- wlug - list.wlug.org.nz

WAV Audio Files Are Now Being Used To Hide Malicious Code
by Peter Reutemann 21 Oct '19

21 Oct '19

'Two reports published in the last few months show that malware operators are experimenting with using WAV audio files to hide malicious code. The first of these new malware campaigns abusing WAV files was reported back in June by Symantec security researchers who said they spotted a Russian cyber-espionage group known as Waterbug (or Turla) using WAV files to hide and transfer malicious code from their server to already-infected victims. The second malware campaign was spotted this month by BlackBerry Cylance. In a report published today and shared with ZDNet last week, Cylance said it saw something similar to what Symantec saw a few months before. But while the Symantec report described a nation-state cyber-espionage operation, Cylance said they saw the WAV steganography technique being abused in a run-of-the-mill crypto-mining malware operation.' -- source: https://it.slashdot.org/story/19/10/20/200249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Respecting Smart Home System Can Work Offline and Sends Fake Data
by Peter Reutemann 21 Oct '19

21 Oct '19

'A publicly-funded group of designers, artists and privacy experts from Amsterdam have designed a smart home system prototype to "prove it's technically possible to build a privacy respecting smart home while maintaining convenience." Its controller uses an Arduino Nano to disconnect the system from the internet during times when it's not in use. They're building everything on Mozilla's open smart home gateway software. The system's microphone is a separate USB device that can be easily unplugged. For extra security, the devices don't even use wifi to communicate. "The Candle devices offer the advantages of a smart home system -- such as voice control, handy automations and useful insights -- without the downsides of sending your data to the cloud and feeling watched in your own home," explains their blurb for Dutch Design Week, where they're launching their prototypes of trust-worthy smart locks, thermostats, and other Internet of Things devices: Most smart devices promises us an easier life, but they increasingly disappoint; they eavesdrop, share our data with countless third parties, and offer attractive targets to hackers. Candle is different. Your data never leaves your home, all devices work fine without an internet connection, and everything is open source and transparent. One of the group's members is long-time Slashdot reader mrwireless, who shares an interesting observation: Smart homes track everything that happens inside them. For developing teenagers, this makes it more difficult to sneak in a date or break the rules in other subtle ways, which is a normal, healthy part of growing up. Candle is a prototype smart home that tries to mitigate these issue. It has given its sensors the ability to generate fake data for a while. In the future, children could get a monthly fake data allowance. Some of the devices have "skirts", simple fabric covers that can be draped over the devices to hide their screen. If you own a dust sensor, this can be useful if your mother in law comes over and you haven't vacuumed in a while.' -- source: https://yro.slashdot.org/story/19/10/20/216238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unpatched Linux bug may open devices to serious attacks over Wi-Fi
by Peter Reutemann 18 Oct '19

18 Oct '19

'A potentially serious vulnerability in Linux may make it possible for nearby devices to use Wi-Fi signals to crash or fully compromise vulnerable machines, a security researcher said. The flaw is located in the RTLWIFI driver, which is used to support Realtek Wi-Fi chips in Linux devices. The vulnerability triggers a buffer overflow in the Linux kernel when a machine with a Realtek Wi-Fi chip is within radio range of a malicious device. At a minimum, exploits would cause an operating-system crash and could possibly allow a hacker to gain complete control of the computer. The flaw dates back to version 3.10.1 of the Linux kernel released in 2013. "The bug is serious," Nico Waisman, who is a principal security engineer at Github, told Ars. "It's a vulnerability that triggers an overflow remotely through Wi-Fi on the Linux kernel, as long as you're using the Realtek (RTLWIFI) driver." The vulnerability is tracked as CVE-2019-17666. Linux developers proposed a fix on Wednesday that will likely be incorporated into the OS kernel in the coming days or weeks. Only after that will the fix make its way into various Linux distributions.' -- source: https://arstechnica.com/information-technology/2019/10/unpatched-linux-flaw… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM+Red Hat: A Successful Acquisition For A Change?
by Lawrence D'Oliveiro 18 Oct '19

18 Oct '19

IBM reports <https://www.theregister.co.uk/2019/10/17/ibm_q3_2019_financials/> that its Red Hat division has been doing quite nicely since it was acquired. This is in contrast to the rest of the company, which seems to be continuing its long, slow downward slide. I have seen mention elsewhere of economic studies that show that, on average, corporate mergers and acquisitions tend to destroy value rather than create it (e.g. the all-too-common scenario of “big company buys small company and then drives away its customers and shuts it down”). The realization of actual “synergies” seems to be the exception rather than the rule. Maybe IBM will continue jettisoning its other parts, and end up being just Red Hat in all but name...

1 0

Bug In Python Script May Have Affected Hundreds Of Studies
by Lawrence D'Oliveiro 18 Oct '19

18 Oct '19

A set of Python scripts popularly used to analyze chemistry data has had a long-standing bug in that it had assumptions about the order in which filenames in a directory would be returned <https://arstechnica.com/information-technology/2019/10/chemists-discover-cr…>. The code worked correctly on Windows and an older version of macOS, but discrepancies crept in on Linux and on newer macOS. The fix was to sort the returned names into a consistent order before processing. I just note this Twitter comment from one of the original authors: When I wrote the scripts 6 years ago, the OS was able to handle the sorting. That would never have been true on Linux. There have never been any guarantees about ordering of directory entries on POSIX-compliant systems. Note the docs <https://docs.python.org/3/library/glob.html#glob.glob> clearly say: Whether or not the results are sorted depends on the file system. One of the researchers who found (and fixed) the bug says ... he hopes the paper will get scientists to pay more attention to the computational side of experiments in the future.

2 7

Germany's Cybersecurity Agency Recommends Firefox As Most Secure Browser
by Peter Reutemann 18 Oct '19

18 Oct '19

'Firefox is the only browser that received top marks in a recent audit carried out by Germany's cyber-security agency -- the German Federal Office for Information Security (or the Bundesamt fur Sicherheit in der Informationstechnik -- BSI). The BSI tested Mozilla Firefox 68 (ESR), Google Chrome 76, Microsoft Internet Explorer 11, and Microsoft Edge 44. The tests did not include other browsers like Safari, Brave, Opera, or Vivaldi. The audit was carried out using rules detailed in a guideline for "modern secure browsers" that the BSI published last month, in September 2019. The BSI normally uses this guide to advise government agencies and companies from the private sector on what browsers are safe to use. The article includes a list of all the minimum requirements required for the BSI to consider a browser "secure." It also lists the areas where the other browsers failed, such as: Lack of support for a master password mechanism (Chrome, IE, Edge); No built-in update mechanism (IE), and No option to block telemetry collection (Chrome, IE, Edge)' -- source: https://news.slashdot.org/story/19/10/17/2136219 Cheers, Pete -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hard drives not mounting
by Ian Young 17 Oct '19

17 Oct '19

Hi John (et al) I am going to assume these are drives formatted NTFS. Of late I have encountered drives from Windows machines which Linux won't mount, I think ntfs-3g is a bit finicky about this in recent versions. Get in touch with me directly if you wish, I have a gadget which will connect drives via USB to avoid having to put them into a machine. Some distributions may be able to see the drives even if Mint doesn't wish to, we could try various versions.

