- wlug - list.wlug.org.nz

Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet
by Peter Reutemann 10 Jan '19

10 Jan '19

'Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws.' -- source: https://linux.slashdot.org/story/19/01/10/1759253 BTW This is an FYI, not a reason to start a flame war again... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Tool Automates Phishing Attacks That Bypass 2FA
by Peter Reutemann 09 Jan '19

09 Jan '19

'A new penetration testing tool published at the start of the year by a security researcher can automate phishing attacks with an ease never seen before and can even blow through login operations for accounts protected by two-factor authentication (2FA). From a report: Named Modlishka --the English pronunciation of the Polish word for mantis -- this new tool was created by Polish researcher Piotr Duszynski. Modlishka is what IT professionals call a reverse proxy, but modified for handling traffic meant for login pages and phishing operations. It sits between a user and a target website -- like Gmail, Yahoo, or ProtonMail. Phishing victims connect to the Modlishka server (hosting a phishing domain), and the reverse proxy component behind it makes requests to the site it wants to impersonate. The victim receives authentic content from the legitimate site --let's say for example Google -- but all traffic and all the victim's interactions with the legitimate site passes through and is recorded on the Modlishka server.' -- source: https://it.slashdot.org/story/19/01/09/1817234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bash-5.0 release available
by Peter Reutemann 08 Jan '19

08 Jan '19

'This release fixes several outstanding bugs in bash-4.4 and introduces several new features. The most significant bug fixes are an overhaul of how nameref variables resolve and a number of potential out-of-bounds memory errors discovered via fuzzing. There are a number of changes to the expansion of $@ and $* in various contexts where word splitting is not performed to conform to a Posix standard interpretation, and additional changes to resolve corner cases for Posix conformance. The most notable new features are several new shell variables: BASH_ARGV0, EPOCHSECONDS, and EPOCHREALTIME. The `history' builtin can remove ranges of history entries and understands negative arguments as offsets from the end of the history list. There is an option to allow local variables to inherit the value of a variable with the same name at a preceding scope. There is a new shell option that, when enabled, causes the shell to attempt to expand associative array subscripts only once (this is an issue when they are used in arithmetic expressions). The `globasciiranges' shell option is now enabled by default; it can be set to off by default at configuration time. There are a few incompatible changes between bash-4.4 and bash-5.0. The changes to how nameref variables are resolved means that some uses of namerefs will behave differently, though I have tried to minimize the compatibility issues. By default, the shell only sets BASH_ARGC and BASH_ARGV at startup if extended debugging mode is enabled; it was an oversight that it was set unconditionally and caused performance issues when scripts were passed large numbers of arguments.' -- source: http://lists.gnu.org/archive/html/bug-bash/2019-01/msg00063.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fwd: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members!
by Peter Reutemann 08 Jan '19

08 Jan '19

Apologies for cross-posting... Cheers, Peter ---------- Forwarded message --------- From: Dave Lane <president(a)nzoss.org.nz> Date: Tue, Jan 8, 2019 at 4:08 PM Subject: [NZOSS OpenChat] Linux.conf.au discount for NZOSS financial members! To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hello everyone, The organisers of 2019's Linux.conf.au (it's here in Christchurch in 2 weeks - 21-25 Jan!) have kindly extended a discount offer to full (financial) NZOSS members, which makes the hobbyist registration price $399 (discounted from $549, so $150 reduction!) for those wanting to attend! Given that the savings is substantially more than the cost of becoming an NZOSS member ($40 - https://members.nzoss.nz) seems quite worthwhile! If you haven't been to an LCA before (this'll be my 6th), they're superb. Go. I'll provide the discount code to any current (or recent 🙂 ) financial members requesting one... The window for registration closes on 15 January, so don't dilly-dally! Hope to see many of you there! Dave -- Dave Lane, President, New Zealand Open Source Society e: president(a)nzoss.org.nz m: 021 229 8147 w: http://nzoss.org.nz ―― View topic http://groups.nzoss.org.nz/r/topic/60OKMe2P8pajbBBtpNRr4L Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DuckDuckGo Denies Using Fingerprinting To Track Its Users
by Peter Reutemann 08 Jan '19

08 Jan '19

'Responding to a forum post that accused it of 'fingerprinting users', privacy-centric search engine DuckDuckGo says that fears are unfounded and that it is not tracking its users. The allegation was made after the Firefox extension CanvasBlocker showed a warning to users. The suggestion of fingerprinting -- gathering as much information as possible about a user through their browser to create a unique identifier that can be used for tracking -- is clearly something that would seem to sit in opposition to what DuckDuckGo claims to stand for. The company CEO says the accusation is simply wrong.' -- source: https://search.slashdot.org/story/19/01/07/194206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sony Appears To Be Blocking Kodi On Its Recent Android TVs
by Peter Reutemann 08 Jan '19

08 Jan '19

'Several reports indict that at least some of Sony's recent Android TVs are actively blocking Kodi, the open-source, cross-platform streaming and media player that allows you to access and play local, network, and remote content. Android Police reports: The official Kodi project Twitter account pointed out Sony's deficiency a couple of days ago, but reports on the Kodi forums of issues installing and running the app from the Play Store go even further back to last year. A handful of affected enthusiasts believe they have discovered the cause of the problem: Sony seems to be blocking the package ID for the app from being installed/run. Supporting this theory is the fact that recompiling the app from scratch with a different ID allows it to work. ' -- source: https://yro.slashdot.org/story/19/01/07/2211200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meetings for 2019
by Peter Reutemann 08 Jan '19

