- wlug - list.wlug.org.nz

Chrome 69 Arrives With Revamped Design, More Powerful Omnibox, and Better Password Manager
by Peter Reutemann 04 Sep '18

04 Sep '18

'Google today launched Chrome 69 for Windows, Mac, and Linux, Android, and iOS, just a few days after the browser's 10-year anniversary. The release includes a new design, more powerful omnibox, updated password manager, more accurate autofill, plenty of developer-specific changes, and a slew of security improvements. You can update to the latest version now using Chrome's built-in updater, download it directly from google.com/chrome, or grab it from Google Play and Apple's App Store.' -- source: https://tech.slashdot.org/story/18/09/04/1711250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MikroTik Routers Are Forwarding Owners' Traffic To Unknown Attackers
by Peter Reutemann 04 Sep '18

04 Sep '18

'Attackers have been exploiting vulnerabilities in MikroTik routers to forward network traffic to a handful of IP addresses under their control. "The bug is in Winbox management component and allows a remote attacker to bypass authentication and read arbitrary files," reports Bleeping Computer. "Exploit code is freely available from at least three sources from at least three sources." From the report: 360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses. According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations. "37.1.207.114 is the top player among all the attackers. A significant number of devices have their traffic going to this destination," Qihoo experts inform. The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs. ' -- source: https://it.slashdot.org/story/18/09/04/2116202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Do Spectre/Meltdown Fixes Affect The Linux Kernel?
by Peter Reutemann 01 Sep '18

01 Sep '18

'"Using the newly minted Linux 4.19 feature code, fresh benchmarks were carried out looking at the performance cost of Spectre/Meltdown/Foreshadow mitigations on Intel Xeon v. AMD EPYC CPUs," writes an anonymous Slashdot reader: Workloads affected by these CPU vulnerabilities mainly deal with I/O and frequent kernel calls while CPU bound tests are still found to be minimally impacted. When toggling these mitigations on Linux 4.19, Intel Xeon CPUs were found to be 10~15% slower with the default kernel while AMD EPYC CPUs dropped to about 5% slower.' -- source: https://linux.slashdot.org/story/18/09/01/1727238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Blocked Collaboration On Spectre/Meltdown Fixes, Says Linux Kernel Developer
by Peter Reutemann 01 Sep '18

01 Sep '18

'This week in Vancouver, Linux kernel developer Greg Kroah-Hartman criticized Intel's slow initial response to the Spectre and Meltdown bugs in a talk at the Open Source Summit North America. An anonymous reader quotes eWeek: Kroah-Hartman said that when Intel finally decided to tell Linux developers, the disclosure was siloed.... "Intel siloed SUSE, they siloed Red Hat, they siloed Canonical. They never told Oracle, and they wouldn't let us talk to each other." For an initial set of vulnerabilities, Kroah-Hartman said the different Linux vendors typically work together. However, in this case they ended up working on their own, and each came up with different solutions. "It really wasn't working, and a number of us kernel developers yelled at [Intel] and pleaded, and we finally got them to allow us to talk to each other the last week of December [2017]," he said. "All of our Christmas vacations were ruined. This was not good. Intel really messed up on this," Kroah-Hartman said... "The majority of the world runs Debian or they run their own kernel," Kroah-Hartman said. "Debian was not allowed to be part of the disclosure, so the majority of the world was caught with their pants down, and that's not good." To Intel's credit, Kroah-Hartman said that after Linux kernel developers complained loudly to the company in December 2017 and into January 2018, it fixed its disclosure process for future Meltdown- and Spectre-related vulnerabilities... "Intel has gotten better at this," he said. An interesting side effect of the Meltdown and Spectre vulnerabilities is that Linux and Windows developers are now working together, since both operating systems face similar risks from the CPU vulnerabilities. "Windows and Linux kernel developers now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," Kroah-Hartman said. "We are working well together. We have always wanted that."' -- source: https://it.slashdot.org/story/18/09/01/1736228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Bug Allows Geolocation Tracking of Users
by Peter Reutemann 30 Aug '18

30 Aug '18

'Researchers have discovered a weakness in all version of Android except 9, the most recent release, that can allow an attacker to gather sensitive information such as the MAC address and BSSID name and pinpoint the location of an affected device. The vulnerability is a result of the way that Android broadcasts device information to apps installed on a device. The operating system uses a mechanism known as an intent to send out information between processes or applications, and some of the information about the device's WiFi network interface sent via a pair of intents can be used by an attacker to track a device closely. A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.' -- source: https://yro.slashdot.org/story/18/08/30/1725225 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Dropbox Dropping Linux Support Says
by Peter Reutemann 29 Aug '18

