- wlug - list.wlug.org.nz

Attackers exploit 0-day vulnerability that gives full control of Android phones
by Peter Reutemann 06 Oct '19

06 Oct '19

'Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night. There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the "exploit has nothing to do with NSO." Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content. “The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”' -- source: https://arstechnica.com/information-technology/2019/10/attackers-exploit-0d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Malware 'Patches' Chrome and Firefox To Fingerprint TLS Traffic
by Peter Reutemann 06 Oct '19

06 Oct '19

'A Russian cyber-espionage hacker group has been spotted using a novel technique that involves patching locally installed browsers like Chrome and Firefox in order to modify the browsers' internal components. The end goal of these modifications is to alter the way the two browsers set up HTTPS connections, and add a per-victim fingerprint for the TLS-encrypted web traffic that originates from the infected computers... According to a Kaspersky report published this week, hackers are infecting victims with a remote access trojan named Reductor, through which they are modifying the two browsers. This process involves two steps. They first install their own digital certificates to each infected host. This would allow hackers to intercept any TLS traffic originating from the host. Second, they modify the Chrome and Firefox installation to patch their pseudo-random number generation (PRNG) functions. These functions are used when generating random numbers needed for the process of negotiating and establishing new TLS handshakes for HTTPS connections. Turla hackers are using these tainted PRNG functions to add a small fingerprint at the start of every new TLS connection. The attack is being attributed to Turla, "a well-known hacker group believed to operate under the protection of the Russian government," ZDNet reports. And though the remote-access trojan already grants full control over a victim's device, one theory is the modified browsers offer "a secondary surveillance mechanism" if that trojan was discovered and removed. Researchers believe the malware is installed during file transfers over HTTP connections, suggesting an ISP had been compromised, according to the article. "A January 2018 report from fellow cyber-security firm ESET revealed that Turla had compromised at least four ISPs before, in Eastern Europe and the former Soviet space, also with the purpose of tainting downloads and adding malware to legitimate fil' -- source: https://news.slashdot.org/story/19/10/06/2242221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Might Bring Its Edge Browser To Linux
by Peter Reutemann 06 Oct '19

06 Oct '19

'Microsoft appears to be porting its Edge browser to Linux, reports ZDNet: "We on the MS Edge Dev team are fleshing out requirements to bring Edge to Linux, and we need your help with some assumptions," wrote Sean Larkin, a member of Microsoft's Edge team.... Chrome, of course, is already available for Linux, so Microsoft should be able to deliver Chromium-based Edge to Linux distributions with minimal fuss.... [I]n June Microsoft Edge developers said there are "no technical blockers to keep us from creating Linux binaries" and that it is "definitely something we'd like to do down the road". Despite Chrome's availability on Linux, the Edge team noted there is still work to be done on the installer, updaters, user sync, and bug fixes, before it could be something to commit to properly. Slashdot reader think_nix shared a link to the related survey that the Edge team has announced on Twitter. "If you're a dev who depends on Linux for dev, testing, personal browsing, please take a second to fill out this survey."' -- source: https://linux.slashdot.org/story/19/10/05/1723204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

To Fight Spectre-Like Attacks, Intel Suggests a New Kind of Memory
by Peter Reutemann 06 Oct '19

06 Oct '19

'Intel researchers published a paper last week suggesting a new kind of CPU memory to block side-channel attacks like Meltdown and Spectre, according to ZDNet: SAPM -- or Speculative-Access Protected Memory -- is the work of Intel STORM (STrategic Offensive Research & Mitigations), a team of elite security researchers that Intel assembled since 2017 to work on creating mitigations for all the speculative-execution attacks that have impacted the CPU maker's products. SAPM is only an idea for the moment, and there are no silicon prototypes. Intel STORM engineers only released "the theory and possible implementation options," to provide "a ground base for other researchers to improve upon and also for the industry to consider...." Intel STORM researchers say SAPM will implement protections at the hardware level and will work with both physical and virtual memory addresses. "SAPM can be applied to specific memory ranges, with the attribute that any memory access to such memory type will be instruction-level serialized, meaning that any speculative execution beyond the SAPM-accessing instruction will be stopped pending the successful retirement of this SAPM-accessing instruction," Intel STORM developers said in their short description of SAPM's basic principles... Intel STORM researchers say the second part (backend) of most speculative execution attacks performs the same actions. SAPM was designed to introduce hardware-based protections against the backend part of most attacks. It's because of this concept that Intel's research team believes that SAPM will also future-proof the next generations of Intel CPUs against other -- currently undiscovered -- speculative execution attacks. "Intel STORM researchers don't deny that there's a performance hit," the article adds. "However, this impact is low and could be mitigated further by dropping other existing protections."' -- source: https://hardware.slashdot.org/story/19/10/05/0315201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

COSMO and Psions
by tom butz 06 Oct '19

06 Oct '19

The Psions were good as long as there was still a dial-up Internet around: they could even generate the DTMF-tones out of telephone-numbers and use them to dial using your phone's microphone. I've kept a 3c-model because of its database program. None of the Psions actually were phones. As they only supported dial-up Internet, I had a look for ISP's that still supported that, and found one (serving the Australian Outback). Unfortunately they didn't accept new customers. As far as second screens are concerned, a while ago there was a Finnish/Russian phone/PDA that had a black and white additional screen on its back. That one drew very little power and could be used for notes and - checking who called. Typing, however, was as clumsy as on any phone. The COSMO features a colour-screen on its back - coloured LEDs instead obviously would've been as user-friendly as Morse-code (for telling you who was calling, if you didn't want to open your phone). In a perfect world, developers would have come up with a Psion keyboard, Internet/WiFi/Bluetooth capability and a black and white screen at the back. Today's cameras are good at taking/watching photos/videos, and they are a lot less chunky.

1 0

Psion Reborn
by Lawrence D'Oliveiro 05 Oct '19

05 Oct '19

The Cosmo Communicator should be shipping to its backers next week <https://www.theregister.co.uk/2019/10/04/planet_launches_cosmo_communicator…>. It has more than a passing resemblance to the Psion clamshell pocket PCs of the 1990s, except this one has an open design, intended to allow it to run a choice of open-source operating systems. This looks to be a niche market, compared to the millions of units shipped by all the usual big-name vendors. But if they can make enough money--and keep enough customers happy--to stay in business, why not?

1 0

Award For “Most Spectacular Misuse Of Microsoft Excel”?
by Lawrence D'Oliveiro 04 Oct '19

04 Oct '19

Astronaut Tim Peake blames the spreadsheet for his dialling a wrong number during his stint on the International Space Station <https://www.theregister.co.uk/2019/10/02/future_decoded_peake/>: "I'm still blaming that on the software, I imported my contacts address book in Excel and all the 9s got rounded up to 0s…" Will people never learn <https://www.youtube.com/watch?v=S8wO4ppE9L8> ...