08 Jan '19

Hi everyone I finally have all the room bookings for 2019 sorted (the guys doing the bookings are overworked and understaffed due to holidays). The university changed its policy around providing rooms on holiday from a "we'll coordinate with security" to a "should not be allowed". Instead of going to the pub three times (Jan/Apr/Oct), listening to pub quizzes, I decided to break with our 4th Monday tradition for these months and have the meetings on the 3rd Monday instead. Here's the complete list of meetings for 2019, for those that don't use meetup.com: Jan 21 -- 3rd Monday Feb 25 Mar 25 Apr 15 -- 3rd Monday May 27 Jun 24 Jul 22 Aug 26 Sep 23 Oct 21 -- 3rd Monday Nov 25 Here is the link to our meetup.com community page: https://www.meetup.com/WaikatoLinuxUsersGroup/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux For Cars: Tesla Isn't The Only Automaker Running Linux Under the Hood
by Peter Reutemann 06 Jan '19

06 Jan '19

'ZDNet reports that by 2020, "many, if not most, new cars will be running with Linux." While some companies, like Tesla, run their own homebrew Linux distros, most rely on Automotive Grade Linux (AGL). AGL is a collaborative cross-industry effort developing an open platform for connected cars with over 140 members... Its membership includes Audi, Ford, Honda, Mazda, Nissan, Mercedes, Suzuki, and the world's biggest automobile company: Toyota. Why? "Automakers are becoming software companies, and just like in the tech industry, they are realizing that open source is the way forward," said Dan Cauchy, AGL's executive director, in a statement. Car companies know that while horsepower sells, customers also want smart infotainment systems, automated safe drive features, and, eventually, self-driving cars. Linux and open-source company can give them all of that. The AGL's goal is to develop an open-source, common platform for infotainment systems: The Unified Code Base (UCB). This is a Linux distribution and open-source software platform for car infotainment, telematics, and instrument cluster applications... The AGL's hope is that this will serve as a de facto industry standard. It's well on its way. Yesterday Hyundai announced that they were also joining both the AGL effort and the Linux Foundation.' -- source: https://tech.slashdot.org/story/19/01/05/1928205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Eben Upton Remembers The Years Before the First Raspberry Pi
by Peter Reutemann 06 Jan '19

06 Jan '19

'Tech Republic re-visits the story of the earliest attempts to build the Raspberry Pi, and the dramatic launch of a quest "to rekindle the curiosity about computing in a generation immersed in technology but indifferent to how it worked." [T]he dominant computers -- games consoles and later tablets and smartphones -- no longer offered an invitation to create, but rather to consume. Eben Upton recalls a bonfire party in 2007 where an 11-year-old boy told him he wanted to be an electrical engineer, and his disappointment at realizing the boy didn't have access to a computer he could program on. "I said, 'Oh, what computer have you got?'. He said, 'I've got a Nintendo Wii'. And there was just that awful feeling about there being a kid who was excited, a kid who was showing concrete interest in our profession, and who didn't have access to a programmable computer, a computer of any sort. He just had a games console." At this time Upton was working as a system-on-a-chip architect at chip designer Broadcom, and realized he had the skills to try to halt this drift away from computers that encouraged users to code. Upton describes the Raspberry Pi as "a very conscious attempt" to bring back the easily programmable home computers that he remembered as a child in the 1980s -- and he was gratified at its success. "Even early on you started to see those pictures of kids lying on the living room floor, looking up at the TV with Raspberry Pi plugged into it, the same way we used to." It was named "Pi" because it booted into a version of Python, and Raspberry because "There's a lot of fruit-named computer companies, and the 'blowing a raspberry' thing was also deliberate." It's gone on to become the world's third best-selling general-purpose computer.' -- source: https://developers.slashdot.org/story/19/01/05/2031219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux commands for measuring disk activity
by Peter Reutemann 04 Jan '19

04 Jan '19

'Linux systems provide a handy suite of commands for helping you see how busy your disks are, not just how full. In this post, we examine five very useful commands for looking into disk activity. Two of the commands (iostat and ioping) may have to be added to your system, and these same two commands require you to use sudo privileges, but all five commands provide useful ways to view disk activity.' -- source: https://www.networkworld.com/article/3330497/linux/linux-commands-for-measu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

DCP – Transfer Files Between Linux Hosts Using Peer-to-Peer Network
by Peter Reutemann 04 Jan '19

04 Jan '19

'People often need to copy or share files over the network. Many of us are used to using tools such as rsync or scp to transfer files between machines. In this tutorial, we are going to review another tool that can help you copy files between hosts in a network – Dat Copy (dcp). Dcp does not require SSH to be used or configured in order to copy your files. Furthermore it does not require any configuration to securely copy your files.' -- source: https://www.tecmint.com/dcp-copy-files-between-linux-servers/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Mickey Mouse Will Be Public-Domain Soon; But What Will It Mean?
by Lawrence D'Oliveiro 03 Jan '19

03 Jan '19

Wonder of wonders, there has been no followup to the Sonny Bono Copyright Term Extension Act of 1998 <https://arstechnica.com/tech-policy/2019/01/a-whole-years-worth-of-works-ju…>. That means more and more interesting things are going to fall into the public domain from this year onwards. However, things are not going to be simple: the original incarnation of Walt Disney’s Mickey Mouse will be in the public domain after 2024, but later versions will still be under copyright, and the trademarks will also continue to be in effect. How will that work? Probably in the same way that “intellectual property” usually works: the one with the biggest legal budget wins.