1 0

Google Ejects Open-Source WireGuard From Play Store Over Donation Links
by Peter Reutemann 17 Oct '19

17 Oct '19

'Google appears to be removing apps that have donation links, including open-source apps where donations are one of the main sources of revenue. WireGuard, a free and open-source VPN, has been reportedly dropped over this according to WireGuard lead developer Jason Donenfeld. Phoronix reports: After waiting days for Google to review the latest version of their secure VPN tunnel application, it was approved and then removed and delisted -- including older versions of WireGuard. The reversal comes on the basis of violating their "payments policy." The only bit of possible "payments" within the WireGuard app is a donation link within the program taking the user to the WireGuard website should anyone want to donate to support this promising open-source secure networking tech. An appeal to the situation was also rejected by Google, Donenfeld has confirmed this morning on their mailing list. In trying to make it back into Android's Play Store, Jason has dropped the donation link from the Android app version while it's still awaiting review from Google. ' -- source: https://news.slashdot.org/story/19/10/16/2215248 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting NEXT Monday
by Peter Reutemann 17 Oct '19

17 Oct '19

Hi everyone Due to Labor Day falling on our usual meeting slot and the university no longer opening up rooms on public holidays, this month's meeting takes place a week earlier, ie next Monday! "Creating a low power consumption Print Server using a Raspberry Pi. Peter Reutemann will present/demo the material prepared by Ian Stewart as he cannot attend the meeting unfortunately." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884319/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Calibre Replacement Considerations
by Lawrence D'Oliveiro 17 Oct '19

17 Oct '19

This blog post <https://anarc.at/software/desktop/calibre/> popped up in my screensaver display a few minutes ago, and was interesting enough for me to find the original. Calibre is the well-known software package for viewing and managing ebooks and converting between formats. As the blog writer says: It's used by Linux geeks as well as Windows power-users and vastly surpasses any native app shipped by ebook manufacturers. I know almost exactly zero people that have an ebook reader that do *not* use Calibre. However, there seem to be quite a few problems with it, not the least of which is that the principal developer seems to have trouble appreciating security vulnerabilities. Another issue is that it is written in Python 2 (though an in-progress port to Python 3 seems to be mostly “going well”). At one point the developer claimed that wasn’t a big deal, as he could continue to maintain Python 2 himself after it became obsolete upstream, but he seems to have backtracked from that position. One pressing problem is that newer versions of Calibre depend on Python 2 libraries that are no longer available in Debian (and therefore would also disappear from all the usual Debian derivatives, like Ubuntu and Linux Mint). However, the list of useful functions that Calibre performs is remarkably long, so finding substitutes for them all is going to be rather daunting.

2 1

In 2019, multiple open source companies changed course—is it the right move?
by Peter Reutemann 17 Oct '19

17 Oct '19

'Free and open source software enables the world as we know it in 2019. From Web servers to kiosks to the big data algorithms mining your Facebook feed, nearly every computer system you interact with runs, at least in part, on free software. And in the larger tech industry, free software has given rise to a galaxy of startups and enabled the largest software acquisition in the history of the world. Free software is a gift, a gift that made the world as we know it possible. And from the start, it seemed like an astounding gift to give. So astounding in fact that it initially made businesses unaccustomed to this kind of generosity uncomfortable. These companies weren't unwilling to use free software, it was simply too radical and by extension too political. It had to be renamed: "open source." Once that happened, open source software took over the world. Recently, though, there's been a disturbance in the open source force. Within the last year, companies like Redis Labs, MongoDB, and Confluent all changed their software licenses, moving away from open source licenses to more restrictive terms that limit what can be done with the software, making it no longer open source software. The problem, argue Redis Labs, MongoDB and others, is a more modern tech trend: hosted software services. Also known as, "the cloud." Also known as Amazon AWS. Amazon, for its part, came out swinging, releasing its own version of the code behind Elastic Search this spring in response to licensing changes at Elastic (the company behind Elastic Search). And besides a new trademark dispute over Amazon's naming convention, Elastic has a very different response from that of MongoDB and Redis—it hasn't said a word in protest.' -- source: https://arstechnica.com/information-technology/2019/10/is-the-software-worl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hard drives
by john 17 Oct '19

17 Oct '19

I sent this yesterday with four screenshots not aware that I may incur the wrath of the moderator. Here is a copy of the e-mail minus the pretty pictures. My neighbor just gave me a couple of failed Sea-gate hard drives to test I put them (one at a time) into my Linux mint machine. They showed up in my computer but would not mount.(see attachments) I ran the "Disks" utility which reported exactly the same problem (one incident of over temperature) for both disks However it stated that the disks were OK. One disk has 500GB of movies and TV series The other 375GB Operas and areas. The disks were used by a Mother and Son on two laptops and were cross pollinated between the two. I doubt that forcing a mount would reap a reward in this case. If any one can help with this it would be neat. Cheers John..