29 Aug '18

'Jack Wallen, writing for TechRepublic: For a company to support Linux, they have to consider supporting: Multiple file systems, multiple distributions, multiple desktops, multiple init systems, multiple kernels. If you're an open source developer, focusing on a single distribution, that's not a problem. If you're a company that produces a product (and you stake your living on that product), those multiple points of entry do become a problem. Let's consider Adobe (and Photoshop). If Adobe wanted to port their industry-leading product to Linux, how do they do that? Do they spend the time developing support for ext4, btrfs, Ubuntu, Fedora, GNOME, Mate, KDE, systemd? You see how that might look from the eyes of any given company? It becomes even more complicated when companies consider how accustomed to the idea of "free" (as in beer) Linux users are. Although I am very willing to pay for software on Linux, it's a rare occasion that I do (mostly because I haven't found a piece of must-have software that has an associated cost). Few companies will support the Linux desktop when the act of supporting means putting that much time and effort into a product that a large cross-section of users might wind up unwilling to pay the price of admission. That's not to say every Linux user is unwilling to shell out the cost for a piece of software. But many won't.' -- source: https://linux.slashdot.org/story/18/08/29/0949228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The Linux Foundation Is Changing The Fabric Of Networking
by Peter Reutemann 29 Aug '18

29 Aug '18

'Will Townsend, a senior analyst at Moor Insights & Strategy research firm, writes: As it relates to networking, the Linux Foundation is currently focused on a number of projects that are bringing top networking vendors, operators, service providers, and users together. Among the top initiatives are the Open Network Automation Platform (ONAP) and Data Plane Development Kit (DPDK). In this article, I would like to dive into both of these initiatives and share my perspective on how each is transforming the nature of networking [Editor's note: the website may have auto-playing videos; an alternative link was not available]. It makes sense that ONAP's releases are named after global cities, considering the platform's growing global footprint. ONAP is aimed at bringing real-time automation and orchestration to both physical and virtualized network functions. The first release in the fall of 2017, named Amsterdam, delivered a unified architecture for providing closed-loop networking automation. The underlying framework ensured a level of modularity to facilitate future functionality as well as standards harmonization and critical upstream partner collaboration. Initial use cases centered on Voice Over LTE (VoLTE) services as well as Virtualized Consumer Premise Equipment (vCPE). Both are extremely cost disruptive from a deployment and management perspective and deliver enhanced service provider agility. What I find extremely compelling is that Amsterdam was only an eight-month development cycle from start to release. That's an amazing feat even in the fast-paced technology industry. [...] DPDK was an effort initially led by Intel at its inception nearly eight years ago, but became a part of the Linux Foundation back in 2017. At a high level, the technology accelerates packet processing workloads running on a variety of CPU architectures. DPDK is aimed at improving overall network performance, delivering enhanced encryption for improved security and optimizing lower latency applications that require lightning-fast response time. The transformative power of 5G networks lies in their potential to deliver low latency for applications such as augmented/virtual reality and self-driving cars -- DPDK will further extend that performance for next-generation wireless wide area networks. I had the opportunity recently to speak to project chair Jim St. Leger after the fifth DPDK release, and I was impressed with the depth and breadth of the open source project. Over 25 companies and 160 technologists are involved in advancing the effort. With the proliferation of data, cord cutting at home, and growing consumption of video over wired and wireless networks, high-quality compression techniques will dramatically improve performance and reliability. DPDK appears to be poised to contribute significantly to that effort.' -- source: https://linux.slashdot.org/story/18/08/29/1646231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

WireGuard VPN review: A new type of VPN offers serious advantages
by Peter Reutemann 29 Aug '18

29 Aug '18

'WireGuard is a new type of VPN that aims to be simpler to set up and maintain than current VPNs and to offer a higher degree of security. The software is free and open source—it's licensed GPLv2, the same license as the Linux kernel—which is always a big plus in my book. It's also designed to be easily portable between operating systems. All of that might lead you to ask: in a world that already has IPSEC, PPTP, L2TP, OpenVPN, and a bewildering array of proprietary SSL VPNs, do we need yet another type of VPN?' -- source: https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connectio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook, Apple and Microsoft Are Contributing To OpenStreetMap
by Peter Reutemann 28 Aug '18

28 Aug '18

'At the recently concluded State of the Map conference in Milan, teams from Microsoft, Apple and Facebook presented their projects, describing how they are working with communities. From a report: The Microsoft Open Maps team has recently released open data on building footprints in the US. Microsoft was among the first to release satellite imagery for use by OpenStreetMap and the images are now integrated into the default editor. It also has a community of mappers directly contributing to OpenStreetMap in Australia. Apple has an internal volunteer programme that has around 5,000 staff contributing to Missing Maps, they've released building data for France and Denmark, and are engaged with data improvement projects around the world. Facebook is exploring how artificial intelligence-assisted tracing can help to improve the quality of OpenStreetMap data in Thailand. DigitalGlobe has made its satellite imagery available under a licence that will allow it to be used by the OpenStreetMap community to improve their mapping efforts. Telenav launched OpenStreetCam to help collect openly-licensed street imagery and has now released open data and code to explore how machine learning can enable the images to be used to improve OpenStreetMap with stop signs and turn directions.' -- source: https://news.slashdot.org/story/18/08/27/2258229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi's PoE HAT Ships For $20, Tosses in a Free Fan
by Peter Reutemann 27 Aug '18