1 0

Examples Of How Not To Code
by Lawrence D'Oliveiro 03 Jan '19

03 Jan '19

Presenting the “Damn Vulnerable Serverless Application” <https://www.theregister.co.uk/2019/01/03/damn_vulnerable_serverless_applica…>, the latest in a line of “damn vulnerable” apps that are chock-full of deliberately-introduced security vulnerabilities. My worry about this sort of thing is the mindless-copy-and-paste crowd. We already see the effects of posting sample code with error-checking omitted “just to keep things simple”, along with exhortations to use it only as a guide, not to be slavishly copied; such exhortations are routinely ignored. From there, it seems only a small step to completely miss the context of such counterexample code, and actually use it as something to be followed.

1 0

Mozilla Thunderbird Outlines Plans For 2019: Addressing UI Lags, Performance Issues; Improved 3rd-Party Email Integration, Encryption Usability
by Peter Reutemann 02 Jan '19

02 Jan '19

'For years, Mozilla has largely neglected development of Thunderbird, an email client it owns. But the company, which grew its team to eight staff last year, says it plans to address most of the issues that users have complained about and add six more people to Thunderbird staff this year, it said in a blog post. In the blog post Wednesday, the company said: Our hires are already addressing technical debt and doing a fair bit of plumbing when it comes to Thunderbird's codebase. Our new hires will also be addressing UI-slowness and general performance issues across the application. This is an area where I think we will see some of the best improvements in Thunderbird for 2019, as we look into methods for testing and measuring slowness -- and then put our engineers on architecting solutions to these pain points. Beyond that, we will be looking into leveraging new, faster technologies in rewriting parts of Thunderbird as well as working toward a multi-process Thunderbird. [...] For instance, one area of usability that we are planning on addressing in 2019 is integration improvements in various areas. One of those in better Gmail support, as one of the biggest email providers it makes sense to focus some resources on this area. We are looking at addressing Gmail label support and ensuring that other features specific to the Gmail experience translate well into Thunderbird. We are looking at improving notifications in Thunderbird, by better integrating with each operating system's built-in notification system. By working on this feature Thunderbird will feel more "native" on each desktop and will make managing notifications from the app easier. The UX/UI around encryption and settings will get an overhaul in the coming year, whether or not all this work makes it into the next release is an open question â" but as we grow our team this will be a focus. It is our hope to make encrypting Email and ensuring your private communication easier in upcoming releases, we've even hired an engineer who will be focused primarily on security and privacy.' -- source: https://tech.slashdot.org/story/19/01/02/165204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GIMP Developers Outline Plan For 2019
by Peter Reutemann 02 Jan '19

02 Jan '19

'The GIMP developers on Wednesday published a blog post in which they look back at the year 2018 (release of GIMP 2.10) and outline the things that they intend to get around this year. From the post: We expect to be shipping 2.10.x updates throughout 2019, starting with the version 2.10.10 currently expected in January/February. This version will feature faster layer groups rendering, smart colorization with the Bucket Fill tool, and various usability improvements. We are also planning the first unstable release of GIMP that will have version 2.99.2, eventually leading up to version 3.0. The prerequisite for releasing that version will be the completion of the space invasion. ZeMarmot project (which can be supported on Patreon or Tipeee) is also planning to focus a bit more on better canvas interactions, as well as animation support improvements, starting from merging existing work. On the GEGL and babl front, we expect to continue working towards better CMYK support and performance.' -- source: https://developers.slashdot.org/story/19/01/02/1655210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

USB Type-C Authentication Program Launched
by Peter Reutemann 02 Jan '19

02 Jan '19

'With the arrival of USB-C a few years back, plugging into laptops, tablets and smartphones became even easier than before. But there are potential security risks. The USB Type-C Authentication Program launched today aims to address such issues. From a report: The new protocol from the USB Implementers Forum (USB-IF) can be used to validate the authenticity of a cable, charger or hardware at the moment of connection, and stop attacks in their tracks. The USB-IF has chosen DigiCert to operate registrations and certificate authority services for the new specification, which makes use of 128-bit cryptographic-based authentication for certificate format, digital signing, hash and random number generation. "USB Type-C Authentication gives OEMs the opportunity to use certificates that enable host systems to confirm the authenticity of a USB device or USB charger, including such product aspects as the descriptors, capabilities and certification status," said DigiCert in a press release. "This protects against potential damage from non-compliant USB chargers and the risks from maliciously embedded hardware or software in devices attempting to exploit a USB connection."' -- source: https://it.slashdot.org/story/19/01/02/2025207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

wget Command Stores Extended Attributes
by Lawrence D'Oliveiro 02 Jan '19

02 Jan '19

Here’s something I didn’t know: the “wget” command saves the URL where it got a downloaded file as an extended attribute of the file. This behaviour isn’t mentioned anywhere in the man page or in the info file, that I can find. Unfortunately, this can lead to a security issue where the URL includes confidential password details. And it appears other apps, like Chrome, do a similar thing. <https://www.theregister.co.uk/2019/01/02/wget_bug_fix/>

1 0

Banana Pi 24-Core ARM Server Running Ubuntu Breaks Cover
by Peter Reutemann 27 Dec '18

27 Dec '18

'ARM-based server processors have threatened to take on Intel in the data center for some time but not much has materialized thus far in terms of significant deployments. However, a new breed of low cost ARM server implementations may be in the works with a many-core platform called Banana Pi. The latest Banana Pi device being teased is something very different in the form of a 24-core ARM server that speculation suggests might be sold as a Banana Pi server board or as a finished server product. A video has surfaced that reportedly shows a 24-core ARM Cortex-A53 processor with 32GB of RAM, though the OS only sees 29.4GB of that RAM. The OS is Ubuntu 18.04.1 LTS with MATE desktop. Unless the processor used in this device is something unannounced, and that seems unlikely, the chip itself would likely be a SocioNext SC2A11. The same processor is used in the Linaro Developer Box. The demo shows the server fully loaded at 100% CPU utilization building a Linux kernel and reportedly the system also supports NVMe storage as well as TensorFlow workloads for machine learning. Not much else is known about the system at this time but it's an interesting development in the Linux server space to be sure.' -- source: https://hardware.slashdot.org/story/18/12/27/0556243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Requesting The Data You’ve Left Online
by Lawrence D'Oliveiro 26 Dec '18

26 Dec '18

Article from a correspondent for the Otago Daily Times <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12182555> about what he discovered when he asked Google, Facebook, the NZ Police, the NZSIS and various credit ratings companies what information they had on him. All except one responded with rather sobering amounts of personal detail.

