/11/researchers-hack-sir… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Linus Torvalds: 'I'm Not a Programmer Anymore'
by Peter Reutemann 04 Nov '19

04 Nov '19

'Linus Torvalds, Linux's creator, doesn't make speeches anymore. But, what he does do, and he did again at Open Source Summit Europe in Lyon France is have public conversations with his friend Dirk Hohndel, VMware's Chief Open Source Officer. In this keynote discussion, Torvalds revealed that he doesn't think he's a programmer anymore. So what does the person everyone thinks of as a programmer's programmer do instead? Torvalds explained: "I don't know coding at all anymore. Most of the code I write is in my e-mails. So somebody sends me a patch ... I [reply with] pseudo code. I'm so used to editing patches now I sometimes edit patches and send out the patch without having ever tested it. I literally wrote it in the mail and say, 'I think this is how it should be done,' but this is what I do, I am not a programmer." So, Hohndel asked, "What is your job?" Torvalds replied, "I read and write a lot of email. My job really is, in the end, is to say 'no.' Somebody has to say 'no' to [this patch or that pull request]. And because developers know that if they do something that I'll say 'no' to, they do a better job of writing the code."' -- source: https://linux.slashdot.org/story/19/11/03/2230223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Hide Notification Popups By Default Starting Next Year
by Peter Reutemann 04 Nov '19

04 Nov '19

'In a move to fight spam and improve the health of the web, Firefox will hide those annoying notification popups by default starting next year, with the release of Firefox 72, in January 2020, ZDNet has learned from a Mozilla engineer. The move comes after Mozilla ran an experiment back in April this year to see how users interacted with notifications, and also looked at different ways of blocking notifications from being too intrusive. Usage stats showed that the vast majority (97%) of Firefox users dismissed notifications, or chose to block a website from showing notifications at all... As a result, Mozilla engineers have decided to hide the notification popup that drops down from Firefox's URL bar, starting with Firefox 72. If a website shows a notification, the popup will be hidden by default, and an icon added to the URL bar instead. Firefox will then animate the icon using a wiggle effect to let the user know there's a notification subscription popup available, but the popup won't be displayed until the user clicks the icon. Mozilla is the first browser vendor to block notification popups by default, according to the article. It's already available in Firefox Nightly versions, but will be added to the stable branch in January. "I think Mozilla's decision is good for the health of the web," Jérôme Segura, malware analyst at Malwarebytes tells ZDNet.' -- source: https://news.slashdot.org/story/19/11/03/1646236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Does Linux Have a Marketing Problem?
by Peter Reutemann 04 Nov '19

04 Nov '19

'On Hackaday's hosting site Hackaday.io, an electrical engineer with a background in semiconductor physics argues that Linux's small market share is due to a lack of marketing: Not only does [Linux] have dominance when raw computing ability is needed, either in a supercomputer or a webserver, but it must have some ability to effectively work as a personal computer as well, otherwise Android wouldn't be so popular on smartphones and tablets. >From there it follows that the only reason that Microsoft and Apple dominate the desktop world is because they have a marketing group behind their products, which provides customers with a comfortable customer service layer between themselves and the engineers and programmers at those companies, and also drowns out the message that Linux even exists in the personal computing realm... Part of the problem too is that Linux and most of its associated software is free and open source. What is often a strength when it comes to the quality of software and its flexibility and customizablity becomes a weakness when there's no revenue coming in to actually fund a marketing group that would be able to address this core communications issue between potential future users and the creators of the software. Canonical, Red Hat, SUSE and others all had varying successes, but this illistrates another problem: the splintered nature of open-source software causes a fragmenting not just in the software itself but the resources. Imagine if there were hundreds of different versions of macOS that all Apple users had to learn about and then decide which one was the best for their needs... I have been using Linux exclusively since I ditched XP for 5.10 Breezy Badger and would love to live in a world where I'm not forced into the corporate hellscape of a Windows environment every day for no other reason than most people already know how to use Windows. With a cohesive marketing strategy, I think this could become a reality, but it won't happen through passionate essays on "free as in freedom" or the proper way to pronounce "GNU" or the benefits of using Gentoo instead of Arch. It'll only come if someone can unify all the splintered groups around a cohesive, simple message and market it to the public.' -- source: https://linux.slashdot.org/story/19/11/03/2012226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Incognito Mode For Google Maps Arrives On Android
by Peter Reutemann 01 Nov '19