27 Aug '18

'Raspberry Pi is offering a Power-over-Ethernet HAT board for the RPi 3 Model B+ for $20 that ships with a small fan. Per blog LinuxGizmo, the "802.3af-compliant 'Raspberry Pi PoE HAT' allows delivery of up to 15W over the RPi 3 B+'s USB-based GbE port without reducing the port's up to 300Mbps bandwidth." From the report: The Raspberry Pi PoE HAT features a fully isolated switched-mode power supply with 37-57V DC, Class 2 input and 5V/2.5A DC output. The HAT connects to both the 40-pin header and a new PoE-specific 4-pin header introduced with the B+ located near the USB ports. To enable PoE, you need power sourcing equipment, which is either "provided by your network switch or with power injectors on an Ethernet cable," writes the foundation in a blog post.' -- source: https://hardware.slashdot.org/story/18/08/27/1916207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu and CentOS Are Undoing a GNOME Security Feature
by Peter Reutemann 27 Aug '18

27 Aug '18

'Current versions of Ubuntu and CentOS are disabling a security feature that was added to the GNOME desktop environment last year. The feature's name is Bubblewrap, which is a sandbox environment that the GNOME Project added to secure GNOME's thumbnail parsers in July 2017, with the release of GNOME 3.26. In recent years, security researchers have proven that thumbnail parses can be an attack vector [1, 2, 3]. Ubuntu Security Tech Lead Alex Murray said the Ubuntu team chose to disable Bubblewrap inside Ubuntu because they did not have the time to perform a security audit. Murray blamed the many CPU bugs (Spectre, Meltdown, etc.), which kept the team busy and prevented them to audit the feature.' -- source: https://news.slashdot.org/story/18/08/27/1815234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.19 Preparing Better CPU Security Mitigations, New EROFS File-System
by Peter Reutemann 27 Aug '18

27 Aug '18

'Linus Torvalds released on Sunday Linux 4.19-rc1 that he describes as a "fairly frustrating merge window" following the new features landing over the past two weeks. What does this "pretty big release" offer? Phoronix's Linux 4.19 feature overview sheds light on more Spectre CPU mitigations for x86/POWER/s390, the new EROFS read-only Android file-system, a Raspberry Pi voltage driver, ThinkPad calculator key support, an in-kernel GPS subsystem, the Google GASKET driver framework, virtual kernel mode-setting, Qualcomm Adreno 600 series support, and many other improvements.' -- source: https://linux.slashdot.org/story/18/08/26/2342240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smartphones From 11 OEMs, Including Google, Samsung, HTC, Lenovo and Sony, Vulnerable To Attacks Via Hidden AT Commands
by Peter Reutemann 26 Aug '18

26 Aug '18

'In massive and groundbreaking research, a team of eleven scientists from the University of Florida, Stony Brook University, and Samsung Research America, have looked into what types of AT commands, or the Hayes command set, are currently supported on modern Android devices. The research team analyzed over 2,000 Android firmware images from eleven Android OEMs such as ASUS, Google, HTC, Huawei, Lenovo, LG, LineageOS, Motorola, Samsung, Sony, and ZTE. They say they discovered that these devices support over 3,500 different types of AT commands, some of which grant access to very dangerous functions. These AT commands are all exposed via the phone's USB interface, meaning an attacker would have to either gain access to a user's device, or hide a malicious component inside USB docks, chargers, or charging stations. Once an attacker is connected via the USB to a target's phone, s/he can use one of the phone's secret AT commands to rewrite device firmware, bypass Android security mechanisms, exfiltrate sensitive device information, perform screen unlocks, or even inject touch events solely through the use of AT commands.' -- source: https://mobile.slashdot.org/story/18/08/26/1910246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

E-Life In NZ
by Lawrence D'Oliveiro 25 Aug '18

25 Aug '18

The Herald website <https://www.nzherald.co.nz/> seems to be having trouble matching some of its headlines with subheads today. From the front page: * Man Hospitalised After Stuffing 15 Hard-Boiled Eggs Up His Bottom How many of these 'only-in-Auckland' dates have you been on? * Lizzie Marvelly: Haters, Trolls And Their Vile Words Kim Kardashian West is 'really proud' of her weight loss. Here's how she did it. * Why Restaurants Hate You The little Prince is getting a well-rounded education at his $38,000 a year school. * Six Reasons Why Superwoman Sucks Italian chef advises home cooks to reach for the most expensive varieties. * Ex-Playboy Model Found Strangled In Her Home Kyle MacDonald on whether or not the term applies to our Prime Minister. Interestingly, all of these are from the “Lifestyle” section.

1 0

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Reworked Microcode Security Fix License No Longer Prohibits Benchmarking
by Peter Reutemann 23 Aug '18

23 Aug '18

'Intel has backtracked on the license for its latest microcode update that mitigates security vulnerabilities in its processors -- after the previous wording outlawed public benchmarking of the chips. The reason for Intel's insistence on a vow of silence is that -- even with the new microcode in place -- turning off hyper-threading is necessary to protect virtual machines from attack via Foreshadow -- and that move comes with a potential performance hit. Predictably, Intel's contractual omerta had the opposite effect and drew attention to the problem. "Performance is so bad on the latest Spectre patch that Intel had to prohibit publishing benchmarks," said Lucas Holt, MidnightBSD project lead, via Twitter. In response to the outcry, Intel subsequently said it would rewrite the licensing terms. And now the fix is in. Via Twitter, Imad Sousou, corporate VP and general manager of Intel Open Source Technology Center, on Thursday said: "We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here. As an active member of the open source community, we continue to welcome all feedback and thank the community." The reworked license no longer prohibits benchmarking. Long-time Slashdot reader and open-source pioneer, Bruce Perens, first brought Intel's microcode update to our attention. In a phone interview with The Register, Perens said he approved of the change. "This is a relatively innocuous license for proprietary software and it can be distributed in the non-free section of Debian, which is where is used to be, and it should be distributable by other Linux distributions," he said. "You can't expect every lawyer to understand CPUs. Sometimes they have to have a deep conversation with their technical people."' -- source: https://it.slashdot.org/story/18/08/23/2041206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Publishes Microcode Security Patches With No Benchmarks Or Profiling Allowed
by Peter Reutemann 23 Aug '18