1 0

Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook's Apps
by Peter Reutemann 03 Oct '19

03 Oct '19

'Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety. From a report: A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication. Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook's plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling. "Security enhancements to the virtual world should not make us more vulnerable in the physical world," the letter reads. "Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes." The letter calls on Facebook to prioritize public safety in designing its encryption by enabling law enforcement to gain access to illegal content in a manageable format and by consulting with governments ahead of time to ensure the changes will allow this access. While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children."' -- source: https://it.slashdot.org/story/19/10/03/1847213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MorphOS 3.12 Released
by Peter Reutemann 03 Oct '19

03 Oct '19

'Mike Bouma shares a post from MorphZone, detailing the latest update to the AmigaOS-like computer operating system known as MorphOS: The MorphOS development team is proud to announce the public release of MorphOS 3.12. This new version introduces brand new dual-monitor capabilities to various Powerbook laptops as well as G5 desktop systems, and features improved thermal management, fan control and dynamic CPU frequency switching, which provide increased energy efficiency and reduced noise levels. Additionally, the Helios Firewire stack has been fully integrated into the core OS and we added support for hundreds of modern printers and scanners. The installation and troubleshooting guides should be carefully read prior to installation. You can download MorphOS 3.12 here.' -- source: https://tech.slashdot.org/story/19/10/02/219220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Ryzen Pro 3000 series desktop CPUs will offer full RAM encryption
by Peter Reutemann 02 Oct '19

02 Oct '19

'Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them. >From a more technical perspective, the answer is that the Ryzen Pro line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard—"a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory"—matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.' -- source: https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most mobile browsers display the Web, that’s it—Vivaldi Mobile can change that
by Peter Reutemann 01 Oct '19

01 Oct '19

'Vivaldi—makers of the power user's favorite Web browser—has finally released a mobile version. Vivaldi for Android (sorry iOS users, it's Android-only for now) brings most of what's great about Vivaldi to your phone, and thanks to Vivaldi's sync service, you can even have all your desktop data on your mobile device. Web browsers are perhaps the most important piece of software we use in 2019. Our devices are often little more than small windows onto the Web, and the browser is what we use to see and explore what's in that window. For all its importance though, the modern browser, especially the mobile Web browser, offers precious little in the way of features. It displays the Web and... that's about it. Want to interact with what you see? You're mostly out of luck. Most people probably like their browser this way. Google, maker of the most widely used mobile browser, rarely does anything without extensive user testing. If Chrome is minimalist, it's safe to assume it's that way because Google has determined that's what its users want. And since most other browsers copy whatever Google Chrome does, most mobile Web browsers end up as minimalistic pieces of software. On the desktop, of course, there has long been an exception to the uniformly dumbed-down offerings of Chrome, Firefox, and Safari—Vivaldi. Led by CEO Jon S. von Tetzchner, co-founder and former CEO of Opera, Vivaldi's primary goal is to build a useful browser, a tool you can bend to your will rather than the other way around. You can customize Vivaldi the way you like. Its preferences may be overwhelming at first glance, but if you dig in, you can make Vivaldi do just about whatever you want it to do. For this reason, Vivaldi is often called a "power user's browser" (as opposed to, I guess, the powerless user's browser). For all that, there was always one big problem with Vivaldi: it was desktop only. The company said it was working on a mobile version from the beginning, and von Tetzchner told me several times he was already using it. But there was nothing for the rest of us. Now Vivaldi Mobile is here (again, for Android users at least). Technically, it's a beta release and all the common cautions regarding beta software apply, but I've been using it for over a month now and have had no problems. Or, I should say, I have had problems, but updates prior to the public release eliminated all of them. And even if there were still bugs, Vivaldi would still be more useful than any other browser on my phone based on this recent testing—and yes, I've tried nearly all of today's mobile browsers, even the small, cottage efforts.' -- source: https://arstechnica.com/information-technology/2019/10/vivaldi-mobile-revie… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's DNS-Over-TLS Plans Scrutinized By US Congress
by Peter Reutemann 01 Oct '19

01 Oct '19

'Google's plans to implement DNS over TLS in Chrome are being investigated by a committee in the U.S. House of Representatives, while the Justice Department has "recently received complaints" about the practice, according to the Wall Street Journal. An anonymous reader quotes Engadget: While Google says it's pushing for adoption of the technology to prevent spying and spoofing, House investigators are worried this would give the internet giant an unfair advantage by denying access to users' data. The House sent a letter on September 13th asking if Google would use data handled through the process for commercial purposes... Internet service providers are worried that they may be shut out of the data and won't know as much about their customers' traffic patterns. This could "foreclose competition in advertising and other industries," an alliance of ISPs told Congress in a September 19th letter... Mozilla also wants to use the format to secure DNS in Firefox, and the company's Marshall Erwin told the WSJ that the antitrust gripes are "fundamentally misleading." ISPs are trying to undermine the standard simply because they want continued access to users' data, Erwin said. Unencrypted DNS helps them target ads by tracking your web habits, and it's harder to thwart DNS tracking than cookies and other typical approaches. ' -- source: https://tech.slashdot.org/story/19/09/29/2033247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

UK Court Rules That E-Mail Sig Blocks Can Sign Contracts
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

An e-mail exchange has been ruled to be a binding contract <https://www.theregister.co.uk/2019/09/30/email_signature_legally_binding_co…> because the senders included their names at the end, as people commonly do.

1 0

Linus Torvalds Approves New Kernel 'Lockdown' Feature
by Peter Reutemann 30 Sep '19

30 Sep '19

'"After years of countless reviews, discussions, and code rewrites, Linus Torvalds approved on Saturday a new security feature for the Linux kernel, named 'lockdown'," reports ZDNet: The new feature will ship as a LSM (Linux Security Module) in the soon-to-be-released Linux kernel 5.4 branch, where it will be turned off by default; usage being optional due to the risk of breaking existing systems. The new feature's primary function will be to strengthen the divide between userland processes and kernel code by preventing even the root account from interacting with kernel code -- something that it's been able to do, by design, until now. When enabled, the new "lockdown" feature will restrict some kernel functionality, even for the root user, making it harder for compromised root accounts to compromise the rest of the OS... "When enabled, various pieces of kernel functionality are restricted," said Linus Torvalds, Linux kernel creator, and the one who put the final stamp of approval on the module yesterday. This includes restricting access to kernel features that may allow arbitrary code execution via code supplied by userland processes; blocking processes from writing or reading /dev/mem and /dev/kmem memory; block access to opening /dev/port to prevent raw port access; enforcing kernel module signatures; and many more others, detailed here.' -- source: https://linux.slashdot.org/story/19/09/30/0312211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Promises UK Government DNS-Over-HTTPS Won't Be Default in UK
by Peter Reutemann 30 Sep '19