1 0

LibreHunt: The Linux Distro Counsellor
by Lawrence D'Oliveiro 23 Dec '18

23 Dec '18

Here’s a site <https://www.librehunt.org/> which purports to suggest a suitable Linux distro for you, based on your answers to questions about your ability, needs etc. The selection is made from a “curated” list of just 44 distros, to simplify things.

1 0

Word For The Week: “Kaomoji”
by Lawrence D'Oliveiro 20 Dec '18

20 Dec '18

For those who might previously have gone “(＠_＠)” or “¯\_(ツ)_/¯” when they heard this word, here it is all explained: <http://kaomoji.ru/en/>. So now you can be all “\(^ヮ^)/” instead. Actually I came across that word in this article <https://arstechnica.com/gadgets/2018/12/windows-10-will-make-it-easier-to-%…>, which reports that Windows 10 will make it easier to enter these character sequences.

1 0

Bye bye Mongo, Hello Postgres
by Peter Reutemann 20 Dec '18

20 Dec '18

'In April the Guardian switched off the Mongo DB cluster used to store our content after completing a migration to PostgreSQL on Amazon RDS. This post covers why and how' -- source: https://www.theguardian.com/info/2018/nov/30/bye-bye-mongo-hello-postgres Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Does Not “Sell” Your Data, But ...
by Lawrence D'Oliveiro 20 Dec '18

20 Dec '18

... they sure as hell have been rather free and easy in sharing it with others <https://www.techdirt.com/articles/20181219/10370941268/facebooks-latest-pri…>. Seems a bunch of companies have had extra-privileged access to user data on Facebook, and they in turn supplied information about those users back to Facebook. This is how the “People You May Know” feature is able to make links like between different patients of the same psychiatrist, and other things equally dodgy ethically, if not downright illegal (or at least they should be). And this may be how Amazon was able to make a (spurious) association between a book reviewer and the book author, and disallow the review on that basis, just because the reviewer had previously followed the author on Facebook.

1 0

kflickr wants http/ssl
by Barry Marchant 19 Dec '18

19 Dec '18

Hi all, When I try to start kflickr from cmd line I get a msg HTTP request to Flickr.com failed. (msg: SSL is required). Am I missing a pkg? or is there another problem? System is x86-64 running Mageia5 TIA Barry

3 2

How Computers Got Shockingly Good At Recognizing Images
by Lawrence D'Oliveiro 19 Dec '18

19 Dec '18

Some good background on the origins of all the current hubbub over automated image recognition: <https://arstechnica.com/science/2018/12/how-computers-got-shockingly-good-a…>. A key breakthrough came in 2012, when a team at the University of Toronto combined the “convolutional” neural network concept with a massive deployment of sheer computing power to leave its competitors in the dust in the “ImageNet” image-recognition competition that year. That team are now working at Google. Oh, and the recognition algorithms are now scoring better than many humans in some areas.

2 2

Windows 10 October 2018 Update Is Getting There
by Lawrence D'Oliveiro 19 Dec '18

19 Dec '18

Microsoft seems to think its October update is now worth inflicting on “advanced” users <https://arstechnica.com/gadgets/2018/12/windows-10-october-2018-update-now-…>. The more general populace will have to wait a bit longer. I wonder when we’ll see the November update ...

1 0

You’ve Heard Of The Wayback Machine, Now Meet Archive Team
by Lawrence D'Oliveiro 18 Dec '18

18 Dec '18

You probably already know about the Wayback machine <https://archive.org/>. You might think of them as the “respectable” side of trying to save snapshots of old websites: they respect robots.txt and takedown demands. Well, now meet the, um, more “wild and woolly” side with the same mission: Archive Team <https://archiveteam.org/>. They describe themselves as ... a loose collective of rogue archivists, programmers, writers and loudmouths dedicated to saving our digital heritage. Since 2009 this variant force of nature has caught wind of shutdowns, shutoffs, mergers, and plain old deletions - and done our best to save the history before it's lost forever. Along the way, we've gotten attention, resistance, press and discussion, but most importantly, we've gotten the message out: IT DOESN'T HAVE TO BE THIS WAY. I just heard about them because they were trying to save all the X-rated blogs on tumblr.com before these disappeared, on orders of new owner Verizon. The company tried to block them from achieving this mission, but they found a way around the block (NSFW language) <https://www.techdirt.com/articles/20181216/22420341242/as-final-fuck-you-to…>.