2 1

Interview With Fedora Project Leader Matthew Miller On 15 Years of Fedora
by Peter Reutemann 17 Oct '19

17 Oct '19

'Fedora -- as a Linux distribution -- will celebrate the 15th anniversary of its first release in November, though its technical lineage is much older, as Fedora Core 1 was created following the discontinuation of Red Hat Linux 9 in favor of Red Hat Enterprise Linux (RHEL). Five years after the start of Fedora.next, the distribution is on the right track -- stability has improved, and work on minimizing hard dependencies in packages and containers, including more audio/video codecs by default, flicker-free boot, and lowering power consumption for notebooks, among other changes, have greatly improved the Fedora experience, while improvements in upstream projects such as GNOME and KDE have likewise improved the desktop experience. In a wide-ranging interview with TechRepublic, Fedora project leader Matthew Miller discussed lessons learned from the past, popular adoption and competing standards for software containers, potential changes coming to Fedora, as well as hot-button topics, including systemd.' -- source: https://linux.slashdot.org/story/19/10/16/1712207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meetup.com: members will pay soon
by Peter Reutemann 16 Oct '19

16 Oct '19

Hi everyone Came across this news item from meetup.com: https://www.meetup.com/lp/paymentchanges Members will soon get charged USD 2 per month for using meetup.com. So far, it was only the organizers that had to cough up money. The idea is to lower costs for organizers and ensure that people RSVPing actually show up. I'll put this as topic for the upcoming AGM. In the meantime, we should start looking for alternatives. E.g.: https://alternativeto.net/software/meetup/ Personally, I like GetTogether (https://gettogether.community/) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

UK’s AMD-CPU-Based Archer2 Supercomputer At Edinburgh Uni
by Lawrence D'Oliveiro 15 Oct '19

15 Oct '19

What’s notable about this super <https://www.theregister.co.uk/2019/10/15/uk_archer2_supercomputer/> is that it uses AMD CPUs instead of Intel, and it is (mostly) CPU-only, with a small number of GPUs available on the side.

1 0

Google's Auto-Delete Tools Are Practically Worthless For Privacy
by Peter Reutemann 15 Oct '19

15 Oct '19

'By default, Google collects a vast amount of data on users' behavior, including a lifelong record of web searches, locations, and YouTube views. But amid a privacy backlash and ongoing regulatory threats, the company has started to hype its recently released privacy tools, like the ability to automatically delete some of the data it collects about you -- data that helps power its $116 billion ad business. [...] In reality, these auto-delete tools accomplish little for users, even as they generate positive PR for Google. Experts say that by the time three months rolls around, Google has already extracted nearly all the potential value from users' data, and from an advertising standpoint, data becomes practically worthless when it's more than a few months old. "Anything up to one month is extremely valuable," says David Dweck, the head of paid search at digital ad firm WPromote. "Anything beyond one month, we probably weren't going to target you anyway." Dweck says that in the digital ad industry, recent activity is essential. If you start searching on Google for real estate or looking up housing values, for instance, Google might lump you into a "prospective home buyers" category for advertisers. That information becomes instantly valuable to realtors, appraisers, and lenders for ad targeting, and it could remain valuable for a while as other companies, such as painters or appliance brands, try to follow up on your home buying. Still, it's unusual for advertisers to target users based on their activity from months earlier, Dweck says.' -- source: https://yro.slashdot.org/story/19/10/15/1933230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw In Sudo Enables Non-Privileged Users To Run Commands As Root
by Peter Reutemann 15 Oct '19

15 Oct '19

'A vulnerability has been discovered in Sudo -- one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system. The vulnerability in question is a sudo security policy bypass issue that could allow a malicious user or a program to execute arbitrary commands as root on a targeted Linux system even when the "sudoers configuration" explicitly disallows the root access. Sudo, stands for "superuser do," is a system command that allows a user to run applications or commands with the privileges of a different user without switching environments -- most often, for running commands as the root user. The vulnerability, tracked as CVE-2019-14287 and discovered by Joe Vennix of Apple Information Security, is more concerning because the sudo utility has been designed to let users use their own login password to execute commands as a different user without requiring their password. What's more interesting is that this flaw can be exploited by an attacker to run commands as root just by specifying the user ID "-1" or "4294967295." That's because the function which converts user id into its username incorrectly treats -1, or its unsigned equivalent 4294967295, as 0, which is always the user ID of root user. The vulnerability affects all Sudo versions prior to the latest released version 1.8.28, which has been released today.' -- source: https://linux.slashdot.org/story/19/10/14/2231235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple's Safari Browser Is Sending Some Users' IP Addresses To China's Tencent
by Peter Reutemann 14 Oct '19

14 Oct '19

'"Apple, which often positions itself as a champion of privacy and human rights, is sending some IP addresses from users of its Safari browser on iOS to Chinese conglomerate Tencent -- a company with close ties to the Chinese Communist Party," reports the Reclaim the Net blog: Apple admits that it sends some user IP addresses to Tencent in the "About Safari & Privacy" section of its Safari settings.... The "Fraudulent Website Warning" setting is toggled on by default which means that unless iPhone or iPad users dive two levels deep into their settings and toggle it off, their IP addresses may be logged by Tencent or Google when they use the Safari browser. However, doing this makes browsing sessions less secure and leaves users vulnerable to accessing fraudulent websites... Even if people install a third-party browser on their iOS device, viewing web pages inside apps still opens them in an integrated form of Safari called Safari View Controller instead of the third-party browser. Tapping links inside apps also opens them in Safari rather than a third-party browser. These behaviors that force people back into Safari make it difficult for people to avoid the Safari browser completely when using an iPhone or iPad. Engadget adds that it's "not clear" whether or not Tencent is actually collecting IP addresses from users outside of China. ("You'll see mention of the collection in the U.S. disclaimer, but that doesn't mean it's scooping up info from American web surfers.") But Reclaim the Net points out that the possibility is troubling, in part because Safari is the #1 most popular mobile internet browser in America, with a market share of over 50%.' -- source: https://apple.slashdot.org/story/19/10/14/033225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next month
by Peter Reutemann 14 Oct '19

14 Oct '19

Hi everyone We have our AGM coming up next month, November 25th: Agenda (preliminary) • President's Report • Treasurer's Report • Election of 2020 Committee • General business • Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bell Labs Plans Big 50th Anniversary Event For Unix
by Peter Reutemann 14 Oct '19