30 Sep '19

'"Despite looking to make DNS-over-HTTPS the default for its American users, Mozilla has assured culture secretary Nicky Morgan that this won't be the case in the UK," reports Gizmodo: DNS-over-HTTPS has been fairly controversial, with the Internet Services Providers Association nominating Mozilla for an 'Internet Villain' over the whole thing, saying it will "bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK." In his letter to Morgan, Mozilla vice president of global policy, trust and security, Alan Davidson, stressed that the company "has no plans to turn on our DNS-over-HTTPS feature by default in the United Kingdom and will not do so without further engagement with public and private stakeholders". He did add that Mozilla does "strongly believe that DNS-over-HTTPS would offer real security benefits to UK citizens. The DNS is one of the oldest parts of the internet's architecture, and remains largely untouched by efforts to make the web more secure. "Because current DNS requests are unencrypted, the road that connects your citizens to their online destination is still open and used by bad actors looking to violate user privacy, attack communications, and spy on browsing activity. People's most personal information, such as their health-related data, can be tracked, collected, leaked and used against people's best interest. Your citizens deserve to be protected from that threat."' -- source: https://news.slashdot.org/story/19/09/29/0434233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Do We Need To Rethink What Free Software Is?
by Peter Reutemann 30 Sep '19

30 Sep '19

'Matthew Garrett is a security developer at Google and a Linux contributor who in 2014 won the Free Software Foundation's annual "Advancement of Free Software" award. But now he's asking if we need to re-think what free software is: If users can pay Amazon to provide a hosted version of a piece of software, there's little incentive for them to pay the authors of that software. This has led to various projects adopting license terms such as the Commons Clause that effectively make it nonviable to provide such a service, forcing providers to pay for a commercial use license instead. In general the entities pushing for these licenses are VC backed companies who are themselves benefiting from free software written by volunteers that they give nothing back to, so I have very little sympathy. But it does raise a larger issue -- how do we ensure that production of free software isn't just a mechanism for the transformation of unpaid labour into corporate profit...? At the same time, people are spending more time considering some of the other ethical outcomes of free software. Copyleft ensures that you can share your code with your neighbour without your neighbour being able to deny the same freedom to others, but it does nothing to prevent your neighbour using your code to deny other fundamental, non-software, freedoms. As governments make more and more use of technology to perform acts of mass surveillance, detention, and even genocide, software authors may feel legitimately appalled at the idea that they are helping enable this by allowing their software to be used for any purpose. The JSON license includes a requirement that "The Software shall be used for Good, not Evil", but the lack of any meaningful clarity around what "Good" and "Evil" actually mean makes it hard to determine whether it achieved its aims. As stewards of the free software definition, the Free Software Foundation should be taking the lead in ensuring that these issues are discussed. The priority of the board right now should be to restructure itself to ensure that it can legitimately claim to represent the community and play the leadership role it's been failing to in recent years, otherwise the opportunity will be lost and much of the activist energy that underpins free software will be spent elsewhere. If free software is going to maintain relevance, it needs to continue to explain how it interacts with contemporary social issues. If any organisation is going to claim to lead the community, it needs to be doing that.' -- source: https://news.slashdot.org/story/19/09/28/1741229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism's Librem 5 Phone Starts Shipping. It Can Run Linux Desktop Apps
by Peter Reutemann 30 Sep '19

30 Sep '19

'On Tuesday Purism announced their first Librem 5 smartphones were rolling off the assembly line and heading to customers. "Seeing the amazing effort of the Purism team, and holding the first fully functioning Librem 5, has been the most inspirational moment of Purism's five year history," said their founder and CEO Todd Weaver. On Wednesday they posted a video announcing that the phones were now shipping, and Friday they posted a short walk-through video. "The crowdsourced $700 Linux phone is actually becoming a real product," reports Ars Technica: Purism's demand that everything be open means most of the major component manufacturers were out of the question. Perhaps because of the limited hardware options, the internal construction of the Librem 5 is absolutely wild. While smartphones today are mostly a single mainboard with every component integrated into it, the Librem 5 actually has a pair of M.2 slots that house full-size, off-the-shelf LTE and Wi-Fi cards for connectivity, just like what you would find in an old laptop. The M.2 sockets look massive on top of the tiny phone motherboard, but you could probably replace or upgrade the cards if you wanted... [Y]ou're not going to get cutting-edge hardware at a great price with the Librem 5. That's not the point, though. The point is that you are buying a Linux phone, with privacy and open source at the forefront of the design. There are hardware kill switches for the camera, microphone, WiFi/Bluetooth, and baseband on the side of the phone, ensuring none of the I/O turns on unless you want it to. The OS is the Free Software Foundation-endorsed PureOS, a Linux distribution that, in this case, has been reworked with a mobile UI. Purism says it will provide updates for the "lifetime" of the device, which would be a stark contrast to the two years of updates you get with an Android phone. PureOS is a Debian-based Linux distro, and on the Librem 5, you'll get to switch between mobile versions of the Gnome and KDE environments. If you're at all interested in PureOS, Purism's YouTube page is worth picking through. Dozens of short videos show that, yes, this phone really runs full desktop-class Linux. Those same videos show the dev kit running things like the APT package manager through a terminal, a desktop version of Solitaire, Emacs, the Gnome disk utility, DOSBox, Apache Web Server, and more. If it runs on your desktop Linux computer, it will probably run on the Librem 5, albeit with a possibly not-touch-friendly UI. The Librem 5 can even be hooked up to a monitor, keyboard, and mouse, and you can run all these Linux apps with the normal input tools... Selling a smartphone is a cutthroat business, and we've seen dozens of companies try and fail over the years. Purism didn't just survive long enough to ship a product -- it survived in what is probably the hardest way possible, by building a non-Android phone with demands that all the hardware components use open code. Making it this far is an amazing accomplishment. ' -- source: https://mobile.slashdot.org/story/19/09/29/0548215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Libre-RISC-V 3D CPU/GPU Seeks Grants For Ambitious Expansion
by Peter Reutemann 30 Sep '19

