- wlug - list.wlug.org.nz

E-Life In NZ
by Lawrence D'Oliveiro 25 Aug '18

25 Aug '18

The Herald website <https://www.nzherald.co.nz/> seems to be having trouble matching some of its headlines with subheads today. From the front page: * Man Hospitalised After Stuffing 15 Hard-Boiled Eggs Up His Bottom How many of these 'only-in-Auckland' dates have you been on? * Lizzie Marvelly: Haters, Trolls And Their Vile Words Kim Kardashian West is 'really proud' of her weight loss. Here's how she did it. * Why Restaurants Hate You The little Prince is getting a well-rounded education at his $38,000 a year school. * Six Reasons Why Superwoman Sucks Italian chef advises home cooks to reach for the most expensive varieties. * Ex-Playboy Model Found Strangled In Her Home Kyle MacDonald on whether or not the term applies to our Prime Minister. Interestingly, all of these are from the “Lifestyle” section.

1 0

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Reworked Microcode Security Fix License No Longer Prohibits Benchmarking
by Peter Reutemann 23 Aug '18

23 Aug '18

'Intel has backtracked on the license for its latest microcode update that mitigates security vulnerabilities in its processors -- after the previous wording outlawed public benchmarking of the chips. The reason for Intel's insistence on a vow of silence is that -- even with the new microcode in place -- turning off hyper-threading is necessary to protect virtual machines from attack via Foreshadow -- and that move comes with a potential performance hit. Predictably, Intel's contractual omerta had the opposite effect and drew attention to the problem. "Performance is so bad on the latest Spectre patch that Intel had to prohibit publishing benchmarks," said Lucas Holt, MidnightBSD project lead, via Twitter. In response to the outcry, Intel subsequently said it would rewrite the licensing terms. And now the fix is in. Via Twitter, Imad Sousou, corporate VP and general manager of Intel Open Source Technology Center, on Thursday said: "We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here. As an active member of the open source community, we continue to welcome all feedback and thank the community." The reworked license no longer prohibits benchmarking. Long-time Slashdot reader and open-source pioneer, Bruce Perens, first brought Intel's microcode update to our attention. In a phone interview with The Register, Perens said he approved of the change. "This is a relatively innocuous license for proprietary software and it can be distributed in the non-free section of Debian, which is where is used to be, and it should be distributable by other Linux distributions," he said. "You can't expect every lawyer to understand CPUs. Sometimes they have to have a deep conversation with their technical people."' -- source: https://it.slashdot.org/story/18/08/23/2041206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Publishes Microcode Security Patches With No Benchmarks Or Profiling Allowed
by Peter Reutemann 23 Aug '18

23 Aug '18

'The Register reports that Debian is rejecting a new Intel microcode update because of a new license term prohibiting the use of the CPU for benchmarks and profiling. There is a new license term applied to the new microcode: "You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results."' -- source: https://linux.slashdot.org/story/18/08/22/2213233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0

Mozilla to Remove Legacy Firefox Add-Ons From Add-On Portal in Early October
by Peter Reutemann 22 Aug '18

22 Aug '18

'Mozilla announced today plans to remove all Firefox legacy add-ons from the official Mozilla add-ons portal in early October. From a report: The move comes after Mozilla updated the Firefox core to use a new add-ons system based on the Chrome-compatible WebExtensions API. This new add-ons API replaced Firefox's old XUL-based add-ons API in November 2017, with the release of Firefox 57. All Firefox legacy add-ons stopped working in Firefox 57, but Mozilla continued to support them in the Firefox Extended Support Release (ESR) 52 branch. Support for Firefox ESR 52 will end on September 5, in two weeks, meaning there won't be any official Firefox version that supports legacy add-ons anymore.' -- source: https://tech.slashdot.org/story/18/08/21/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 21 Aug '18

21 Aug '18

Hi everyone We have a meeting coming up on Monday: "Linux is Alexa's best mate" Brendon Ranum, owner of a voice driven highly automated accommodation business in Cambridge, discusses Alexa integration from a Linux User perspective. Brendon will bring along his collection of every Amazon Echo ever made (10 models), and talk about adding voice control in front of home automation, the pitfalls, and how a spare Raspberry Pi can be used to solve some of them. He will also demo creating and using Echo Skills, compare differences in features of the Echo's in different countries, and share how guests attitudes have changed over the last year using Alexa. Usually found leading large scale IT change & innovation overseas, Brendon never lost his passion for electrical and electronic engineering and love of shiny things. Come along and learn why someone would put 20 of these in a house! -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737178/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Exam Requires Microsoft Office 365, Laptops, No Chargers Allowed
by Lawrence D'Oliveiro 20 Aug '18

20 Aug '18

Some students are Botany Downs Secondary College are upset at their school’s requirements for them to set the NCEA Level 1 science exam <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12110032>. Their problem is with the ban on chargers, because the school says they cannot provide outlets for 450 students. So laptops have to have a 5-hour battery life to make it through the exam. Which leaves out older machines with batteries in less-than-tiptop condition. Would there be a problem allowing them spare batteries? (And temporary use of an outlet while switching over, to avoid the need to power down?) Come to think of it, do they know they can buy spare batteries?