14 Oct '19

'Photographer Peter Adams launched a "Faces of Open Source" portrait project in 2014. This week he posted a special announcement on the web site of Bell Labs: Later this month, Bell Labs will celebrate the 50th anniversary of Unix with a special two day "Unix 50" event at their historic Murray Hill headquarters. This event should be one for the history books with many notable Unix and computer pioneers in attendance...! As I was making those photographs (which will be on display at the event), I gained much insight into Bell Labs and the development of Unix. However, it was some of the more personal stories and anecdotes that brought Bell Labs to life and gave me a feel for the people behind the code. One such time was when Ken Thompson (who is an accomplished pilot) told me how he traveled to Russia after the fall of the Soviet Union in order to fly in a MiG-29 fighter jet... Brian Kernighan told me about how a certain portrait of Peter Weinberger found its way into some very interesting places. These included the concrete foundation of a building on Bell Labs campus, the cover images printed onto Unix CD-ROMs, and most notably, painted on the top of a nearby water tower. Which brings us to another important piece of Unix mythology that I learned about: the fictitious Bell Labs employee G.R. Emlin (a.k.a. "the gremlin").... A lot of this folklore (including the gremlin) is going to be on display at the Unix 50 event. The archivists at Bell Labs have outdone themselves by pulling together a massive collection of artifacts taken from the labs where Unix was developed for over 30 years. I was able to photograph a few of these artifacts last year, but so much more will be exhibited at this event -- including several items from the personal archives of some attendees. As if that wasn't enough, the event will also showcase a number of vintage computers and a look into Bell Labs future with a tour of their Future X Labs. The article includes some more quick stories about the Unix pioneers at Bell Labs (including "the gremlin") and argues that "the decision to freely distribute Unix's source code (to anyone who asked for it) inadvertently set the stage for the free and open source software movements that dominate the technology industry today... "In hindsight, maybe 1969 should be called the 'summer of code.'"' -- source: https://tech.slashdot.org/story/19/10/12/1625237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Planting tiny spy chips in hardware can cost as little as $200
by Peter Reutemann 14 Oct '19

14 Oct '19

'More than a year has passed since Bloomberg Businessweek grabbed the lapels of the cybersecurity world with a bombshell claim: that Supermicro motherboards in servers used by major tech firms, including Apple and Amazon, had been stealthily implanted with a chip the size of a rice grain that allowed Chinese hackers to spy deep into those networks. Apple, Amazon, and Supermicro all vehemently denied the report. The National Security Agency dismissed it as a false alarm. The Defcon hacker conference awarded it two Pwnie Awards, for "most overhyped bug" and "most epic fail." And no follow-up reporting has yet affirmed its central premise. But even as the facts of that story remain unconfirmed, the security community has warned that the possibility of the supply chain attacks it describes is all too real. The NSA, after all, has been doing something like it for years, according to the leaks of whistle-blower Edward Snowden. Now researchers have gone further, showing just how easily and cheaply a tiny, tough-to-detect spy chip could be planted in a company's hardware supply chain. And one of them has demonstrated that it doesn't even require a state-sponsored spy agency to pull it off—just a motivated hardware hacker with the right access and as little as $200 worth of equipment.' -- source: https://arstechnica.com/information-technology/2019/10/planting-tiny-spy-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast
by Peter Reutemann 11 Oct '19

11 Oct '19

Apologies for cross-posting. Cheers, Peter -------- Original Message -------- From: Simon Lyall <simon(a)darkmere.gen.nz> Sent: October 11, 2019 9:50:45 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Subject: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast The Sysadmin Miniconf is being held on The Gold Coast in January. We are looking for talks about all aspects of System Administration and Operations. Sysadmin Miniconf Call for Presentations https://sysadmin.miniconf.org/cfp20.html The Sysadmin Miniconf is part of Linux.conf.au, a 5-day technical conference being held in The Gold Coast in January 2020. There are 12 Single-day Miniconfs on specific topics such as Kubernetes, Documentation, Kernel and Security being held as part of the conference. The Miniconfs are currently looking for talk proposals https://linux.conf.au/programme/miniconfs/ Tickets for Linux.conf.au are now available: https://linux.conf.au/ Please forward to your colleagues, peers, or others you think may be interested -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Will Begin Shipping 2 Linux Laptops With Coreboot-Based Open Source Firmware
by Peter Reutemann 10 Oct '19

10 Oct '19

'System76, the Denver-based Linux PC manufacturer and developer of Pop OS, has some stellar news for those who prefer their laptops a little more open. Later this month the company will begin shipping two of their laptop models with its Coreboot-powered open source firmware. >From a report: Beginning today, System76 will start taking pre-orders for both the Galago Pro and Darter Pro laptops. The systems will ship out later in October, and include the company's Coreboot-based open source firmware which was previously teased at the 2019 Open Source Firmware Conference. (Coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.) What's so great about ripping out the proprietary firmware included in machines like this and replacing it with an open alternative? To begin with, it's leaner. System76 claims that users can boot from power off to the desktop 29% faster with its Coreboot-based firmware. [...] Both of these laptops can be kitted out with 10th-Generation Intel CPUs (specifically the i5-10210U and the i7-10510U), and both have glare-resistant matte 1080p IPS displays. Beginning at $949, the Galago Pro features an all-aluminum chassis, a wealth of connectivity options including HDMI, DisplayPort to USB-C and Thunderbolt, and can be configured with up to 32GB of RAM and up to 6TB of storage space. The Darter Pro, meanwhile, can be built out with 32GB of RAM and up to 2TB of storage, and features up to 10 hours of battery life.' -- source: https://hardware.slashdot.org/story/19/10/10/1847228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Forum cracks the vintage passwords of Ken Thompson and other Unix pioneers
by Peter Reutemann 10 Oct '19

10 Oct '19

'As one of the original versions of Unix, BSD is an ancient operating system. So it shouldn’t come as a surprise that it used what are, by today’s standards, strange, even ridiculous security. For one, the hashing function protecting passwords, though state of the art 40 years ago, is now trivial to crack. Stranger still, the password hashes of some BSD creators were included in publicly available source code. And then, there are the passwords people chose. Last week, technologist Leah Neukirchen reported finding a source tree for BSD version 3, circa 1980, and successfully cracking passwords of many of computing’s early pioneers. In most of the cases the success was the result of the users choosing easy-to-guess passwords. BSD co-inventor Dennis Ritchie, for instance, used “dmac” (his middle name was MacAlistair); Stephen R. Bourne, creator of the Bourne shell command line interpreter, chose “bourne”; Eric Schmidt, an early developer of Unix software and now the executive chairman of Google parent company Alphabet, relied on “wendy!!!” (the name of his wife); and Stuart Feldman, author of Unix automation tool make and the first Fortran compiler, used “axolotl” (the name of a Mexican salamander). Weakest of all was the password for Unix contributor Brian W. Kernighan: “/.,/.,”—representing a three-character string repeated twice using adjacent keys on a QWERTY keyboard. (None of the passwords included the quotation marks.) But there were at least five plaintext passwords that remained out of reach. They included those belonging to Turkish computer scientist Özalp Babaoğlu, Unix software developer Howard Katseff, and crucial Unix contributors Tom London and Bob Fabry. But the uncracked hash that seemed to occupy Neukirchen the longest was the password used by Ken Thompson, another Unix co-inventor. “I never managed to crack ken's password with the hash ZghOT0eRm4U9s, and I think I enumerated the whole 8 letter lowercase + special symbols key space,” Neukirchen reported in the above-linked thread, posted to the Unix Heritage Society mailing list. “Any help is welcome.' -- source: https://arstechnica.com/information-technology/2019/10/forum-cracks-the-vin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A detailed look at Ubuntu’s new experimental ZFS installer
by Peter Reutemann 10 Oct '19