23 Aug '18

'The Register reports that Debian is rejecting a new Intel microcode update because of a new license term prohibiting the use of the CPU for benchmarks and profiling. There is a new license term applied to the new microcode: "You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results."' -- source: https://linux.slashdot.org/story/18/08/22/2213233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0

Mozilla to Remove Legacy Firefox Add-Ons From Add-On Portal in Early October
by Peter Reutemann 22 Aug '18

22 Aug '18

'Mozilla announced today plans to remove all Firefox legacy add-ons from the official Mozilla add-ons portal in early October. From a report: The move comes after Mozilla updated the Firefox core to use a new add-ons system based on the Chrome-compatible WebExtensions API. This new add-ons API replaced Firefox's old XUL-based add-ons API in November 2017, with the release of Firefox 57. All Firefox legacy add-ons stopped working in Firefox 57, but Mozilla continued to support them in the Firefox Extended Support Release (ESR) 52 branch. Support for Firefox ESR 52 will end on September 5, in two weeks, meaning there won't be any official Firefox version that supports legacy add-ons anymore.' -- source: https://tech.slashdot.org/story/18/08/21/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 21 Aug '18

21 Aug '18

Hi everyone We have a meeting coming up on Monday: "Linux is Alexa's best mate" Brendon Ranum, owner of a voice driven highly automated accommodation business in Cambridge, discusses Alexa integration from a Linux User perspective. Brendon will bring along his collection of every Amazon Echo ever made (10 models), and talk about adding voice control in front of home automation, the pitfalls, and how a spare Raspberry Pi can be used to solve some of them. He will also demo creating and using Echo Skills, compare differences in features of the Echo's in different countries, and share how guests attitudes have changed over the last year using Alexa. Usually found leading large scale IT change & innovation overseas, Brendon never lost his passion for electrical and electronic engineering and love of shiny things. Come along and learn why someone would put 20 of these in a house! -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737178/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Exam Requires Microsoft Office 365, Laptops, No Chargers Allowed
by Lawrence D'Oliveiro 20 Aug '18

20 Aug '18

Some students are Botany Downs Secondary College are upset at their school’s requirements for them to set the NCEA Level 1 science exam <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12110032>. Their problem is with the ban on chargers, because the school says they cannot provide outlets for 450 students. So laptops have to have a 5-hour battery life to make it through the exam. Which leaves out older machines with batteries in less-than-tiptop condition. Would there be a problem allowing them spare batteries? (And temporary use of an outlet while switching over, to avoid the need to power down?) Come to think of it, do they know they can buy spare batteries?

1 0

Slides Worth Viewing
by Lawrence D'Oliveiro 15 Aug '18

15 Aug '18

Followed this link <https://twitter.com/thepacketrat/status/1029728686734565382> which doesn’t seem to relate to the article that included it, but which has some gems on IoT security worth repeating: Assumptions of Technological Manifest Destiny: 1. Technology is value-neutral and thus will automatically help everyone 2. Technology should be deployed as quickly as possible 3. History is uninteresting and unhelpful The Value of Scepticism In three words: Think before deploying. In two words: Think first. In one word: Don’t. Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? A: Because Keynote Speakers Make Bad Life Decisions And Are Poor Role Models.

1 0

Standardizing The Legalities Of Reporting Security Bugs
by Lawrence D'Oliveiro 03 Aug '18

03 Aug '18

Security researchers often find themselves in for a rough ride (legally speaking) when they try to report holes that they have found. This new effort <https://arstechnica.com/information-technology/2018/08/new-open-source-effo…> tries to put together a clear framework so everybody knows exactly where they stand. Of course, the next step is to get various organizations to adopt it.

1 0

Hāwera High School Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Some students have lost access to their coursework <https://www.theregister.co.uk/2018/08/02/new_zealand_school_hit_by_ransomwa…>.

1 0

Reddit Breached Via Two-Factor Authentication Vulnerability
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Two-factor authentication, using a phone call or SMS text as the second factor, seemed like such a neat idea. But it turned out to be far too easy to hack. And here’s the proof <https://arstechnica.com/information-technology/2018/08/password-breach-teac…>: The 2FA protecting the Reddit accounts, however, relied on OTPs sent through SMS messages, despite reports over the years (such as this one <https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-pr…>) that make it amply clear they are susceptible to interception. Seems like the only reasonable option for a second authentication factor is dedicated hardware security keys.