1 1

MIPS Goes Open Source
by Peter Reutemann 18 Dec '18

18 Dec '18

'Junko Yoshida, writing for EETimes: Without question, 2018 was the year RISC-V genuinely began to build momentum among chip architects hungry for open-source instruction sets. That was then. By 2019, RISC-V won't be the only game in town. Wave Computing (Campbell, Calif.) announced Monday (Dec. 17) that it is putting MIPS on open source, with MIPS Instruction Set Architecture (ISA) and MIPS' latest core R6 available in the first quarter of 2019. Art Swift, hired by Wave this month as president of its MIPS licensing business, described the move as critical to accelerate the adoption of MIPS in an ecosystem. Going open source is "a big plan" that Wave CEO Derek Meyer, a MIPS veteran, has been quietly fostering since Wave acquired MIPS Technologies in June, explained Swift. Swift himself is a MIPS alumnus who worked at the company as a vice president of marketing and business development for four years. Wave, which styles itself as a tech startup poised to bring "AI and deep learning from the datacenter to the edge," sees MIPS as a key to advancing Wave's AI into a host of uses and applications. Included in MIPS instruction sets are extensions such as SIMD (single instruction, multiple data) and DSP. Swift promised that MIPS will bring to the open-source community "commercial-ready" instruction sets with "industrial-strength" architecture. "Chip designers will have opportunities to design their own cores based on proven and well tested instruction sets for any purposes," said Swift.' -- source: https://news.slashdot.org/story/18/12/17/1954247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Red Hat Enterprise Linux Comes To Windows 10 in the Form of WLinux Enterprise
by Peter Reutemann 18 Dec '18

18 Dec '18

'Mark Wilson writes: Earlier in the year open-source software startup Whitewater Foundry brought WLinux to the Windows Subsystem for Linux (WSL). Not content with creating the first native Linux distribution for WSL, the company has now gone a step further, targeting enterprise users with WLinux Enterprise. Whitewater Foundry says that WLinux Enterprise is the first product to support the industry-standard Red Hat Enterprise Linux on Windows Sub' -- source: https://tech.slashdot.org/story/18/12/17/2041255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google isn’t the company that we should have handed the Web over to
by Peter Reutemann 17 Dec '18

17 Dec '18

'With Microsoft's decision to end development of its own Web rendering engine and switch to Chromium, control over the Web has functionally been ceded to Google. That's a worrying turn of events, given the company's past behavior. Chrome itself has about 72 percent of the desktop-browser market share. Edge has about 4 percent. Opera, based on Chromium, has another 2 percent. The abandoned, no-longer-updated Internet Explorer has 5 percent, and Safari—only available on macOS—about 5 percent. When Microsoft's transition is complete, we're looking at a world where Chrome and Chrome-derivatives take about 80 percent of the market, with only Firefox, at 9 percent, actively maintained and available cross-platform. The mobile story has stronger representation from Safari, thanks to the iPhone, but overall tells a similar story. Chrome has 53 percent directly, plus another 6 percent from Samsung Internet, another 5 percent from Opera, and another 2 percent from Android browser. Safari has about 22 percent, with the Chinese UC Browser sitting at about 9 percent. That's two-thirds of the mobile market going to Chrome and Chrome derivatives. In terms of raw percentages, Google won't have quite as big a lock on the browser space as Microsoft did with Internet Explorer—Internet Explorer 6 peaked at around 80 percent, and all versions of Internet Explorer together may have reached as high as 95 percent. But Google's reach is, in practice, much greater: not only is the Web a substantially more important place today than it was in the early 2000s, but also there's a whole new mobile Web that operates in addition to the desktop Web.' -- source: https://arstechnica.com/gadgets/2018/12/the-web-now-belongs-to-google-and-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Do Alternative Software Licenses Represent Open Source's 'Midlife Crisis'?
by Peter Reutemann 16 Dec '18

16 Dec '18

'"it is clear to me that open source -- now several decades old and fully adult -- is going through its own midlife crisis," writes Joyent CTO Bryan Cantrill. [O]pen source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it -- and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source -- the community, the positivity, the energy, the adoption, the downloads -- but they also want to enjoy the fruits of proprietary software companies in software lock-in and its concomitant monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others...are little better... "[T]heir business model isn't their community's problem, and they should please stop trying to make it one," Cantrill writes, adding letter that "As we collectively internalize that open source is not a business model on its own, we will likely see fewer VC-funded open source companies (though I'm honestly not sure that that's a bad thing)..." He also points out that "Even though the VC that led the last round wants to puke into a trashcan whenever they hear it, business models like 'support', 'services' and 'training' are entirely viable!" Jay Kreps, Co-founder of @confluentinc, has posted a rebuttal on Medium. "How do you describe a license that lets you run, modify, fork, and redistribute the code and do virtually anything other than offer a competing SaaS offering of the product? I think Bryan's sentiment may be that it should be called the Evil Proprietary Corruption of Open Source License or something like that, but, well, we disagree."' -- source: https://news.slashdot.org/story/18/12/15/2221232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Last Independent Mobile OS
by Peter Reutemann 16 Dec '18