10 Oct '19

'Yesterday brought exciting news on the ZFS and Ubuntu fronts—experimental ZFS root support in the installer for Ubuntu's upcoming interim release, Eoan Ermine. The feature appeared in the 2019-10-09 daily build of Eoan—it's not in the regular beta release and, in fact, wasn't even in the "current daily" when we first went to download it. It's that new! (Readers wanting to play with the new functionality can find it in today's daily build, available here.)' -- source: https://arstechnica.com/information-technology/2019/10/a-detailed-look-at-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Schneier Slams Australia's Encryption Laws and CyberCon Speaker Bans
by Peter Reutemann 09 Oct '19

09 Oct '19

'Governments breaking encryption is bad, and "will get worse once breaking encryption means people can die," says one of the world's leading security experts. From a report: "Australia has some pretty draconian laws about forcing tech companies to break security," says cryptographer and computer security professional Bruce Schneier. He's referring to the controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, which came into force in December. "I actually don't like that, because stuff that you do flows downhill to the US. So stop doing that," he told the Australian Cybersecurity Conference, or CyberCon, in Melbourne on Wednesday. Schneier's argument against breaking encrypted communications is simple. "You have to make a choice. Either everyone gets to spy, or no one gets to spy. You can't have 'We get to spy, you don't.' That's not the way the tech works," he said. "As this tech becomes more critical to life, we simply have to believe, accept, that securing it is more important than leaving it insecure so you can eavesdrop on the bad guys."' -- source: https://it.slashdot.org/story/19/10/09/1855255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tor Project Removes 13.5% of Current Servers For Running EOL Versions
by Peter Reutemann 09 Oct '19

09 Oct '19

'The Tor Project has removed from its network this week more than 800 servers that were running outdated and end-of-life (EOL) versions of the Tor software. The removed servers represent roughly 13.5% of the 6,000+ servers that currently comprise the Tor network and help anonymize traffic for users across the world. Roughly 750 of the removed servers represent Tor middle relays, and 62 are exit relays -- where users exit the Tor network onto the world wide web after having their true location hidden through the Tor network. The organization said it plans to release a Tor software update in November that will natively reject connections with EOL Tor server versions by default, without any intervention from the Tor Project staff. "Until then, we will reject around 800 obsolete relays using their fingerprints," the Tor Project said in a statement this week.' -- source: https://tech.slashdot.org/story/19/10/09/1853238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Remote Code Execution Flaw Fixed In Popular Terminal App For MacOS
by Peter Reutemann 09 Oct '19

09 Oct '19

'iTerm2 users: It's time to upgrade. A security audit sponsored by the Mozilla Open Source Support Program uncovered a critical remote code execution (RCE) vulnerability in the popular open-source terminal app for macOS. ITerm2 is an open-source alternative to the built-in macOS Terminal app, which allows users to interact with the command-line shell. Terminal apps are commonly used by system administrators, developers and IT staff in general, including security teams, for a variety of tasks and day-to-day operations. The iTerm2 app is a popular choice on macOS because it has features and allows customizations that the built-in Terminal doesn't, which is why the Mozilla Open Source Support Program (MOSS) decided to sponsor a code audit for it. The MOSS was created in the wake of the critical and wide-impact Heartbleed vulnerability in OpenSSL with the goal of sponsoring security audits for widely used open-source technologies. The flaw, which is now tracked as CVE-2019-9535, has existed in iTerm2 for the past seven years and is located in the tmux integration. Tmux is a terminal multiplexer that allows running multiple sessions in the same terminal window by splitting the terminal screen. The flaw was fixed in iTerm2 version 3.3.6, which was released today.' -- source: https://apple.slashdot.org/story/19/10/09/2048214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Essential Reveals Project Gem Smartphone With Very Long, Unusual Design
by Peter Reutemann 09 Oct '19

09 Oct '19

'Andy Rubin, the controversial mobile industry executive who co-founded Android, left Google amid allegations of sexual misconduct while retaining a huge severance package, and went on to create the Essential Phone, has tweeted photos teasing an upcoming device with an elongated design and very tall UI composed of card-like apps. The Verge reports: It look extremely small in his hands, too. The device has a large button and volume rocker on the right edge and a fingerprint divot around back, below what appears to be a single main camera. And as you can see, these devices have some decidedly flashy finishes that change color when you view them at different angles -- a sea green that shifts to yellow and blue, for example. An Essential spokesperson confirmed to the The Verge that this is the company's new phone, adding: "We've been working on a new device that's now in early testing with our team outside the lab. We look forward to sharing more in the near future." A couple hours later, Essential tweeted some slightly more official images of the new phone, which it's calling Project Gem. XDA-Developers also spotted some leaked code that mentions the divot on the rear of the device may activate its voice assistant when you tap your finger to it. They also suggest it runs Android and packs a Qualcomm Snapdragon 730 processor. ' -- source: https://mobile.slashdot.org/story/19/10/09/0519214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Kills Kaby Lake G, Vows To Offer Drivers For Five Years
by Peter Reutemann 09 Oct '19

09 Oct '19

'When Kaby Lake G debuted at CES 2018, it made a big bang. No one expected sworn rivals Intel and AMD to collaborate on a CPU package, marrying a 7th-gen Kaby Lake CPU with a unique AMD Radeon RX Vega GPU. But what began with a bang ended Monday with an unceremonious memo. >From a report: The Product Change Notification published by Intel on Monday confirmed that pretty much every single Kaby Lake G, including the Core i7-8706G, the Core i7-8705G, and the Core i5-8305G, would be discontinued. Last call for orders will be on January 17, 2020, and the final shipments are scheduled for July 31, 2020. While the end of life of a processor isn't typically a big deal to consumers who own them, one sticking point could have been driver support. Specifically, Kaby Lake G drivers for the custom AMD Radeon RX Vega M graphics come only from Intel. With a normal discrete GPU, the consumer would download drivers from the original company, such as Nvidia or AMD. With Kaby Lake G kaput, where does that leave Kaby Lake G-owners? Intel said the company will follow its standard policy and provide driver support for Kaby Lake G for five years from the launch of the product. All told, that probably means another 3.5 years of driver updates.' -- source: https://slashdot.org/story/19/10/09/142229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Drops 32-Bit Linux
by Peter Reutemann 09 Oct '19