1 0

sudo Or su?
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Found this piece <https://www.pclinuxos.com/forum/index.php/topic,90479.0.html> in the PCLinuxOS forums, courtesy of a reader link from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>. Basically it says that “sudo”, when used “In The Manner Of the Buntus”, i.e. to be able to run arbitrary commands as root, is a bad idea. Instead, it should be carefully restricted to allow access only to functions needed by a particular user. To get blanket root access, it is better to use “su”, which means having a separate root password. Actually, it goes further than that: it decrees that anybody posting instructions on the PCLinuxOS forums involving “irresponsible” use of sudo (i.e. contrary to the philosophy above) is subject to having their posts deleted, being reprimanded, and ultimately having their account cancelled altogether. Thoughts?

3 2

UK’s National Cyber Security Centre Weighs In On Ubuntu
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Advice for both users and admins about Ubuntu 18.04 LTS <https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts>, from the arm of the GCHQ charged with looking after the security of the computers of ordinary mortals. Points out some gaps in software-only disk encryption, and recommends enabling Secure Boot, among a remarkable amount of other detail. Found from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>.

1 0

If You Buy Something, Do You Own It?
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

Raglan man Niall Darwin discovers that assurances by electric-car company Tesla’s own official representatives aren’t worth a darn. And so, the question needs to be asked for the hundredth or thousandth time: when you buy a consumer item with essential proprietary software at its heart, what actually do you own? <https://www.newshub.co.nz/home/new-zealand/2018/07/waikato-man-suing-tesla-…>

1 0

Now They Need To Fix The TV Sets ...
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

YouTube has adopted a more responsive page layout to cope with videos having different aspect ratios <https://arstechnica.com/gadgets/2018/07/youtube-picks-up-dark-mode-on-andro…>. To no-one’s surprise, this has annoyed a few people who have become accustomed to the old design. When 16:9 widescreen TVs were being conceived way back in the 1990s, the aim clearly was to allow us all to view cinematic movies full-screen, making maximum use of available screen area with minimal or no black bars. Nobody foresaw the widespread popularity of smartphones with built-in cameras, and of the common use of footage captured with such devices in TV broadcasts. But while such phones commonly have 16:9 screens and their cameras capture 16:9 footage, their users often hold them vertically, so the image ends up in just about the worst shape for display on a regular widescreen TV. There seems to be a common convention nowadays of filling in the gaps with blurred portions of the actual image -- which I agree looks less jarring than black bars. Hmmm ... there have been computer monitors that can be rotated to portrait or landscape orientations, with automatic adjustment of the display to match (aka “xrandr” <https://wiki.archlinux.org/index.php/xrandr>). Wouldn’t it be useful if a TV could do the same...?

1 0

Ubuntu 18.04.01 now released for most flavours
by Ian Stewart 30 Jul '18

30 Jul '18

Hi, A few days ago Ubuntu 18.04.01 was released for most flavours (e.g. Desktop, Server, Mate, Budgie, Kylin, Xubuntu, Kubuntu) You can get your flavour, in 32 or 64 bit, from here... https://www.ubuntu.com/download/desktop <https://www.ubuntu.com/download/desktop> http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/ <http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/> http://cdimage.ubuntu.com/ubuntu-mate/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntu-budgie/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntukylin/releases/18.04.1/release/ http://cdimage.ubuntu.com/xubuntu/releases/18.04.1/release/ http://cdimage.ubuntu.com/kubuntu/releases/18.04.1/release/ My understanding is that if you are running 16.04.xx LTS and you have enabled "Notify me of a new updated version of Ubuntu", then you should now start to get pop-up's prompting you to do an on-line update to 18.04.01. I'm hopeful that it will bring some stability to Mate that seemed to be lacking in 18.04.00. cheers, Ian.

1 0

Distrowatch review of Ubuntu MATE and Budgie 18.04
by Ian Young 30 Jul '18

30 Jul '18

This week's Distrowatch features Ubuntu MATE and Budgie for review. Not the usual reviewer and somewhat longer than most of the weekly distro reviews. Some faults found with the MATE version and to a lesser extent with Budgie. The laptop in use for testing only had 2GiB of RAM however which might account for some of the problems encountered. 4 GiB seems to be a bare minimum these days.

2 1

Intel Moving Away From Hyperthreading?
by Lawrence D'Oliveiro 27 Jul '18

27 Jul '18

Looks like Intel’s next-generation i7 product family will abandon hyperthreading in favour of increasing the core count. So while you will still be able to run 8 concurrent threads, each one gets its own core now. Also, it looks like Intel’s current fab technology is running out of steam, while the new one is a bit behind schedule. <https://arstechnica.com/gadgets/2018/07/leaked-benchmarks-show-intel-is-dro…>

1 0

Space Supercomputer Comes Up To First Birthday
by Lawrence D'Oliveiro 26 Jul '18

26 Jul '18

340 days ago, an HPE machine made up of two Apollo Intel x86 servers running RHEL was installed on the ISS, without any radiation hardening or any other special hardware adaptation measures, apart from a “water-cool enclosure”. So far it has suffered only two complete outages, both triggered by loss of external power, not the failure of the machine itself. Though the software has apparently been picking up transient memory errors (not too surprising, really). <https://www.theregister.co.uk/2018/07/26/hpe_iss_supercomputer/>