30 Sep '19

'The NLNet Foundation is a non-profit supporting privacy, security, and the "open internet". Now the open source Libre RISC-V hybrid CPU/GPU is applying for eight additional grants from the NLNet Foundation, according to this update from the project's Luke Kenneth Casson Leighton (Slashdot reader #517,947): Details on each Grant Application are on the newly-opened RISC-V Community Forum. The general idea is to kick RISC-V into a commercially-viable mass-volume high gear by putting forward funding proposals for NEON/SSE-style Video Acceleration to be upstreamed for use by ffmpeg, vlc, mplayer and gstreamer; hardware-assisted Mesa 3D (a port of the RADV Vulkan Driver to RISC-V), and a hardware-accelerated OpenCL port to RISC-V. This all in a "Hybrid" fashion (a la NEON/SSE) as opposed to the "usual" way that 3D and Video is done, which hugely complicate both software drivers and applications debugging. In addition, the Libre RISC-V SoC itself is applying for grants to do a gcc port supporting its Vectorisation Engine including auto-vectorisation, and, crucially, to do an entirely Libre-licensed ASIC Layout using LIP6.fr coriolis2, working in tandem with Chips4Makers to create a 180nm commercially-viable single-core dual-issue test ASIC. The process takes approximately 2-3 months for approval. Once accepted, anyone may be the direct (tax-deductible) recipient of NLNet donations, for sub-tasks completed. Worth noting: Puri.sm is sponsoring the project, and, given NLNet's Charitable Status, donations from Corporations (or individuals) are 100% tax-deductible.' -- source: https://hardware.slashdot.org/story/19/09/29/1845252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Is Still Head of the GNU Project
by Peter Reutemann 30 Sep '19

30 Sep '19

'On Thursday, Richard Stallman reminded the GNU Project mailing list that "On September 16 I resigned as president of the Free Software Foundation, but the GNU Project and the FSF are not the same. I am still the head of the GNU Project (the Chief GNUisance), and I intend to continue as such." The next day, with no explanation, a one-sentence update appeared on his personal blog at Stallman.org announcing that "I hereby step down as head of the GNU Project, effective immediately." But a few commenters on social media speculated that the post could have come from someone who'd hijacked Stallman's site -- and sure enough, that sentence had been removed by Sunday morning. In addition, for what it's worth Techrights.org posted an unconfirmed claim Sunday from "a generally reliable source" that "Stallman.org was defaced by an FSF employee. The deface has been reverted, and the domain appears to now be operating on non-FSF infrastructure..." But whatever's happening, Richard Stallman is still living the life of Richard Stallman. Friday he also posted that he's looking for a room in a shared house or apartment for at least two months. "There should not be a cat (unless hypoallergenic), or a dog that jumps up excitedly on people (unless quite small), or a digital listening device such as Echo, Siri or 'Hello Google', or a card lock that records who opens the door. I will ask about cameras."' -- source: https://news.slashdot.org/story/19/09/29/054211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Roll On The Paperless Office?
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

The “Paperless Office” was a prediction from back in the 1970s or so that, with the increasing use of electronic automation for business data processing, the need for paper documents would diminish over time and eventually go away. Then with the increasing popularity of PCs came the demand for printers to print the documents created with them, and it seemed the trend was the opposite--electronic automation was producing even more paper documents than ever, rather than less. Well, maybe we have seen “peak paper”, according to <https://www.theregister.co.uk/2019/09/13/wall_street_analyst_slashes_hp_inc…>: The company is currently trying to dig itself out a hole of its own making: it mis-forecast toner cartridge revenues in EMEA for FY'19 that started in October last year, not factoring in the burgeoning demand for cloned or remanufactured alternatives or - seemingly - that businesses are printing less than they used to.

4 10

4K / Ultra High Definition Monitors
by Ian Stewart 27 Sep '19

27 Sep '19

Hi Folks, For those of you at last nights meeting you'll recollect there was some discussion on Ultra High Definition<https://en.wikipedia.org/wiki/4K_resolution> computer monitors (i.e. "4K" monitors). With such a large resolution monitor there were jokes made about sitting on the other side of the room in order to use your computer. Today I found links to a Canadian web-site that seems to have created a science out of how far to sit in front of a TV monitor... https://www.rtings.com/tv/reviews/by-size/size-to-distance-relationship ...and... https://www.rtings.com/tv/learn/4k-ultra-hd-uhd-vs-1080p-full-hd-tvs-and-up… ...apparently you sit closer to a 4K/UHD TV monitor than a 1080/HD TV monitor. In fact, if you sit too far away from a 4K/UHD monitor then there is no point in having one and you should have stuck with a 1080/HD monitor! I notice that PB-Tech for the category of 4K Monitors<https://www.pbtech.co.nz/category/peripherals/monitors/4k-monitors>, the sizes are mostly in the range 24 inch to 32 inch, while 4K TVs<https://www.pbtech.co.nz/category/tv-av/tvs/4k-televisions> have screens in the range 43 inch to 86 inch. The cheapest 32 inch 4K monitor I found was a Kogan 32" Ultra HD 4K FreeSync IPS Monitor (3840 x 2160) that is available by purchasing on-line at NZ$370 plus shipping from kogan<https://www.kogan.com/nz/buy/kogan-32-ultra-hd-4k-freesync-ips-monitor-3840…>. Getting a 4K monitor is one thing, being able to feed it with true 4K created video is the next challenge. I don't think it will be coming out of a Freeview box in NZ for a while ;-) However, with the adoption and take-up of the AV1<https://en.wikipedia.org/wiki/AV1> standard, then more 4K video content should become available to stream from the internet. If your Desktop PC doesn't have a 4K (3980 x 1920 pixel) graphics capability, then don't forget that for a starting price of around $150 will be required for a PCI-e 4K graphics adapter<https://www.pbtech.co.nz/product/VGAGBV11032/Gigabyte-GeForce-GT1030-2GB-GD…>. cheers, Ian.

2 4

Cloudflare, Google Chrome, and Firefox Add HTTP/3 Support
by Peter Reutemann 27 Sep '19

27 Sep '19

'HTTP/3, the next major iteration of the HTTP protocol, is getting a big boost today with support added in Cloudflare, Google Chrome, and Mozilla Firefox. From a report: Starting today, Cloudflare announced that customers will be able to enable an option in their dashboards and turn on HTTP/3 support for their domains. That means that whenever users visit a Cloudflare-hosted website from an HTTP/3-capable client, the connection will automatically upgrade to the new protocol, rather than being handled via older versions. On the browser side, Chrome Canary added support for HTTP/3 earlier this month. Users can enable it by using the Chrome command-line flags of "--enable-quic --quic-version=h3-23". In addition, Mozilla too announced it would roll out support for HTTP/3. The browser maker is scheduled to ship HTTP/3 in an upcoming Firefox Nightly version later this fall.' -- source: https://news.slashdot.org/story/19/09/26/1710239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Phrase Of The Week: “Chaos Engineering”
by Lawrence D'Oliveiro 27 Sep '19

27 Sep '19

How about a company that offers “Failure-As-A-Service” <https://www.theregister.co.uk/2019/09/26/organizing_chaos_gremlin_announces…>? That is, they make it easier to deliberately trigger various kinds of infrastructure problems and outages (under controlled conditions, of course) to make sure that your systems that are supposed to be designed for resiliency, actually do what they say on the tin. Quote from their Senior Site Reliability Engineer: “I like to do a CPU attack first. It's the Hello World of chaos engineering.”