09 Oct '19

'Brian Fagioli, writing for BetaNews: Beginning with the upcoming version 31 of the operating system, i686 32-bit processor support is being dropped by the Fedora Project. "The i686 architecture essentially entered community support with the Fedora 27 release. Unfortunately, there are not enough members of the community willing to do the work to maintain the architecture. Don't worry, though -- Fedora is not dropping all 32-bit packages. Many i686 packages are still being built to ensure things like multilib, wine, and Steam will continue to work," says Justin Forbes of Fedora Project. Forbes further explains, "While the repositories are no longer being composed and mirrored out, there is a koji i686 repository which works with mock for building 32-bit packages, and in a pinch to install 32-bit versions which are not part of the x86_64 multilib repository. Of course, maintainers expect this will see limited use. Users who simply need to run a 32-bit application should be able to do so with multilib on a 64-bit system."' -- source: https://tech.slashdot.org/story/19/10/09/154256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internal Email Shows GitHub Plans To Renew ICE Contract
by Peter Reutemann 09 Oct '19

09 Oct '19

'GitHub CEO Nat Friedman explained why the company plans to renew a contract with U.S. Immigration and Customs Enforcement (ICE), even though he and others at GitHub oppose ICE's policy of separating children from parents at the border, Motherboard reported on Wednesday, citing an internal GitHub email. From a report: The email shows the continuing debate within the tech industry about whether companies should work specifically with ICE, and comes as a host of other companies have dealt with employee protests over corporate involvement with ICE. "In August, the GitHub leadership team learned about a pending renewal of our product by the U.S. Immigration & Customs Enforcement (ICE) agency. Since then, we have been talking with people throughout the company, based on our own personal concerns and those raised by Hubbers," Friedman's email reads, referring to GitHub employees. Evan Greer, deputy director at activism group Fight for the Future tweeted a copy of the email on Tuesday. Motherboard also separately obtained a copy of the email from a source inside GitHub. The product up for renewal is a license of GitHub Enterprise Server, an on-premises deployment of GitHub that customers can run on their own server, according to the email. ICE originally bought a license in April, 2016.' -- source: https://developers.slashdot.org/story/19/10/09/1557245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Twitter transgression proves why its flawed 2FA system is such a privacy trap
by Peter Reutemann 09 Oct '19

09 Oct '19

'If ever there was a surefire way to sour users against a two-factor authentication system that was already highly flawed, Twitter has found it. On Tuesday, the social media site said that it used phone numbers and email addresses provided for 2FA protection to tailor ads to users. Twitter requires users to provide a valid phone number to be eligible for 2FA protection. A working cell phone number is mandatory even when users' 2FA protection is based solely on security keys or authenticator apps, which don't rely on phone numbers to work. Deleting a phone number from a user's Twitter settings immediately withdraws account from Twitter 2FA, as I confirmed just prior to publishing this post.' -- sources: https://arstechnica.com/information-technology/2019/10/twitter-used-phone-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Collapse OS' Is An Open-Source Operating System For the Post-Apocalypse
by Peter Reutemann 09 Oct '19

09 Oct '19

'Collapse OS is a new open-source operating system built specifically for use during humanity's darkest days. According to its creator, software developer Virgil Dupras, Collapse OS is what the people of the future will need to reconfigure their scavenged iPhones. For now, though, he's hosting the project on GitHub and looking for contributors. Motherboard reports: According to the Collapse OS site, Dupras envisions a world where the global supply chain collapses by 2030. In this possible future -- kind of a medium-apocalypse -- populations won't be able to mass produce electronics anymore, but they'll still be an enormous source of political and social power. Anyone who can scavenge electronics and reprogram them will gain a huge advantage over those who don't. Dupras believes that the biggest problem for tech savvy post-apocalyptic people will be microcontrollers -- tiny computers embedded in circuit boards that control the functions of computer systems. Collapse OS will work with Z80 8-bit microprocessors. Though less common today than 16- and 32-bit components, the 8-bit Z80 can be found in desktop computers, cash registers, musical instruments, graphing calculators, and everything in between. In a Reddit Q&A, Dupras explained that the Z80 was chosen "because it's been in production for so long and because it's been used in so many machines, scavenger have good chances of getting their hands on it." According to the product page, Collapse OS currently can run on a homebrew Z80-based computer called the RC2014, and on Reddit Dupras said it could theoretically run on a Sega Genesis console.' -- source: https://news.slashdot.org/story/19/10/08/2036204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Overclock a Raspberry Pi 4 For Some Nice Performance Gains
by Peter Reutemann 08 Oct '19

08 Oct '19

'The Raspberry Pi 4 is one of the cheapest single-board computers around. The new 4th generation is a solid performance lift over its predecessor and good bang for the buck if you're interested in learning Linux, working with embedded computing, or just want to kick back and play some retro games on an emulator. In addition, the latest version of the Raspberry Pi Foundation's Linux distribution, Raspbian Buster, comes with a new firmware revision for the tiny DIY PC that removes its 2GHz clock speed limit and allows voltage adjustments to wring out additional performance, with proper cooling of course. In testing, while there are no guarantees in overclocking, HotHardware was able to realize more than a 40% lift in their Raspberry Pi 4's processor clock speed, and a 50% boost to the GPU with an air-cooled mini case kit. Combined, they're not enough to turn the Pi 4 into your every day PC, but the performance gains are measurable and valuable. All it takes is a quick firmware update and a couple of Linux commands to dial things in.' -- source: https://hardware.slashdot.org/story/19/10/08/0312213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thunderbird Announces OpenPGP Support
by Peter Reutemann 08 Oct '19

08 Oct '19

'On the Mozilla Thunderbird blog it was announced that for the future Thunderbird 78 release, planned for summer 2020, they will add built-in functionality for email encryption and digital signatures using the OpenPGP standard. This addresses a feature request opened on Bugzilla almost 20 years ago and has been one of the top voted bugs for most of that period.' -- source: https://it.slashdot.org/story/19/10/08/209254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

D-Link Home Routers Open To Remote Takeover Will Remain Unpatched
by Peter Reutemann 08 Oct '19