1 0

Fwd: [NZLUG] Linux.conf.au Call for Papers.
by Peter Reutemann 25 Jul '18

25 Jul '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Michael Field <michael.field(a)concepts.co.nz> Date: Thu, Jul 26, 2018 at 9:58 AM Subject: [NZLUG] Linux.conf.au Call for Papers. To: "nzlug(a)lists.nzoss.org.nz" <nzlug(a)lists.nzoss.org.nz> I don’t know if anybody has posted that the Call for Proposals is open for Linux Conference Australia (in Chch this year) – they close on 30th July. See https://linux.conf.au/ if you want to submit Presentation / Tutorial / Miniconf. If accepted, you get free registration, speakers dinner ticket and so on. Mike *Michael Field* | *Senior Systems Engineer* *COMPUTER CONCEPTS LIMITED* <http://concepts.co.nz/> *P:* 03 348 2500 | *W:* concepts.co.nz 21 Durham Street South, Sydenham, Christchurch, New Zealand 8023 This email and any attachments are confidential. They may contain privileged information or copyright material. If you are not an intended recipient, you should not read, copy, use or disclose the contents without authorisation and we request you contact us at once by return email. Please then delete the email and any attachments from your system. We do not accept liability in connection with computer viruses, data corruption, delay, interruption, unauthorised access or unauthorised amendment. Any views expressed in this email and any attachments do not necessarily reflect the views of the company. _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Security Flaw Could Let Nearby Attacker Grab Your Private Data
by Peter Reutemann 24 Jul '18

24 Jul '18

'A recently discovered bug in many Bluetooth firmware and OS drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices. Researchers at the Israel Institute of Technology discovered the flaw, which was flagged today by Carnegie Mellon University CERT. It affects Bluetooth's Secure Simple Pairing and Low Energy Secure Connections. ZDNet reports: As the CERT notification explains, the vulnerability is caused by some vendors' Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel. This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and "passively intercept and decrypt all device messages, and/or forge and inject malicious messages." Thankfully, patches are on the way. "Intel recommended users upgrade to the latest support driver and to check with vendors if they have provided one in their respective updates," reports ZDNet. "Dell has released a new driver for the Qualcomm driver it uses while Lenovo's update is for the flaw in Intel software. LG and Huawei have referenced fixes for CVE-2018-5383 in their respective July updates for mobile devices." It is not yet known if Android, Google, or the Linux kernel are affected. Apple has released a patch for the flaw earlier this month.' -- source: https://it.slashdot.org/story/18/07/24/2121215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReactOS 0.4.9 Is Entirely Self-Hosting, Fixes FastFAT Crashes
by Peter Reutemann 24 Jul '18

24 Jul '18

'ReactOS, the "free Windows clone" operating system, has pushed out ReactOS 0.4.9 just recently, which brings a whole slew of improvements. With this latest 0.4.9 version, ReactOS has become entirely self-hosting without any issues, which means ReactOS can fully build itself from within itself, it does not require any third-party operating system to compile ReactOS. Self-hosting was built into older ReactOS versions, but it came with a myriad of issues -- the system would become too stressed under memory usage and storage I/O loads. This was due to a flawed NT-compliant kernel. Additional improvements in ReactOS 0.4.9 include overall stability and performance enhancements. The hardware abstraction layer and the FastFAT drivers received significant attention, and FastFAT should no longer eat through the cache so fast it causes system crashes due to resource leakage. FastFAT has also been rewritten to trigger a "chkdsk" repair on dirty / corrupt volumes during boot detections. Some other quality improvements are the addition of a built-in zipfldr extension -- ReactOS can now natively unpackage zipped archives, without the need of a third-party tool like WinZip.' -- source: https://news.slashdot.org/story/18/07/24/0139247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Encryption Push, Chrome Flags HTTP Sites as 'Not Secure'
by Peter Reutemann 24 Jul '18

24 Jul '18

'On Tuesday, Chrome started marking sites that don't use HTTPS as "not secure." From a report: First announced two years ago, Google said it would flag any site that still uses unencrypted HTTP to deliver its content in the latest version of Chrome, out Tuesday. It's part of the company's years-long effort effort to gradually nudge more webmasters and site owners into adopting HTTPS, a secure encryption standard for data in transit. Any site that doesn't load with green padlock or a "secure" message in the browser's address bar will be flagged -- and shamed -- as insecure. [...] According to nightly data compiled by security experts Troy Hunt and Scott Helme, roughly 100 of the top 500 websites are still serving their pages over unencrypted HTTP -- all of which will today be flagged as "insecure." Many of those sites -- like Baidu, JD.com, and Google.cn -- are Chinese language sites, but many popular Western sites -- including BBC.com, DailyMail.co.uk, and Fedex.com -- are HTTP. Of the top million sites, a little over half do not redirect to HTTPS. Chrome 68 also brings with it Page Lifecycle API, and the Payment Handler API. From a report: The Payment Handler API builds on the Payment Request API, which helped users check out online. The new API enables web-based payment apps to facilitate payments directly within the Payment Request experience, as seen above. As with every version, Chrome 68 includes an update to the V8 JavaScript engine: version 6.8. It reduces memory consumption as well as includes improvements to array destructuring, Object.assign, and TypedArray.prototype.sort. Check out the full list of changes for more information.' -- source: https://tech.slashdot.org/story/18/07/24/177207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Blocks Autoplaying Web Audio
by Peter Reutemann 24 Jul '18