1 0

Why So Many Apps Are Asking To Use Bluetooth on iOS 13
by Peter Reutemann 26 Sep '19

26 Sep '19

'Apple's new iOS 13 update adds a new privacy measure that requires apps to get your consent in order to use your device's Bluetooth. From a report: After installing the latest version of iOS, trust me when I say you'll be surprised by the number of apps asking for Bluetooth permission the next time you open them. Some might seem very strange (like Dunkin' Donuts in my case), but others probably won't make you think twice about giving the thumbs-up. The reason Apple implemented this is because Bluetooth has enabled companies to sneakily track your location over Bluetooth by using beacons in stores, shopping malls, and even on popular city streets if they're placed within range of a place you'd walk by. This is entirely separate from your iPhone's location privacy settings, which makes it seem all the more underhanded. A beacon is very easily able to detect your device's Bluetooth chip and log that with a retailer or some other app on your phone. So getting more strict about Bluetooth is a good move by Apple to prevent unwanted tracking of its customers. Similarly, the company is also getting even more transparent about location, showing you on a map how often and where apps have recorded your position. This prompt is much easier to understand, and will probably startle people into slimming down the list of apps that can monitor where they are. As it should!' -- source: https://apple.slashdot.org/story/19/09/26/1928204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

High-severity vulnerability in vBulletin is being actively exploited
by Peter Reutemann 26 Sep '19

26 Sep '19

'Attackers are mass-exploiting an anonymously disclosed vulnerability that makes it possible to take control of servers running vBulletin, one of the Internet’s most popular applications for website comments. Sites running the app should take comments offline until administrators install a patch that vBulletin developers released late Wednesday morning. The vulnerability was disclosed through an 18-line exploit that was published on Monday by an unidentified person. The exploit allows unauthenticated attackers to remotely execute malicious code on just about any vBulletin server running versions 5.0.0 up to 5.5.4. The vulnerability is so severe and easy to exploit that some critics have described it as a back door.' -- source: https://arstechnica.com/information-technology/2019/09/public-exploit-code-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The /e/ Google-Free, Pro-Privacy Android Clone Is Now Available
by Peter Reutemann 26 Sep '19

26 Sep '19

'Gael Duval, creator of the popular early Linux distribution, Mandrake Linux, wanted a smartphone, which was open source, would run a wide variety of popular software, and protect your privacy. His answer was the Android-based /e/ operating system and smartphones. While it's still in beta, both its code and refurbished Samsung phones running it are now available. Duval's approach hasn't been to reinvent the mobile operating system wheel, but instead to clean up Android of its Google privacy-invading features and replace them with privacy-respecting one, in which, as Duval said in an interview, "Your data is your data." To do this, he's started with LineageOS. This is an Android-based operating system, which is descended from the failed CyanogenMod Android fork. According to Duval, the /e/ operating system is a Lineage OS fork. It also blends in features from the Android Open Source Project (AOSP) 7, 8, and 9 source-code trees. In the /e/ OS all Google services have been removed and replaced with MicroG services. MicroG replaces Google's libraries with purely open-source implementations without hooks to Google's services. This includes libraries and apps which provide Google Play, Maps, Geolocation, and Messaging services for the Android applications when they need them. What this means is that you can run some Android apps, which normally only work on a fully Google-enabled Android phone on an /e/ phone. These compatible apps are available via the /e/ app store. The /e/ platform also comes with its own services, the report notes. For example, its search program uses Qwant, a popular, privacy-first European-based search engine, and for cloud storage, you get /e/'s own cloud, which is based on the open-source NextCloud. You can download and install /e/ on 85 different smartphone models. You can also buy an /e/ phone today if you're in the EU.' -- source: https://linux.slashdot.org/story/19/09/25/2129247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Developer Made an Ad Blocker That Works On Podcasts and Radio
by Peter Reutemann 25 Sep '19

25 Sep '19

'Meet AdBlock Radio, an adblocker for live radio streams and podcasts. Its creator, Alexandre Storelli, told Motherboard he hopes to help companies "develop alternative business models for radio and podcast lovers that do not want ads." "Ads exploit the weaknesses of many defenseless souls," Storelli told Motherboard. "Ads dishonestly tempt people, steal their time and promise them a higher social status. Blocking them will be a relieving experience for many." Most audio ads exploit "auditory artifacts" to produce an ad that can't be ignored or tuned out because it feels louder than it actually is -- this has gotten so bad that there has actually been a "sonic arms race" where ads have been made increasingly louder over the years. "Adblock Radio detects audio ads with machine-learning and Shazam-like techniques," Storelli wrote about the project. He said he's been working on it for more than three years and that it uses techniques such as speech recognition, acoustic fingerprinting, and machine learning to detect known ad formats. It uses a crowdsourced database of ads and "acoustic fingerprinting," which converts audio features into a series of numbers that can be combed by an algorithm. Storelli has made Adblock Radio open-source and given detailed instructions on how to build on it, integrate it into user devices, and deploy it in a way that pressures radio stations (and podcasts) to self-regulate the quality of their ads.' -- source: https://entertainment.slashdot.org/story/19/09/25/2056215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 10 Go Edition Improves Speed and Security For Low-cost Phones
by Peter Reutemann 25 Sep '19

25 Sep '19

'Android Go has made smartphones more accessible by focusing on lower-cost devices, but it's frequently pokey and sometimes insecure -- not a great introduction to modern mobile tech. Google is aware of this, though, and it's tackling those issues head-on with its newly unveiled Android 10 Go edition. From a report: The scaled-back version of Android 10 puts a strong focus on speed, with faster and more memory-efficient app switching as well as launching that's 10 percent faster than in Android 9 Go. It should be more reliable, too. For some, data protection may be the real star of the show. Android 10 Go edition includes a new Adiantum encryption system that should secure data without affecting performance or requiring special hardware. You won't have to worry that your sensitive info is vulnerable simply because you bought an entry-level device.' -- source: https://mobile.slashdot.org/story/19/09/25/1648239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s Cascadia Font Offers Ligatures For Programmers
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

I just heard of this <https://devblogs.microsoft.com/commandline/cascadia-code/>, though it was apparently announced back in May. It has OpenType context-dependent substitutions for displaying “>=” as “≥”, “/=” as “≠” among others. Me? I just think it’s about time programming languages supported those Unicode characters directly.

1 0

Quantum Computers Are Analog Computers
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

Google continues to experiment with quantum computing <https://arstechnica.com/science/2019/09/paper-leaks-showing-a-quantum-compu…>. This latest result (albeit preliminary) sounds impressive: But that seriously understates what's going on here. Every calculation that's done on a quantum computer will end up being a measurement of a quantum system. And in this case, there is simply no way to get that probability distribution using a classical computer. With this system, we can get it in under 10 minutes, and most of that time is spent in processing that doesn't involve the qubits. As the researchers put it, "To our knowledge, this experiment marks the first computation that can only be performed on a quantum processor." but it is still just reinforcing the point I made earlier <https://list.waikato.ac.nz/hyperkitty/list/wlug(a)list.waikato.ac.nz/thread…>, that quantum computers are just a reboot of the old idea of “analog” computers. These are able to do fast simulations of physical systems (in this case, a quantum probability distribution), to limited precision. But they continue to be useless for number-theoretic calculations, such as factoring large integers. Or code cracking.