16 Dec '18

'The year was 2010 and the future of mobile computing was looking bright. The iPhone was barely three years old, Google's Android had yet to swallow the smartphone market whole, and half a dozen alternative mobile operating systems -- many of which were devoutly open source -- were preparing for launch. Eight years on, you probably haven't even heard of most of these alternative mobile operating systems, much less use them. Today, Android and iOS dominate the global smartphone market and account for 99.9 percent of mobile operating systems. Even Microsoft and Blackberry, longtime players in the mobile space with massive revenue streams, have all but left the space. Then there's Jolla, the small Finnish tech company behind Sailfish OS, which it bills as the "last independent alternative mobile operating system." Jolla has had to walk itself back from the edge of destruction several times over the course of its seven year existence, and each time it has emerged battered, but more determined than ever to carve out a spot in the world for a truly independent, open source mobile operating system. Jolla's Sailfish OS rose from the ashes of Nokia and Intel's ill-fated collaboration, MeeGo. The MeeGo project launched in 2010 in an attempt to merge Intel's Linux-based Moblin OS and Nokia's Maemo software platform into a single open-source mobile operating system that could take on Google. By 2011, Android had already surpassed Nokia in the smartphone market, a fact that wasn't lost on Nokia's CEO Stephen Elop, who in a memo described the company as standing on a "burning platform." Nokia only ever released one phone running MeeGo: the Nokia N9, which ended up being well received despite its limited release. But it was too little, too late. By 2011, Nokia was bleeding talent and it was clear that MeeGo wasn't going to keep the company competitive in the rapidly changing smartphone market. In a last-ditch effort, Nokia struck a partnership with Microsoft to provide the hardware for its next generation of Windows Phones, abandoning MeeGo entirely. The same couldn't be said for those developers who had worked on MeeGo and, before that, an open source mobile OS called Mer, based on Intel's Maemo system. In October 2011, three developers that had worked on Mer sent a message on a mailing list calling for the creation of a "MeeGo 2.0." At the same time, developer Sami Pienimaki and two others left Nokia to found their own company, which would use this new version of MeeGo as the basis for an open source mobile OS. And thus, Sailfish was born. In a cheeky homage to the "burning platform" memo, Pienimaki and his fellow defectors decided to name their company Jolla, a Finnish word connoting a small boat or life raft. Jolla has since turned to Russia and China, both of which were hungry for a secure alternative to Google-based systems. In late 2016, Sailfish OS achieved domestic certification in Russia for government and corporate us. Around the same time, Sailfish was also making moves in China. In early 2017, the Sailfish China Consortium gained the exclusive rights and license to develop a Chinese OS based on Sailfish.' -- source: https://hardware.slashdot.org/story/18/12/16/0758215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Tesla Model 3 Modded To Run Ubuntu
by Peter Reutemann 16 Dec '18

16 Dec '18

'CleanTechnica is reporting that someone hacked the infotainment system of a Tesla Model 3 and got root access and installed Linux distribution Ubuntu. Redditor trsohmers is able to show an Ubuntu command shell running alongside the Tesla OS. Since Tesla supports a browser that allows you to visit any site, could this be leveraged into remote hacks? It could also mean that if Tesla sells a long-range version of the Model 3, but limits it via software, people might try to remove the block. One could potentially get a 15-day trial of full self-driving for free and extend that 15-day window forever. At least he had some guts messing with $50,000 hardware that phones home all the time. Will Tesla brick his car to attempt to disprove the security issue?' -- source: https://news.slashdot.org/story/18/12/15/0355250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Evelyn Berezin Has Died
by Lawrence D'Oliveiro 15 Dec '18

15 Dec '18

Among her many achievements: While IBM had been producing word processors of a sort for a few years when Berezin developed hers in 1968, she was the first to use semiconductor chips to make a true computing system for this purpose. IBM's solution used a typewriter and a magnetic tape drive and was much less efficient to use. <https://arstechnica.com/gadgets/2018/12/evelyn-berezin-creator-of-the-first…>

1 0

Automatically Generating Fake Photos
by Lawrence D'Oliveiro 15 Dec '18

15 Dec '18

Look at the photo grid about halfway down this article <https://www.theregister.co.uk/2018/12/14/ai_created_photos/>: as I understand it, the main facial features are taken from the photos down the leftmost column; these are then resynthesized into a new orientation, expression and other embellishments (including hair colour/style, gender and apparent age!) to match the photos across the topmost row. Or something like that. Apparently, Nvidia is planning to publish its source code. Kids, you may not be able to afford the hardware to try this at home ...

1 0

Windows Server 2019 Officially Supports OpenSSH For the First Time
by Peter Reutemann 13 Dec '18

13 Dec '18

'Microsoft said in 2015 that it would build OpenSSH, a set of utilities that allow clients and servers to connect securely, into Windows, while also making contributions to its development. Neowin: Since then, the company has delivered on that promise in recent releases of Windows 10, being introduced as a feature-on-demand in version 1803. However, Windows Server hadn't received the feature until now, at least not in an officially supported way -- Windows Server version 1709 included it as a pre-release feature. But that's finally changed, as Microsoft this week revealed that Windows Server 2019, which was made available (again) in November, includes OpenSSH as a supported feature.' -- source: https://slashdot.org/story/18/12/13/1947257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

In a Test, 3D Model of a Head Was Able To Fool Facial Recognition System of Several Popular Android Smartphones
by Peter Reutemann 13 Dec '18

13 Dec '18

'Forbes magazine tested four of the most popular handsets running Google's operating systems and Apple's iPhone to see how easy it'd be to break into them with a 3D-printed head. All of the Android handsets opened with the fake. Apple's phone, however, was impenetrable. From the report: For our tests, we used my own real-life head to register for facial recognition across five phones. An iPhone X and four Android devices: an LG G7 Linq, a Samsung S9, a Samsung Note 8 and a OnePlus 6. I then held up my fake head to the devices to see if the device would unlock. For all four Android phones, the spoof face was able to open the phone, though with differing degrees of ease. The iPhone X was the only one to never be fooled. There were some disparities between the Android devices' security against the hack. For instance, when first turning on a brand new G7 Linq, LG actually warns the user against turning facial recognition on at all. No surprise then that, on initial testing, the 3D-printed head opened it straightaway. [...] The OnePlus 6 came with neither the warnings of the other Android phones nor the choice of slower but more secure recognition.' -- source: https://apple.slashdot.org/story/18/12/13/1438218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel Developers Discuss Dropping x32 Support
by Peter Reutemann 12 Dec '18