1 0

Slides Worth Viewing
by Lawrence D'Oliveiro 15 Aug '18

15 Aug '18

Followed this link <https://twitter.com/thepacketrat/status/1029728686734565382> which doesn’t seem to relate to the article that included it, but which has some gems on IoT security worth repeating: Assumptions of Technological Manifest Destiny: 1. Technology is value-neutral and thus will automatically help everyone 2. Technology should be deployed as quickly as possible 3. History is uninteresting and unhelpful The Value of Scepticism In three words: Think before deploying. In two words: Think first. In one word: Don’t. Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? A: Because Keynote Speakers Make Bad Life Decisions And Are Poor Role Models.

1 0

Standardizing The Legalities Of Reporting Security Bugs
by Lawrence D'Oliveiro 03 Aug '18

03 Aug '18

Security researchers often find themselves in for a rough ride (legally speaking) when they try to report holes that they have found. This new effort <https://arstechnica.com/information-technology/2018/08/new-open-source-effo…> tries to put together a clear framework so everybody knows exactly where they stand. Of course, the next step is to get various organizations to adopt it.

1 0

Hāwera High School Hit By Ransomware Attack
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Some students have lost access to their coursework <https://www.theregister.co.uk/2018/08/02/new_zealand_school_hit_by_ransomwa…>.

1 0

Reddit Breached Via Two-Factor Authentication Vulnerability
by Lawrence D'Oliveiro 02 Aug '18

02 Aug '18

Two-factor authentication, using a phone call or SMS text as the second factor, seemed like such a neat idea. But it turned out to be far too easy to hack. And here’s the proof <https://arstechnica.com/information-technology/2018/08/password-breach-teac…>: The 2FA protecting the Reddit accounts, however, relied on OTPs sent through SMS messages, despite reports over the years (such as this one <https://arstechnica.com/information-technology/2017/05/thieves-drain-2fa-pr…>) that make it amply clear they are susceptible to interception. Seems like the only reasonable option for a second authentication factor is dedicated hardware security keys.

1 0

sudo Or su?
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Found this piece <https://www.pclinuxos.com/forum/index.php/topic,90479.0.html> in the PCLinuxOS forums, courtesy of a reader link from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>. Basically it says that “sudo”, when used “In The Manner Of the Buntus”, i.e. to be able to run arbitrary commands as root, is a bad idea. Instead, it should be carefully restricted to allow access only to functions needed by a particular user. To get blanket root access, it is better to use “su”, which means having a separate root password. Actually, it goes further than that: it decrees that anybody posting instructions on the PCLinuxOS forums involving “irresponsible” use of sudo (i.e. contrary to the philosophy above) is subject to having their posts deleted, being reprimanded, and ultimately having their account cancelled altogether. Thoughts?

3 2

UK’s National Cyber Security Centre Weighs In On Ubuntu
by Lawrence D'Oliveiro 01 Aug '18

01 Aug '18

Advice for both users and admins about Ubuntu 18.04 LTS <https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts>, from the arm of the GCHQ charged with looking after the security of the computers of ordinary mortals. Points out some gaps in software-only disk encryption, and recommends enabling Secure Boot, among a remarkable amount of other detail. Found from <https://www.theregister.co.uk/2018/08/01/ncsc_ubuntu/>.

1 0

If You Buy Something, Do You Own It?
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

Raglan man Niall Darwin discovers that assurances by electric-car company Tesla’s own official representatives aren’t worth a darn. And so, the question needs to be asked for the hundredth or thousandth time: when you buy a consumer item with essential proprietary software at its heart, what actually do you own? <https://www.newshub.co.nz/home/new-zealand/2018/07/waikato-man-suing-tesla-…>