24 Jul '18

'Mozilla's latest Nightly builds for Firefox now include an option to mute autoplaying audio. The feature was recently added to the Chrome browser, but Mozilla's update offers a few more options. According to Engadget, "You can turn the feature off entirely, force it to ask for permission, and make exceptions for specific sites." Keep in mind that these are nightly releases, so you will most likely run into some bugs. The "polished version" is likely weeks away.' -- source: https://news.slashdot.org/story/18/07/24/2055217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Detail New CPU Side-Channel Attack Named SpectreRSB
by Peter Reutemann 24 Jul '18

24 Jul '18

'"Scientists from the University of California, Riverside (UCR) have published details last week about a new Spectre-class attack that they call SpectreRSB," reports Bleeping Computer. "Just like all 'Spectre-class' attacks, SpectreRSB takes advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. The difference from previous Spectre-like attacks is that SpectreRSB recovers data from the speculative execution process by attacking a different CPU component involved in this 'speculation' routine, namely the Return Stack Buffer (RSB)." In a research paper, academics say they've used SpectreRSB attacks to recover data belonging to other processes, and have even tricked the RSB into spilling SGX secrets. The attack works on Intel, AMD, and ARM processors, known to use RSB. The attack can also bypass all the mitigations put in place for the original Spectre/Meltdown flaws.' -- source: https://it.slashdot.org/story/18/07/23/2143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

None of Google's 85, 000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA
by Peter Reutemann 24 Jul '18

24 Jul '18

'Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. From the report: Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device). A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.' -- source: https://tech.slashdot.org/story/18/07/23/1944236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Publish New Software-Level Protections Against Spectre and Rowhammer Attacks
by Peter Reutemann 23 Jul '18

23 Jul '18

'Academics from multiple universities have announced fixes for two severe security flaws known as Spectre and Rowhammer. Both these fixes are at the software level, meaning they don't require CPU or RAM vendors to alter products, and could, in theory, be applied as basic software patches. The first of these new mitigation mechanisms was announced on Thursday, last week. A research team from Dartmouth College in New Hampshire says it created a fix for Spectre Variant 1 (CVE-2017-5753), a vulnerability discovered at the start of the year affecting modern CPUs. Their fix uses ELFbac, an in-house-developed Linux kernel patch that brings access control policies to runtime virtual memory accesses of Linux processes, at the level of ELF binary executables. [...] The second fix for a major flaw announced last week came on Saturday from the Systems and Network Security Group at VU Amsterdam. Researchers announced a new technique called ZebRAM that they said is a comprehensive software protection against Rowhammer attacks.' -- source: https://it.slashdot.org/story/18/07/23/1613217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 8.0 Released
by Peter Reutemann 22 Jul '18

22 Jul '18

'The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system. This release brings stability improvements, hundreds of bug fixes, and many new features. Some highlights of the NetBSD 8.0 release are: — USB stack rework, USB3 support added. — In-kernel audio mixer (audio_system(9)). — Reproducible builds — PaX MPROTECT (W^X) memory protection enforced by default — PaX ASLR enabled by default — Position independent executables by default [...] NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone.' -- source: https://linux.slashdot.org/story/18/07/21/2341255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Fifth Undocumented Cisco Backdoor Has Been Discovered
by Peter Reutemann 21 Jul '18

21 Jul '18

'Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer. An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization... Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.' -- source: https://tech.slashdot.org/story/18/07/21/2133202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jul '18

20 Jul '18

Hi everyone We have a meeting next Monday: "Tom Butz will bring his RaspberryPi to this meetup. After introducing RISCOS and how the Pi was born, he will give a short demo of RISCOS. He will also use Debian/Raspbian on the Pi and, among other things, demo web-browsing, email-checking, database handling with COBOL, playing games and videos. Instead of using an external display via HDMI, he will also show the use of a pop-on LCD screen." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737169/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Making the Windows Command Line a Lot Better
by Peter Reutemann 19 Jul '18

19 Jul '18

'Over the last few years, Microsoft has been working to improve the Windows console. Console windows now maximize properly, for example. In the olden days, hitting maximize would make the window taller but not wider. Today, the action will fill the whole screen, just like any other window. Especially motivated by the Windows subsystem for Linux, the console in Windows 10 supports 16 million colors and VT escape sequences, enabling much richer console output than has traditionally been possible on Windows. Microsoft is working to build a better console for Windows, one that we hope will open the door to the same flexibility and capabilities that Unix users have enjoyed for more than 40 years. The APIs seem to be in the latest Windows 10 Insider builds, though documentation is a little scarce for now. The command-line team is publishing a series of blog posts describing the history of the Windows command-line, and how the operating system's console works. The big reveal of the new API is coming soon, and with this, Windows should finally be able to have reliable, effective tabbed consoles, with emoji support, rich Unicode, and all the other things that the Windows console doesn't do... yet.' -- source: https://tech.slashdot.org/story/18/07/17/2028206 It's probably gonna get announced as "revolutionary"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

PC Sales Grow For A Change
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

The first year-on-year growth in quarterly PC shipments has happened in 6 years <https://arstechnica.com/gadgets/2018/07/pc-market-appears-to-have-grown-for…>. Interesting to compare the basis behind the two different figures quoted: excluding Chromebooks, but including tablets (whether running Windows or not), gives a figure of 1.4% increase (Gartner), while the converse gives 2.7% (IDC). In other words, Chromebooks are accounting for something like half that growth, possibly even more.