1 0

EU Right To Be Forgotten Is For Europe Only
by Lawrence D'Oliveiro 25 Sep '19

25 Sep '19

The EU Court of Justice has ruled in favour of Google <https://arstechnica.com/tech-policy/2019/09/google-wins-case-as-court-rules…>, in saying that France’s claim that any “right to be forgotten” has to be implemented worldwide cannot apply. While it is true that, in an always-online connected world, the ease of bypassing regional bans makes a mockery of local laws, how do you reconcile the ability of one country to impose communication blocks on others with the idea of national sovereignty?

1 0

Linux Foundation Exec Believes Edge Computing Will Be More Important Than Cloud Computing
by Peter Reutemann 23 Sep '19

23 Sep '19

'Once upon a time, back when we all had mainframes and then servers in our offices, we had edge computing. Our compute power was literally down the hall. Then, along came the cloud, and all that changed. Computers were hundreds of miles but milliseconds away. Now, with the rise of IoT, 5G, and our never-satisfied need for speed, edge computing is coming back with a vengeance. Indeed, at his keynote at Open Networking Summit in Belgium, Arpit Joshipura, The Linux Foundation's general manager of networking, said "edge computing will overtake cloud computing" by 2025. When Joshipura is talking about edge computing, he means compute and storage resources that are five to 20 milliseconds away. He also means edge computing should be an open, interoperable framework. This framework should be independent of hardware, silicon, cloud, or operating system. Open-edge computing should also work with any edge-computing use case: Internet of Things (IoT) edge, a telecom edge, cloud edge, or enterprise edge, whatever, "Our goal here is to unify all of these." This is being done via LF Edge. This Linux Foundation organization seeks to bring all edge computing players under one umbrella with one technology. Its purpose is to create a software stack that unifies a fragmented edge market around a common, open vision for the future of the industry. To make this happen, Joshipura announced two more projects were being incorporated into LF Edge: Baetyl and Fledge.' -- source: https://slashdot.org/story/19/09/23/1722226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU's Former Kernel Maintainer Shares 'A Reflection on the Departure of Richard Stallman'
by Peter Reutemann 22 Sep '19

22 Sep '19

'Thomas Bushnell, BSG, founded GNU's official kernel project, GNU Hurd, and maintained it from 1990 through 2003. This week on Medium he posted "a reflection on the departure of RMS." There has been some bad reporting, and that's a problem. While I have not waded through the entire email thread Selam G. has posted, my reaction was that RMS did not defend Epstein, and did not say that the victim in this case was acting voluntarily. But it's not the most important problem. It's not remotely close to being the most important problem. This was an own-goal for RMS. He has had plenty of opportunities to learn how to stfu when that's necessary. He's responsible for relying too much on people's careful reading of his note, but even that's not the problem. He thought that Marvin Minsky was being unfairly accused. Minsky was his friend for many many years, and I think he carries a lot of affection and loyalty for his memory. But Minsky is also dead, and there's plenty of time to discuss at leisure whatever questions there may be about his culpability. RMS treated the problem as being "let's make sure we don't criticize Minsky unfairly", when the problem was actually, "how can we come to terms with a history of MIT's institutional neglect of its responsibilities toward women and its apparent complicity with Epstein's crimes". While it is true we should not treat Minsky unfairly, it was not -- and is not -- a pressing concern, and by making it his concern, RMS signaled clearly that it was much more important to him than the question of the institution's patterns of problematic coddling of bad behavior. And, I think, some of those focusing themselves on careful parsing of RMS's words are falling into the same pitfall as he.... Minsky was RMS's protector for a long long time. He created the AI Lab, where I think RMS found the only happy home he ever knew. He kept the rest of the Institute at bay and insulated RMS from attack (as did other faculty that also had befriended RMS). I was around for most of the 90s, and I can confirm the unfortunate reality that RMS's behavior was a concern at the time, and that this protection was itself part of the problem... Bushnell also calls Stallman "a tragic figure. He is one of the most brilliant people I've met, who I have always thought desperately craved friendship and camaraderie, and seems to have less and less of it all the time. This is all his doing; nobody does it to him. But it's still very sad. As far as I can tell, he believes his entire life's work is a failure..." But Bushnell concludes that "It is time for the free software community to leave adolescence and move to adulthood, and this requires leaving childish tantrums, abusive language, and toxic environments behind."' -- source: https://news.slashdot.org/story/19/09/21/0253227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian May Need To Re-Evaluate Its Interest In 'Init System Diversity'
by Peter Reutemann 22 Sep '19

22 Sep '19

'"Debian Project Leader Sam Hartman has shared his August 2019 notes where he outlines the frustrations and issues that have come up as a result of init system diversity with some developers still aiming to viably support systemd alternatives within Debian," reports Phoronix: Stemming from elogind being blocked from transitioning to testing and the lack of clarity into that, Hartman was pulled in to try to help mediate the matter and get to the bottom of the situation with a lack of cooperation between the elogind and systemd maintainers for Debian as well as the release team. Elogind is used by some distributions as an implementation of systemd's logind, well, outside of systemd as a standalone daemon. Elogind is one of the pieces to the puzzle for trying to maintain a modern, systemd-free Linux distribution. Various issues were raised that are trying to be worked through albeit many Debian developers face time limitations and other factors like emotional exhaustion. Hartman noted in his August notes, "I think we may be approaching a point where we need to poll the project -- to have a GR and ask ourselves how committed we are to the different parts of this init diversity discussion. Reaffirming our support for sysvinit and elogind would be one of the options in any such GR. If that option passed, we'd expect all the maintainers involved to work together or to appoint and empower people who could work on this issue. It would be fine for maintainers not to be involved so long as they did not block progress. And of course we would hold the discussions to the highest standards of respect."' -- source: https://linux.slashdot.org/story/19/09/21/042213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Phrase Of The Week: “Tab Bankruptcy”
by Lawrence D'Oliveiro 22 Sep '19

22 Sep '19

What happens when you accumulate a growing bunch of open pages in your browser, meaning to look at them in the next few days, but never get around to it? Until you have so many tabs open, you realize you will never have time to check them out, so you abandon them all and start again? That’s called “declaring tab bankruptcy”. And here <https://github.com/jsvine/tab-bankrupter> is a Chrome extension that lets you do that, while preserving pinned tabs, but saves a record of all the tabs you’ve abandoned. So, you know, you can change your mind and come back to them later ... Then you’ll probably want another extension to let you declare saved-bankruptcy bankruptcy, where you wipe all your bankruptcy saves and start again ...