01 Nov '19

'Incognito Mode for Google Maps is rolling out to Android users to prevent your search queries and real-time tracked location from being recorded onto your Google account. Engadget reports: It's not something you'll want to use all the time as some features will be disabled, and it's important to note that it doesn't turn off all tracking. The places you go won't be saved to your Location History (if you have that enabled), your searches won't be saved to your account and it won't use your information to personalize the experience. Still, you could be tracked by internet service providers, other apps, or if you're using Assistant and other Google services. Similar to incognito on Chrome, it's more useful as a depersonalized look at recommendations than as a full-fledged privacy protector, and a way to make sure that whatever you're searching for in this instance doesn't affect your recommendations later -- don't worry, we're not judging. ' -- source: https://yro.slashdot.org/story/19/11/01/0112223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's Network Congestion Algorithm Isn't Fair, Researchers Say
by Peter Reutemann 01 Nov '19

01 Nov '19

'Researchers at Carnegie Mellon University say a Google algorithm designed help reduce internet congestion is mathematically unfair, resulting in network management systems that may disadvantage some traffic over others. From a report: Several years back, Google began work on a new open source congestion control algorithm (CCA) designed to improve the way the internet functions. The result was BBR, short for Bottleneck Bandwidth and RTT (Round-Trip Time). The goal of the project: to improve how network packets travel between servers to mitigate congestion on the internet. CCAs have long been used to help manage congestion -- ideally while treating all traffic equally. But in a study unveiled last week at the Internet Measurement Conference in Amsterdam, researchers revealed that BBR doesn't actually do a very good job of that last part. In fact, they found that during periods of congestion, BBR connections would take up 40 percent of the available bandwidth, leaving the remaining 60 percent to be fought over by the remaining users on the network.' -- source: https://tech.slashdot.org/story/19/10/31/204226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Text Editor Releases 'Free Uyghur' Edition, Gets Swamped With Chinese Spam
by Peter Reutemann 01 Nov '19

01 Nov '19

Something from the Windows open-source camp rather than Linux: 'This week, the developer of the popular text- and code-editing software Notepad++ released a new version update. Nothing seemed particularly strange about it, except maybe the name: Notepad++ v7.8.1 is the "Free Uyghur" edition. In a blog post announcing the updated version, developer Don Ho writes about the plight of the Uyghur people, an ethnic minority in China that's faced persecution from the country's authoritarian government. China operates internment camps that are used to detain Uyghur people throughout the country's Xinjiang region. Since the announcement, the software's GitHub "issues" page has been bombarded with spam, much of it in the Chinese language. "Stop sending meaningless political-related issues, it just makes you look like an idiot," reads one comment. Another one simply reads, "Bye ! Uninstall." There's a litany of curses, and one asks, "What do you know about China?" Others have moved in to criticize the Chinese government in response. Ho told The Verge that the software's dedicated site was also under a distributed-denial-of-service attack, but that it has been stopped by an anti-DDoS service provided by the site's host. Ho writes in the announcement that he anticipated potential pushback, saying "talking about politics is exactly what software and commercial companies generally try to avoid," but decided to take the step anyway. "The problem is," Ho writes in the announcement of the Free Uyghur edition, "if we don't deal with politics, politics will deal with us.' -- source: https://tech.slashdot.org/story/19/10/31/0037247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 31 Released
by Peter Reutemann 01 Nov '19

01 Nov '19

'Fedora 31 has just rolled out the door. From a report: Is it an exciting release? No, not really. Sure, enthusiasts will find themselves thrilled withe inclusion of the GNOME 3.34 desktop environment (with Qt Wayland by default), Linux 5.3 kernel, and Mesa 9.2, but otherwise, it is fairly boring. You know what? That's not a bad thing. In 2019, Fedora is simply a mature and stable operating system that only needs to follow an evolutionary path at this time -- not revolutionary. It stands alone as the world's best desktop Linux distribution. "Fedora 31 Workstation provides new tools and features for general users as well as developers with the inclusion of GNOME 3.34. GNOME 3.34 brings significant performance enhancements which will be especially noticeable on lower-powered hardware. Fedora 31 Workstation also expands the default uses of Wayland, including allowing Firefox to run natively on Wayland under GNOME instead of the XWayland backend as with prior releases," says The Fedora Project.' -- sources: https://linux.slashdot.org/story/19/10/31/168259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Appeal
by john 30 Oct '19

30 Oct '19

Western community center has recently had all the computers upgraded. However there are ten machines but only five working mouse (mice?) I would find the job easier if there a couple of five port switches available. If any one feels they can help with either or both of these please contact me (can travel) Cheers John..