08 Oct '19

'D-Link won't patch a critical unauthenticated command-injection vulnerability in its routers that could allow an attacker to remotely take over the devices and execute code. Threatpost reports: The vulnerability (CVE-2019-16920) exists in the latest firmware for the DIR-655, DIR-866L, DIR-652 and DHP-1565 products, which are Wi-Fi routers for the home market. D-Link last week told Fortinet's FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). The root cause of the vulnerability, according to Fortinet, is a lack of a sanity check for arbitrary commands that are executed by the native command-execution function. Fortinet describes this as a "typical security pitfall suffered by many firmware manufacturers." With no patch available, affected users should upgrade their devices as soon as possible. ' -- source: https://it.slashdot.org/story/19/10/08/2016251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Attackers exploit 0-day vulnerability that gives full control of Android phones
by Peter Reutemann 06 Oct '19

06 Oct '19

'Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night. There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the "exploit has nothing to do with NSO." Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content. “The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”' -- source: https://arstechnica.com/information-technology/2019/10/attackers-exploit-0d… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Russian Malware 'Patches' Chrome and Firefox To Fingerprint TLS Traffic
by Peter Reutemann 06 Oct '19

06 Oct '19

'A Russian cyber-espionage hacker group has been spotted using a novel technique that involves patching locally installed browsers like Chrome and Firefox in order to modify the browsers' internal components. The end goal of these modifications is to alter the way the two browsers set up HTTPS connections, and add a per-victim fingerprint for the TLS-encrypted web traffic that originates from the infected computers... According to a Kaspersky report published this week, hackers are infecting victims with a remote access trojan named Reductor, through which they are modifying the two browsers. This process involves two steps. They first install their own digital certificates to each infected host. This would allow hackers to intercept any TLS traffic originating from the host. Second, they modify the Chrome and Firefox installation to patch their pseudo-random number generation (PRNG) functions. These functions are used when generating random numbers needed for the process of negotiating and establishing new TLS handshakes for HTTPS connections. Turla hackers are using these tainted PRNG functions to add a small fingerprint at the start of every new TLS connection. The attack is being attributed to Turla, "a well-known hacker group believed to operate under the protection of the Russian government," ZDNet reports. And though the remote-access trojan already grants full control over a victim's device, one theory is the modified browsers offer "a secondary surveillance mechanism" if that trojan was discovered and removed. Researchers believe the malware is installed during file transfers over HTTP connections, suggesting an ISP had been compromised, according to the article. "A January 2018 report from fellow cyber-security firm ESET revealed that Turla had compromised at least four ISPs before, in Eastern Europe and the former Soviet space, also with the purpose of tainting downloads and adding malware to legitimate fil' -- source: https://news.slashdot.org/story/19/10/06/2242221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Might Bring Its Edge Browser To Linux
by Peter Reutemann 06 Oct '19

06 Oct '19

'Microsoft appears to be porting its Edge browser to Linux, reports ZDNet: "We on the MS Edge Dev team are fleshing out requirements to bring Edge to Linux, and we need your help with some assumptions," wrote Sean Larkin, a member of Microsoft's Edge team.... Chrome, of course, is already available for Linux, so Microsoft should be able to deliver Chromium-based Edge to Linux distributions with minimal fuss.... [I]n June Microsoft Edge developers said there are "no technical blockers to keep us from creating Linux binaries" and that it is "definitely something we'd like to do down the road". Despite Chrome's availability on Linux, the Edge team noted there is still work to be done on the installer, updaters, user sync, and bug fixes, before it could be something to commit to properly. Slashdot reader think_nix shared a link to the related survey that the Edge team has announced on Twitter. "If you're a dev who depends on Linux for dev, testing, personal browsing, please take a second to fill out this survey."' -- source: https://linux.slashdot.org/story/19/10/05/1723204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

To Fight Spectre-Like Attacks, Intel Suggests a New Kind of Memory
by Peter Reutemann 06 Oct '19

06 Oct '19

'Intel researchers published a paper last week suggesting a new kind of CPU memory to block side-channel attacks like Meltdown and Spectre, according to ZDNet: SAPM -- or Speculative-Access Protected Memory -- is the work of Intel STORM (STrategic Offensive Research & Mitigations), a team of elite security researchers that Intel assembled since 2017 to work on creating mitigations for all the speculative-execution attacks that have impacted the CPU maker's products. SAPM is only an idea for the moment, and there are no silicon prototypes. Intel STORM engineers only released "the theory and possible implementation options," to provide "a ground base for other researchers to improve upon and also for the industry to consider...." Intel STORM researchers say SAPM will implement protections at the hardware level and will work with both physical and virtual memory addresses. "SAPM can be applied to specific memory ranges, with the attribute that any memory access to such memory type will be instruction-level serialized, meaning that any speculative execution beyond the SAPM-accessing instruction will be stopped pending the successful retirement of this SAPM-accessing instruction," Intel STORM developers said in their short description of SAPM's basic principles... Intel STORM researchers say the second part (backend) of most speculative execution attacks performs the same actions. SAPM was designed to introduce hardware-based protections against the backend part of most attacks. It's because of this concept that Intel's research team believes that SAPM will also future-proof the next generations of Intel CPUs against other -- currently undiscovered -- speculative execution attacks. "Intel STORM researchers don't deny that there's a performance hit," the article adds. "However, this impact is low and could be mitigated further by dropping other existing protections."' -- source: https://hardware.slashdot.org/story/19/10/05/0315201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

COSMO and Psions
by tom butz 06 Oct '19

06 Oct '19

The Psions were good as long as there was still a dial-up Internet around: they could even generate the DTMF-tones out of telephone-numbers and use them to dial using your phone's microphone. I've kept a 3c-model because of its database program. None of the Psions actually were phones. As they only supported dial-up Internet, I had a look for ISP's that still supported that, and found one (serving the Australian Outback). Unfortunately they didn't accept new customers. As far as second screens are concerned, a while ago there was a Finnish/Russian phone/PDA that had a black and white additional screen on its back. That one drew very little power and could be used for notes and - checking who called. Typing, however, was as clumsy as on any phone. The COSMO features a colour-screen on its back - coloured LEDs instead obviously would've been as user-friendly as Morse-code (for telling you who was calling, if you didn't want to open your phone). In a perfect world, developers would have come up with a Psion keyboard, Internet/WiFi/Bluetooth capability and a black and white screen at the back. Today's cameras are good at taking/watching photos/videos, and they are a lot less chunky.