1 0

A Novel Use For GitHub
by Lawrence D'Oliveiro 22 Sep '19

22 Sep '19

Came across this GitHub repo <https://github.com/tewhalen/bmw_e30>, which doesn’t actually contain any code. Instead, the owner is using the issues feature to keep track of servicing items for his car. Why do it on a public server? Well, the guy is a BMW owner ...

1 0

At The Open-Core Summit
by Lawrence D'Oliveiro 20 Sep '19

20 Sep '19

A bunch of companies <https://www.theregister.co.uk/2019/09/20/open_source_companies_cloud/> have met to share a common annoyance: that big corporations like Amazon, Google and Microsoft are able to profit from their open-source software without giving anything back. I’m not sure what you can do about it, though. Attempts to impose more restrictive conditions on licences seem to have backfired. The AGPL seems to have been the only one of these efforts to have any legs, and I’m doubtful it has really achieved much.

1 0

German Interior Ministry Wants To Ensure “Digital Sovereignty”
by Lawrence D'Oliveiro 20 Sep '19

20 Sep '19

Germany wants to avoid having too much reliance on specific software/service vendors, like Microsoft and cloud suppliers <https://www.theregister.co.uk/2019/09/19/german_government_report_digital_s…>. How to deal with this? Answers suggested were * Negotiate new contracts with those same suppliers that get rid of the objectionable things, like telemetry * Diversify: stick with proprietary software, just get it from more suppliers * Use Open Source. Real-world results seem mixed? (Munich was cited as a “failure”). Also, Open Source software can end up acquired by proprietary vendors anyway. But then again, why should such acquisitions be such a big deal? Have they not heard of “forks”? Word I learned today: “Schmerzpunkt”.

1 0

How the Internet Archive is Waging War on Misinformation
by Peter Reutemann 19 Sep '19

19 Sep '19

'San Francisco-based non-profit is archiving billions of web pages in a bid to preserve web history. From a report: Since the 2016 US election, as fears about the power of fake news have intensified, the archive has stepped up its efforts to combat misinformation. At a time when false and ultra-partisan content is rapidly created and spread, and social media pages are constantly updated, the importance of having an unalterable record of who said what, when has been magnified. "We're trying to put in a layer of accountability," said founder Brewster Kahle. Mr Kahle founded the archive, which now employs more than 100 staff and costs $18m a year to run, because he feared that what was appearing on the internet was not being saved and catalogued in the same way as newspapers and books. The organisation is funded through donations, grants and the fees it charges third parties that request specific digitisation services. So far, the archive has catalogued 330bn web pages, 20m books and texts, 8.5m audio and video recordings, 3m images and 200,000 software programs. The most popular, public websites are prioritised, as are those that are commonly linked to. Some information is free to access, some is loaned out (if copyright laws apply) and some is only available to researchers. Curled up in a chair in his office after lunch, Mr Kahle lamented the combined impact of misinformation and how difficult it can be for ordinary people to access reliable sources of facts. "We're bringing up a generation that turns to their screens, without a library of information accessible via screens," said Mr Kahle. Some have taken advantage of this "new information system", he argued -- and the result is "Trump and Brexit." Having a free online library is crucial, said Mr Kahle, since "[the public is] just learning from whateverâ...âis easily available."' -- source: https://tech.slashdot.org/story/19/09/19/1858249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Protocol found in webcams and DVRs is fueling a new round of big DDoSes
by Peter Reutemann 19 Sep '19

19 Sep '19

'Hackers have found a new way to amplify the crippling effects of denial-of-service techniques by abusing an improperly implemented tool found in almost 1 million network-connected cameras, DVRs, and other Internet-of-things devices. The technique abuses WS-Discovery, a protocol that a wide array of network devices use to automatically connect to one another. Often abbreviated as WSD, the protocol lets devices send user datagram protocol packets that describe the device capabilities and requirements over port 3702. Devices that receive the probes can respond with replies that can be tens to hundreds of times bigger. WSD has shipped with Windows since Vista and is one of the ways the operating system automatically finds network-based printers.' -- source: https://arstechnica.com/information-technology/2019/09/in-the-wild-ddoses-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Adobe Raking It In
by Lawrence D'Oliveiro 18 Sep '19

18 Sep '19

That rentware business model continues to pay off very handsomely <https://www.theregister.co.uk/2019/09/18/adobe_results/>. Users may grumble, but as long as they don’t actually do anything about it, why should Adobe worry?

1 0

OBS Studio
by Peter Reutemann 18 Sep '19

18 Sep '19

Came across the OBS Studio project last night by accident (never heard of it before!): "Free and open source software for video recording and live streaming. Download and start streaming quickly and easily on Windows, Mac or Linux. High performance real time video/audio capturing and mixing. Create scenes made up of multiple sources including window captures, images, text, browser windows, webcams, capture cards and more. Set up an unlimited number of scenes you can switch between seamlessly via custom transitions. Intuitive audio mixer with per-source filters such as noise gate, noise suppression, and gain. Take full control with VST plugin support." -- source: https://obsproject.com/ I'll give it a go for my next video recording project. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MITRE’s Latest Common Weakness Enumeration List
by Lawrence D'Oliveiro 18 Sep '19

18 Sep '19

The CWE is not a list of security vulnerabilities as such, but of factors which commonly lead to security vulnerabilities <https://www.theregister.co.uk/2019/09/18/the_25_most_dangerous_software_wea…>. The methodology of the list has changed from the previous one (from back in 2011), so it’s hard to say that the changes are down to different (improved?) coding practices. Still, two thirds of the entries are the same in both lists.

1 0

Researchers Uncover 125 Vulnerabilities Across 13 Routers and NAS Devices
by Peter Reutemann 18 Sep '19

18 Sep '19

'Independent Security Evaluators (ISE) discovered a total of 125 different security vulnerabilities across 13 IoT devices, likely affecting millions of consumers. Help Net Security reports: In nearly all the devices (12 of the 13), ISE achieved its goal of obtaining remote root-level access. The table below shows the types of vulnerabilities that ISE identified in the targets. All 13 of the devices evaluated by ISE had at least one web application vulnerability such as cross-site scripting (XSS), operating system command injection (OS CMDi), or SQL injection (SQLi) that could be leveraged by an attacker to get remote access to the device's shell or gain access to the device's administrative panel. ISE obtained root shells on 12 of the devices, allowing complete control over the device. Six of them can be remotely exploited without authentication: the Asustor AS-602T, Buffalo TeraStation TS5600D1206, TerraMaster F2-420, Drobo 5N2, Netgear Nighthawk R9000, and TOTOLINK A3002RU. "We found that many of these issues were trivial to exploit and should have been discovered even in a rudimentary vulnerability assessment," says ISE founder Stephen Bono. "This indicates that these manufacturers likely undergo no such assessment whatsoever, that the bug bounty programs they employ are ineffective, that vulnerability disclosures sent to them are not addressed, or more likely, all of the above."' -- source: https://it.slashdot.org/story/19/09/17/2053202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HP Printers Try To Send Data Back To HP About Your Devices and What You Print
by Peter Reutemann 17 Sep '19