1 0

Python Creator Steps Down
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

Guido van Rossum, creator of Python and (up to now) “Benevolent Dictator For Life” over the Python project, has decided to relinquish that role <https://www.theregister.co.uk/2018/07/13/python_creator_guido_van_rossum_qu…>. The reason may have been building for a while, but the last straw seems to have been the controversy over this <https://www.python.org/dev/peps/pep-0572/> proposed new feature for Python, “assignment expressions”, using a new “:=” operator. Interestingly enough, back in the day, “:=” was the operator used for assignments in what they called “ALGOL-like” languages (which included Pascal). The use of “=” for assignment was a peculiarity of FORTRAN, and also adopted by C, from which it has spread (unfortunately, in my view) to be adopted in most newer, higher-level languages, like Perl and Python. In the “ALGOL-like” languages, “=” kept close to its mathematical meaning, namely a test for equality. But if “:=” becomes valid, how long before these “assignment expressions” become acceptable stand-alone, as assignment statements? Pity that “=” can never become the equality-test operator ... unless Python 4 provides some way to guard against writing expressions as statements that simply discard their value ...

1 0

AV1 is Well On Its Way To Becoming a Viable Alternative To Patented Video Codecs, Mozilla Says
by Peter Reutemann 12 Jul '18

12 Jul '18

'Here's a surprising fact: It costs money to watch video online, even on free sites like YouTube. That's because about 4 in 5 videos on the web today rely on a patented technology called the H.264 video codec. >From a report: It took years for companies to put this complex, global set of legal and business agreements in place, so H.264 web video works everywhere. Now, as the industry shifts to using more efficient video codecs, those businesses are picking and choosing which next-generation technologies they will support. The fragmentation in the market is raising concerns about whether our favorite web past-time, watching videos, will continue to be accessible and affordable to all. Over the last decade, several companies started building viable alternatives to patented video codecs. Mozilla worked on the Daala Project, Google released VP9, and Cisco created Thor for low-complexity videoconferencing. All these efforts had the same goal: to create a next-generation video compression technology that would make sharing high-quality video over the internet faster, more reliable, and less expensive. In 2015, Mozilla, Google, Cisco, and others joined with Amazon and Netflix and hardware vendors AMD, ARM, Intel, and NVIDIA to form AOMedia. As AOMedia grew, efforts to create an open video format coalesced around a new codec: AV1. AV1 is based largely on Google's VP9 code and incorporates tools and technologies from Daala, Thor, and VP10. Mozilla loves AV1 for two reasons: AV1 is royalty-free, so anyone can use it free of charge. Software companies can use it to build video streaming into their applications. Web developers can build their own video players for their sites. The second reason we love AV1 is that it delivers better compression technology than even high-efficiency codecs -- about 30% better, according to a Moscow State University study.' -- source: https://news.slashdot.org/story/18/07/11/2246221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Typeform Data Breach Hits A Little Close To Home
by Lawrence D'Oliveiro 12 Jul '18

12 Jul '18

A few days ago, Typeform, a company which specializes in online survey forms, reported <https://www.theregister.co.uk/2018/07/02/typeform_breach/> that someone had gained unauthorized access to one of its backups. This turned out to impact a remarkable variety of institutions using its services <https://www.theregister.co.uk/2018/07/03/hotel_chain_and_uk_political_party…> <https://www.theregister.co.uk/2018/07/04/typeform_breach_continued/>, though the listed ones all seem to be in the UK and Australia. Now, I read today in the Hamilton Press (issue of 11th July, i.e. today), on page 6, that the affected customers include the Hamilton City Council, Waikato District Council, and Waipā District Council. “About 2800 Waikato people” may have used the Typeform service to express views to these local bodies. Information that could have been leaked was “names, email addresses, and in some cases, phone numbers”. Hamilton City used the service to run 10 surveys between November 2014 and February 2018, and a total of 1941 people “may have been affected”; it has contacted them about the breach, and it doesn’t use Typeform any more. Waipā District has similarly contacted 125 participants in its surveys. (No mention of what action Waikato District is taking...)

1 0

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Peter Reutemann 11 Jul '18

11 Jul '18

'In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability—and came away with the contents of a US Air Force captain's computer. The purloined files from the captain—the officer in charge (OIC) of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit (AMU)at Creech Air Force Base, Nevada—included export-controlled information regarding Reaper drone maintenance. The hacker took the documents to a Dark Web marketplace, where he planned on selling them for a few hundred dollars. And it's there that analysts from Recorded Future, an information security threat intelligence company, discovered them. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago. Discoverable by searching Shodan for devices with Internet Protocol port 21 open and response text including "214-ADMIN_LOGIN," the vulnerability allowed attackers to compromise routers and then gain access to the local network. They could then either grab files passing over the network or gain access to devices on it.' -- source: https://arstechnica.com/information-technology/2018/07/year-old-router-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0