1 0

Psion Reborn
by Lawrence D'Oliveiro 05 Oct '19

05 Oct '19

The Cosmo Communicator should be shipping to its backers next week <https://www.theregister.co.uk/2019/10/04/planet_launches_cosmo_communicator…>. It has more than a passing resemblance to the Psion clamshell pocket PCs of the 1990s, except this one has an open design, intended to allow it to run a choice of open-source operating systems. This looks to be a niche market, compared to the millions of units shipped by all the usual big-name vendors. But if they can make enough money--and keep enough customers happy--to stay in business, why not?

1 0

Award For “Most Spectacular Misuse Of Microsoft Excel”?
by Lawrence D'Oliveiro 04 Oct '19

04 Oct '19

Astronaut Tim Peake blames the spreadsheet for his dialling a wrong number during his stint on the International Space Station <https://www.theregister.co.uk/2019/10/02/future_decoded_peake/>: "I'm still blaming that on the software, I imported my contacts address book in Excel and all the 9s got rounded up to 0s…" Will people never learn <https://www.youtube.com/watch?v=S8wO4ppE9L8> ...

1 0

Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook's Apps
by Peter Reutemann 03 Oct '19

03 Oct '19

'Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety. From a report: A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication. Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook's plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling. "Security enhancements to the virtual world should not make us more vulnerable in the physical world," the letter reads. "Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes." The letter calls on Facebook to prioritize public safety in designing its encryption by enabling law enforcement to gain access to illegal content in a manageable format and by consulting with governments ahead of time to ensure the changes will allow this access. While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children."' -- source: https://it.slashdot.org/story/19/10/03/1847213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MorphOS 3.12 Released
by Peter Reutemann 03 Oct '19

03 Oct '19

'Mike Bouma shares a post from MorphZone, detailing the latest update to the AmigaOS-like computer operating system known as MorphOS: The MorphOS development team is proud to announce the public release of MorphOS 3.12. This new version introduces brand new dual-monitor capabilities to various Powerbook laptops as well as G5 desktop systems, and features improved thermal management, fan control and dynamic CPU frequency switching, which provide increased energy efficiency and reduced noise levels. Additionally, the Helios Firewire stack has been fully integrated into the core OS and we added support for hundreds of modern printers and scanners. The installation and troubleshooting guides should be carefully read prior to installation. You can download MorphOS 3.12 here.' -- source: https://tech.slashdot.org/story/19/10/02/219220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Ryzen Pro 3000 series desktop CPUs will offer full RAM encryption
by Peter Reutemann 02 Oct '19

02 Oct '19

'Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them. >From a more technical perspective, the answer is that the Ryzen Pro line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard—"a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory"—matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.' -- source: https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Most mobile browsers display the Web, that’s it—Vivaldi Mobile can change that
by Peter Reutemann 01 Oct '19

01 Oct '19

'Vivaldi—makers of the power user's favorite Web browser—has finally released a mobile version. Vivaldi for Android (sorry iOS users, it's Android-only for now) brings most of what's great about Vivaldi to your phone, and thanks to Vivaldi's sync service, you can even have all your desktop data on your mobile device. Web browsers are perhaps the most important piece of software we use in 2019. Our devices are often little more than small windows onto the Web, and the browser is what we use to see and explore what's in that window. For all its importance though, the modern browser, especially the mobile Web browser, offers precious little in the way of features. It displays the Web and... that's about it. Want to interact with what you see? You're mostly out of luck. Most people probably like their browser this way. Google, maker of the most widely used mobile browser, rarely does anything without extensive user testing. If Chrome is minimalist, it's safe to assume it's that way because Google has determined that's what its users want. And since most other browsers copy whatever Google Chrome does, most mobile Web browsers end up as minimalistic pieces of software. On the desktop, of course, there has long been an exception to the uniformly dumbed-down offerings of Chrome, Firefox, and Safari—Vivaldi. Led by CEO Jon S. von Tetzchner, co-founder and former CEO of Opera, Vivaldi's primary goal is to build a useful browser, a tool you can bend to your will rather than the other way around. You can customize Vivaldi the way you like. Its preferences may be overwhelming at first glance, but if you dig in, you can make Vivaldi do just about whatever you want it to do. For this reason, Vivaldi is often called a "power user's browser" (as opposed to, I guess, the powerless user's browser). For all that, there was always one big problem with Vivaldi: it was desktop only. The company said it was working on a mobile version from the beginning, and von Tetzchner told me several times he was already using it. But there was nothing for the rest of us. Now Vivaldi Mobile is here (again, for Android users at least). Technically, it's a beta release and all the common cautions regarding beta software apply, but I've been using it for over a month now and have had no problems. Or, I should say, I have had problems, but updates prior to the public release eliminated all of them. And even if there were still bugs, Vivaldi would still be more useful than any other browser on my phone based on this recent testing—and yes, I've tried nearly all of today's mobile browsers, even the small, cottage efforts.' -- source: https://arstechnica.com/information-technology/2019/10/vivaldi-mobile-revie… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google's DNS-Over-TLS Plans Scrutinized By US Congress
by Peter Reutemann 01 Oct '19

01 Oct '19

'Google's plans to implement DNS over TLS in Chrome are being investigated by a committee in the U.S. House of Representatives, while the Justice Department has "recently received complaints" about the practice, according to the Wall Street Journal. An anonymous reader quotes Engadget: While Google says it's pushing for adoption of the technology to prevent spying and spoofing, House investigators are worried this would give the internet giant an unfair advantage by denying access to users' data. The House sent a letter on September 13th asking if Google would use data handled through the process for commercial purposes... Internet service providers are worried that they may be shut out of the data and won't know as much about their customers' traffic patterns. This could "foreclose competition in advertising and other industries," an alliance of ISPs told Congress in a September 19th letter... Mozilla also wants to use the format to secure DNS in Firefox, and the company's Marshall Erwin told the WSJ that the antitrust gripes are "fundamentally misleading." ISPs are trying to undermine the standard simply because they want continued access to users' data, Erwin said. Unencrypted DNS helps them target ads by tracking your web habits, and it's harder to thwart DNS tracking than cookies and other typical approaches. ' -- source: https://tech.slashdot.org/story/19/09/29/2033247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

UK Court Rules That E-Mail Sig Blocks Can Sign Contracts
by Lawrence D'Oliveiro 30 Sep '19

30 Sep '19

An e-mail exchange has been ruled to be a binding contract <https://www.theregister.co.uk/2019/09/30/email_signature_legally_binding_co…> because the senders included their names at the end, as people commonly do.

1 0