12 Dec '18

'It was just several years ago that the open-source ecosystem began supporting the x32 ABI, but already kernel developers are talking of potentially deprecating the support and for it to be ultimately removed.. [...] While the x32 support was plumbed through the Linux landscape, it really hasn't been used much. Kernel developers are now discussing the future of the x32 ABI due to the maintenance cost involved in still supporting this code but with minimal users. Linus Torvalds is in favor of sunsetting x32 and many other upstream contributors in favor of seeing it deprecated and removed.' -- source: https://linux.slashdot.org/story/18/12/12/1336210 More information on x32 ABI: https://en.wikipedia.org/wiki/X32_ABI Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Getting Shown Pregnancy Ads After Child Was Stillborn
by Lawrence D'Oliveiro 12 Dec '18

12 Dec '18

An op-ed on the pitfalls of algorithmically-targeted advertising, originally from the Washington Post <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121760…>: Please, Tech Companies, I implore you: If your algorithms are smart enough to realize that I was pregnant, or that I've given birth, then surely they can be smart enough to realize that my baby died, and advertise to me accordingly - or maybe, just maybe, not at all. Unfortunately, the old adage “if you’re not paying for the product, then you are the product” applies yet again. Notwithstanding a personal reply from a high-up Facebook exec at the end of the above article, don’t expect these algorithms to be “smart enough” to do anything more than maximize advertising revenue. Anything more ends up counting as “unnecessary expenditure”.

2 1

FreeBSD 12 Released
by Peter Reutemann 12 Dec '18

12 Dec '18

'The 12th version of the FreeBSD has been released, bringing support for updated hardware. Some of the highlights include: OpenSSL has been updated to version 1.1.1a (LTS). Unbound has been updated to version 1.8.1, and DANE-TA has been enabled by default. OpenSSH has been updated to version 7.8p1. Additonal capsicum(4) support has been added to sshd(8). Clang, LLVM, LLD, LLDB, compiler-rt and libc++ has been updated to version 6.0.1. The vt(4) Terminus BSD Console font has been updated to version 4.46. The bsdinstall(8) utility now supports UEFI+GELI as an installation option. The VIMAGE kernel configuration option has been enabled by default. The NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations. The netdump(4) driver has been added, providing a facility through which kernel crash dumps can be transmitted to a remote host after a system panic. The vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster. Various improvements to graphics support for current generation hardware. Support for capsicum(4) has been enabled on armv6 and armv7 by default. The UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously. The NFS version 4.1 server has been updated to include pNFS server support. The pf(4) packet filter is now usable within a jail(8) using vnet(9). The bhyve(8) utility has been updated to add NVMe device emulation. The bhyve(8) utility is now able to be run within a jail(8). Various Lua loader(8) improvements. KDE has been updated to version 5.12.' -- source: https://bsd.slashdot.org/story/18/12/12/1510202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Could NZ Get Its Own “Assistance and Access” Law?
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

The ever-perceptive Juha Saarinen gives his commentary <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121750…> on the law recently passed in Australia to compel access to decrypted forms of encrypted communications. Thanks to the new law requiring them to quietly add that backdoor that mustn't be called a backdoor into their code, Aussie developers can no longer be trusted by their international peers. You can't say no when government agencies issue a notice, saying absolutely do not tell your employer about it or you'll cop a hefty punishment. But the law is not supposed to achieve this by introducing “systemic weaknesses” into the encryption. Can you use that as a defence against having to weaken the encryption? Not a chance. The not-so-fine irony is that the Aussie Government is doing the same thing it alleges the Chinese spies would force Huawei to do, and which was considered dangerous enough to ban the telco equipment vendor from national communications networks. This gets pointed out repeatedly about similar discussions in the US, UK etc. But there seems to be a mentality among politicians, law enforcement, spies etc that “we’re the good guys, they’re the bad guys, therefore what we do cannot be classed in the same league as what they do”. Forgetting that what makes us good is that we don’t act like bad guys. And the kicker: The risk now is that other Five-Eyes countries, including New Zealand, follow Australia into making the same monumental mistake. What are the odds?

1 0

New Firefox Suggests Ways To Get More Out of the Web
by Peter Reutemann 11 Dec '18

11 Dec '18

'Starting Tuesday, Firefox will nudge you to try out options designed to make the web more interesting, more useful or more productive. From a report: Mozilla's new Firefox 64 keeps an eye on what you're up to and prompts you to try extensions and features that could help you with that activity, the browser maker said. For example, if you open the same tab lots of times, it could suggest you pin it to your tab strip for easier future access. Other suggestions include installing the Facebook Container extension to curtail the social network's snooping, a Google Translate extension to tap into Google's service, and the Enhancer for YouTube extension to do things like block ads and control playback on Google's video site. The feature could help you customize Firefox more to your liking -- something that could help you stick with the browser in the face of Google Chrome's dominance. And that, in turn, could help Mozilla pursue its push toward a privacy-respecting web that's not just effectively controlled by Chrome.' -- source: https://news.slashdot.org/story/18/12/11/1756217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Super Micro Says Review Found No Malicious Chips in Motherboards
by Peter Reutemann 11 Dec '18

11 Dec '18

'Computer hardware maker Super Micro Computer told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards. >From a report: In a letter to customers, the San Jose, California, company said it was not surprised by the result of the review it commissioned in October after a Bloomberg article reported that spies for the Chinese government had tainted Super Micro equipment to eavesdrop on its clients.' -- source: https://hardware.slashdot.org/story/18/12/11/1410200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Trojan Steals Money From PayPal Accounts Even With 2FA On
by Peter Reutemann 11 Dec '18