1 0

New 'Unremovable' XHelper Malware Has Infected 45,000 Android Devices
by Peter Reutemann 30 Oct '19

30 Oct '19

'Over the past six months, a new Android malware strain has made a name for itself after popping up on the radar of several antivirus companies, and annoying users thanks to a self-reinstall mechanism that has made it near impossible to remove. Named xHelper, this malware was first spotted back in March but slowly expanded to infect more than 32,000 devices by August (per Malwarebytes), eventually reaching a total of 45,000 infections this month (per Symantec). The malware is on a clear upward trajectory. Symantec says the xHelper crew is making on average 131 new victims per day and around 2,400 new victims per month. Most of these infections have been spotted in India, the U.S., and Russia. According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan. The good news is that the trojan doesn't carry out destructive operations. According to both Malwarebytes and Symantec, for most of its operational lifespan, the trojan has shown intrusive popup ads and notification spam. The ads and notifications redirect users to the Play Store, where victims are asked to install other apps -- a means through which the xHelper gang is making money from pay-per-install commissions. What's interesting about xHelper is that it gains access to an Android device via an initial app and installs itself as a separate self-standing service. Furthermore, you can't remove the app, as the trojan reinstalls itself every time, even after users perform a factory reset.' -- source: https://tech.slashdot.org/story/19/10/29/2121244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How a months-old AMD microcode bug destroyed my weekend [UPDATED]
by Peter Reutemann 30 Oct '19

30 Oct '19

'This weekend, I was excited to deploy my first Ryzen 3000-powered workstation in my home office. Unfortunately, a microcode bug—originally discovered in July but still floating around in large numbers in the wild—wrecked my good time. I eventually got my Ryzen 3700X system working, and it's definitely fast. But unfortunately, it's still bugged, and there's no easy way to fix it. Not long after the product launch, AMD Ryzen 3000 customers started noticing problems with their shiny new CPUs. Windows users couldn't successfully launch Destiny 2 (due to a power-management bug, unrelated to the one sidelining my system), and Linux users in many cases couldn't even get their system to boot. Jason Evangelho covered the initial discovery and report of the bug at Forbes back in July, and an AMD representative provided him with a statement by email: "AMD has identified the root cause and implemented a BIOS fix for an issue impacting the ability to run certain Linux distributions and Destiny 2 on Ryzen 3000 processors. We have distributed an updated BIOS to our motherboard partners, and we expect consumers to have access to the new BIOS over the coming days." This sounds happy and upbeat, but the reality isn't quite so simple. When there's a bug in the CPU microcode, you're at the mercy of your motherboard vendor to release a new system BIOS that will update it for you—you can't just go to some download link at AMD and apply a fix yourself. AMD responded to the bug in July. As far as I can tell, AMD did so only by direct email response; there's no press release about it—and the company's response made it sound like everything would be fixed in a week or two. I have the unfortunate duty of reporting to you, three months later, that it is not.' -- source: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

50 Years Ago, the Internet Was Born In Room 3420
by Peter Reutemann 30 Oct '19

30 Oct '19

'On October 29, 1969, a graduate student in a UCLA computer science lab logged into a computer hundreds of miles away at the Stanford Research Institute. It was the first connection via ARPANET, which -- after 20 years as a government and academic network -- evolved into the modern internet. Over at Fast Company, Mark Sullivan marked the anniversary by visiting the room where the historic login took place and talking to three of the people who made it happen.' -- source: https://tech.slashdot.org/story/19/10/29/1557212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Patent Troll Versus GNOME Foundation
by Lawrence D'Oliveiro 29 Oct '19

29 Oct '19

An entity named Rothschild Patent Imaging (RPI) is claiming that the GNOME Shotwell app is infringing a patent it holds <https://www.theregister.co.uk/2019/10/22/gnome_linux_lausuit/>. The GNOME Foundation is not settling, instead it is fighting back to try to get the patent invalidated and RPI to pay its legal fees.

2 1

BBC News Launches 'Dark Web' Tor Mirror
by Peter Reutemann 25 Oct '19

25 Oct '19

'The BBC has made its international news website available via the Tor network, in a bid to thwart censorship attempts. The browser can obscure who is using it and what data is being accessed, which can help people avoid government surveillance and censorship. Countries including China, Iran and Vietnam are among those who have tried to block access to the BBC News website or programs. Instead of visiting bbc.co.uk/news or bbc.com/news, users of the Tor browser can visit the new bbcnewsv2vjtpsuy.onion web address. Clicking this web address will not work in a regular web browser.' -- source: https://yro.slashdot.org/story/19/10/24/213258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0