17 Sep '19

'Robert Heaton: Last week my in-laws politely but firmly asked me to set up their new HP printer. I protested that I'm completely clueless about that sort of thing, despite my tax-return-job-title of "software engineer." Still remonstrating, I was gently bundled into their study with an instruction pamphlet, a cup of tea, a promise to unlock the door once I'd printed everyone's passport forms, and a warning not to try the window because the roof tiles are very loose. At first the setup process was so simple that even a computer programmer could do it. But then, after I had finished removing pieces of cardboard and blue tape from the various drawers of the machine, I noticed that the final step required the downloading of an app of some sort onto a phone or computer. This set off my crapware detector. [...] It was a way to try and get people to sign up for expensive ink subscriptions and/or hand over their email addresses, plus something even more nefarious that we'll talk about shortly (there were also some instructions for how to download a printer driver tacked onto the end). This was a shame, but not unexpected. I'm sure that the HP ink department is saddled with aggressive sales quotas, and no doubt the only way to hit them is to ruthlessly exploit people who don't know that third-party cartridges are just as good as HP's and are much cheaper. Fortunately, the careful user can still emerge unscathed from this phase of the setup process by gingerly navigating the UI patterns that presumably do fool some people who aren't paying attention.' -- source: https://hardware.slashdot.org/story/19/09/17/1454203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Moving To a Faster 4-Week Release Cycle
by Peter Reutemann 17 Sep '19

17 Sep '19

'Mozilla announces in a blog post: We typically ship a major Firefox browser (Desktop and Android) release every 6 to 8 weeks. Building and releasing a browser is complicated and involves many players. To optimize the process, and make it more reliable for all users, over the years we've developed a phased release strategy that includes 'pre-release' channels: Firefox Nightly, Beta, and Developer Edition. With this approach, we can test and stabilize new features before delivering them to the majority of Firefox users via general release. And today we're excited to announce that we're moving to a four-week release cycle! We're adjusting our cadence to increase our agility, and bring you new features more quickly. In recent quarters, we've had many requests to take features to market sooner. Feature teams are increasingly working in sprints that align better with shorter release cycles. Considering these factors, it is time we changed our release cadence. Starting Q1 2020, we plan to ship a major Firefox release every 4 weeks. Firefox ESR release cadence (Extended Support Release for the enterprise) will remain the same. In the years to come, we anticipate a major ESR release every 12 months with 3 months support overlap between new ESR and end-of-life of previous ESR. The next two major ESR releases will be ~June 2020 and ~June 2021.' -- source: https://news.slashdot.org/story/19/09/17/1750247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Linux 31 Beta is Here
by Peter Reutemann 17 Sep '19

17 Sep '19

'Fedora 31 is due later this year, but first, there needs to be some beta testing. And so, today, Fedora 31 Beta is made available for download. Unfortunately, details surrounding version 31 are a bit sparse. With that said, one big change involves Fedora users with ARM 64-based single board computers, such as a Raspberry Pi. Those folks will get access to an additional desktop spin -- the lightweight Xfce. Workstation users will be treated to GNOME 3.34, but not the final version that was released recently. Don't worry -- when Fedora leaves beta status, and is officially released, you can be sure the stable GNOME 3.34 will be included. Remember, Fedora is one of the best ways to experience a vanilla GNOME desktop environment.' -- source: https://linux.slashdot.org/story/19/09/17/1836214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman’s Last Interview As FSF President
by Lawrence D'Oliveiro 17 Sep '19

17 Sep '19

Seems the great prophet has bumbled into matters where perhaps he should have kept his mouth shut, and is now stepping down from the FSF. But leaving that aside, this interview <https://www.theregister.co.uk/2019/09/17/richard_stallman_interview/> has the usual choice nuggets on subjects he does know something about: One thing that has changed is that nowadays, a non-free program is typically malware as well. That was not the case in 1983. In 1983, when a proprietary software product was discovered to be malware, it was scandalous. It was shocking. It made the news, sort of at least in the tech press, because this wasn't the usual case. It there was a certain level of scruples, even among proprietary software developers. But over the years, those scruples have evaporated, as companies raced each other to the bottom in terms of mistreating their own users. And now, almost any non free program you run is mistreating you somehow.

1 0

Password-exposing bug purged from LastPass extensions
by Peter Reutemann 16 Sep '19

16 Sep '19

'Developers of the LastPass password manager have patched a vulnerability that made it possible for websites to steal credentials for the last account the user logged into using the Chrome or Opera extension. The vulnerability was discovered late last month by Google Project Zero researcher Tavis Ormandy, who privately reported it to LastPass. In a write-up that became public on Sunday, Ormandy said the flaw stemmed from the way the extension generated popup windows. In certain situations, websites could produce a popup by creating an HTML iframe that linked to the Lastpass popupfilltab.html window rather than through the expected procedure of calling a function called do_popupregister(). In some cases, this unexpected method caused the popups to open with a password of the most recently visited site.' -- source: https://arstechnica.com/information-technology/2019/09/lastpass-fixes-bug-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Say hello to 802.11ax: Wi-Fi 6 device certification begins today
by Peter Reutemann 16 Sep '19

16 Sep '19

'Today, the Wi-Fi Alliance launched its Wi-Fi Certified 6 program, which means that the standard has been completely finalized, and device manufacturers and OEMs can begin the process of having the organization certify their products to carry the Wi-Fi 6 branding. If you need a bit of a catch-up, Wi-Fi 6—aka 802.11ax—is the next generation of Wi-Fi. 802.11ax will, at least in theory, allow many more nearby devices to use the same Wi-Fi channels and frequencies without causing as much congestion and lag as Wi-Fi 5 (better known as 802.11ac) and Wi-Fi 4 (802.11n) do. That's the good news. The bad news is that very few of these benefits can be seen just from buying a Wi-Fi 6 router—you need most, if not all, of the devices in range (both yours and, ideally, any neighbors') to also support Wi-Fi 6 before you see the improvements. 802.11ax also mandates support for the WPA3 encryption and authentication protocol. WPA3 provides considerably better security for your Wi-Fi network than WPA2 did, and due to its adoption of Simultaneous Authentication of Equals (SAE), it will hopefully prove more robust toward future attacks as well.' -- source: https://arstechnica.com/gadgets/2019/09/say-hello-to-802-11ax-wi-fi-6-devic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0