11 Dec '18

'ESET researchers have discovered a new Android Trojan using a novel Accessibility-abusing technique that targets the official PayPal app, and is capable of bypassing PayPal's two-factor authentication. A report elaborates: At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores. After being launched, the malicious app terminates without offering any functionality and hides its icon. This video, courtesy of ESET, demonstrates the process in practice.' -- source: https://it.slashdot.org/story/18/12/11/1722251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Fixes Notepad
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Windows Notepad has never been able to handle any newline convention other than the old DOS/Windows/CP/M one (CR-LF). Now, after so many decades, Microsoft has finally decided to give it “universal newline” capability, so it can handle lines ending in LF-only (Unix/Linux) and CR-only (old MacOS) <http://www.theregister.co.uk/2018/05/08/windows_notepad_unix_macos_line_end…>. Gee, I wonder how many lines of code that took...

2 2

No, I Didn’t Know That
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Would you believe, malware can make money by generating fake clicks on ads? Would you further believe, that ad networks pay more for clicks from Apple devices than from Android? Can you guess what happens next? <https://www.theregister.co.uk/2018/12/10/android_ios_clickfraud/>

1 0

Presentations using the Waikato Uni video projector - Console windows font size.
by Ian Stewart 11 Dec '18

11 Dec '18

Hi, This is mostly a memo to myself as I have twice been caught out with Linux consoles being displayed with too small a font on the Uni video projector. However the following may also be useful to other presenters in the future. Most wlug presentations are done with a Linux laptop or PC running in a GUI Environment that is connected to the video projector. If you open a GUI console terminal window or web-browser window and the video projector display is difficult to read, then you can increase the size with the keystroke sequence Control + Shift + Plus, or decrease the size with Control + Minus. Linux also has 6 x console windows available. The keystroke sequence Ctrl + Alt + F1 opens tty1 console, through to Ctrl + Alt + F6 opening tty6 console. Note that Ctrl + Alt + F7 returns you to the laptops GUI environment. As your laptop/pc is likely to auto-size to the resolution of the video projector, then I think your laptop will opt to displaying the 1080p resolution of 1920 x 1080 pixels. By default your Linux consoles are likely to be configured to display a "Fixed" font of "8x16". When you display your console window with the video projector then one page of the display will be about 60 lines of text with 200 characters across the page. This is almost impossible to read on the projector screen. One way to overcome this problem this is to edit... /etc/default/console-setup You will see... FONTFACE="Fixed" FONTSIZE="8x16" At the bottom of the file add something like... # For Waikato University Video Projector # Choices of Fontsize with Terminus font: # 6x12, 8x14, 8x16, 10x20, 11x22, 12x24, 14x28, 16x32 FONTFACE="Terminus" FONTSIZE="14x28" ...save the changes to the console-setup file and execute... $ setupcon The console displayed should now be about 35 rows by 80 character cells, and should allow everyone to read what is displayed. cheers, Ian. PS: Another approach to making these changes is... $ dpkg-reconfigure console-setup ...this will step through 4 x graphical input screens. From these screens select "Terminus" as the Font and the "14x28" as the Font size. To restore to the original settings run dpkg-reconfigure console-setup again and select "Fixed" and "8x16".

1 0

Malicious Sites Abuse 11-Year-Old Firefox Bug That Mozilla Failed To Fix
by Peter Reutemann 11 Dec '18

11 Dec '18

'Malware authors, ad farmers, and scammers are abusing a Firefox bug to trap users on malicious sites. From a report: This wouldn't be a big deal, as the web is fraught with this kind of malicious sites, but these websites aren't abusing some new never-before-seen trick, but a Firefox bug that Mozilla engineers appear to have failed to fix in the 11 years ever since it was first reported back in April 2007. The bug narrows down to a malicious website embedding an iframe inside their source code. The iframe makes an HTTP authentication request on another domain. [...] For the past few years, malware authors, ad farmers, and scammers have been abusing this bug to lure users on sites where they show all sorts of nasties, such as tech support scams, ad farms that reload the page with new ads in a loop, pages that push users to buy fake gift cards, or sites that offer malware-laced software updates. Whenever users try to leave, the owners of these shady sites trigger the authentification modal in a loop.' -- source: https://news.slashdot.org/story/18/12/10/0220258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ESET Discovers 21 New Linux Malware Families
by Peter Reutemann 11 Dec '18

11 Dec '18

'In a report published last week by cyber-security firm ESET, the company detailed 21 "new" Linux malware families. All operate in the same manner, as trojanized versions of the OpenSSH client. From a report: They are developed as second-stage tools to be deployed in more complex "botnet" schemes. Attackers would compromise a Linux system, usually a server, and then replace the legitimate OpenSSH installation with one of the trojanized versions.' -- source: https://linux.slashdot.org/story/18/12/10/1538203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Faxes To Be Banned At The NHS
by Lawrence D'Oliveiro 10 Dec '18

10 Dec '18

The UK’s National Health Service is being forced to phase out its heavy reliance on fax machines <https://www.theregister.co.uk/2018/12/10/hancock_fax_ban_nhs/> and resort to more, um, “digital” alternatives like e-mail instead: However, it's worth noting that just last week, up to 1.2 million staffers were locked out of their NHSmail accounts after Accenture reportedly botched a data centre upgrade. [Helen Stokes-Lampard, chair of the Royal College of General Practitioners] raised similar concerns about the resilience of the IT systems the NHS is racing to introduce. "What's shocking is how often digital innovations fall over," she said. "It doesn't mean we shouldn’t do it, but what it does mean is we have to be realistic about with the time scales for this."

1 0