1 0

Now They Need To Fix The TV Sets ...
by Lawrence D'Oliveiro 31 Jul '18

31 Jul '18

YouTube has adopted a more responsive page layout to cope with videos having different aspect ratios <https://arstechnica.com/gadgets/2018/07/youtube-picks-up-dark-mode-on-andro…>. To no-one’s surprise, this has annoyed a few people who have become accustomed to the old design. When 16:9 widescreen TVs were being conceived way back in the 1990s, the aim clearly was to allow us all to view cinematic movies full-screen, making maximum use of available screen area with minimal or no black bars. Nobody foresaw the widespread popularity of smartphones with built-in cameras, and of the common use of footage captured with such devices in TV broadcasts. But while such phones commonly have 16:9 screens and their cameras capture 16:9 footage, their users often hold them vertically, so the image ends up in just about the worst shape for display on a regular widescreen TV. There seems to be a common convention nowadays of filling in the gaps with blurred portions of the actual image -- which I agree looks less jarring than black bars. Hmmm ... there have been computer monitors that can be rotated to portrait or landscape orientations, with automatic adjustment of the display to match (aka “xrandr” <https://wiki.archlinux.org/index.php/xrandr>). Wouldn’t it be useful if a TV could do the same...?

1 0

Ubuntu 18.04.01 now released for most flavours
by Ian Stewart 30 Jul '18

30 Jul '18

Hi, A few days ago Ubuntu 18.04.01 was released for most flavours (e.g. Desktop, Server, Mate, Budgie, Kylin, Xubuntu, Kubuntu) You can get your flavour, in 32 or 64 bit, from here... https://www.ubuntu.com/download/desktop <https://www.ubuntu.com/download/desktop> http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/ <http://cdimage.ubuntu.com/ubuntu/releases/18.04.1/release/> http://cdimage.ubuntu.com/ubuntu-mate/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntu-budgie/releases/18.04.1/release/ http://cdimage.ubuntu.com/ubuntukylin/releases/18.04.1/release/ http://cdimage.ubuntu.com/xubuntu/releases/18.04.1/release/ http://cdimage.ubuntu.com/kubuntu/releases/18.04.1/release/ My understanding is that if you are running 16.04.xx LTS and you have enabled "Notify me of a new updated version of Ubuntu", then you should now start to get pop-up's prompting you to do an on-line update to 18.04.01. I'm hopeful that it will bring some stability to Mate that seemed to be lacking in 18.04.00. cheers, Ian.

1 0

Distrowatch review of Ubuntu MATE and Budgie 18.04
by Ian Young 30 Jul '18

30 Jul '18

This week's Distrowatch features Ubuntu MATE and Budgie for review. Not the usual reviewer and somewhat longer than most of the weekly distro reviews. Some faults found with the MATE version and to a lesser extent with Budgie. The laptop in use for testing only had 2GiB of RAM however which might account for some of the problems encountered. 4 GiB seems to be a bare minimum these days.

2 1

Intel Moving Away From Hyperthreading?
by Lawrence D'Oliveiro 27 Jul '18

27 Jul '18

Looks like Intel’s next-generation i7 product family will abandon hyperthreading in favour of increasing the core count. So while you will still be able to run 8 concurrent threads, each one gets its own core now. Also, it looks like Intel’s current fab technology is running out of steam, while the new one is a bit behind schedule. <https://arstechnica.com/gadgets/2018/07/leaked-benchmarks-show-intel-is-dro…>

1 0

Space Supercomputer Comes Up To First Birthday
by Lawrence D'Oliveiro 26 Jul '18

26 Jul '18

340 days ago, an HPE machine made up of two Apollo Intel x86 servers running RHEL was installed on the ISS, without any radiation hardening or any other special hardware adaptation measures, apart from a “water-cool enclosure”. So far it has suffered only two complete outages, both triggered by loss of external power, not the failure of the machine itself. Though the software has apparently been picking up transient memory errors (not too surprising, really). <https://www.theregister.co.uk/2018/07/26/hpe_iss_supercomputer/>

1 0

Fwd: [NZLUG] Linux.conf.au Call for Papers.
by Peter Reutemann 25 Jul '18

25 Jul '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Michael Field <michael.field(a)concepts.co.nz> Date: Thu, Jul 26, 2018 at 9:58 AM Subject: [NZLUG] Linux.conf.au Call for Papers. To: "nzlug(a)lists.nzoss.org.nz" <nzlug(a)lists.nzoss.org.nz> I don’t know if anybody has posted that the Call for Proposals is open for Linux Conference Australia (in Chch this year) – they close on 30th July. See https://linux.conf.au/ if you want to submit Presentation / Tutorial / Miniconf. If accepted, you get free registration, speakers dinner ticket and so on. Mike *Michael Field* | *Senior Systems Engineer* *COMPUTER CONCEPTS LIMITED* <http://concepts.co.nz/> *P:* 03 348 2500 | *W:* concepts.co.nz 21 Durham Street South, Sydenham, Christchurch, New Zealand 8023 This email and any attachments are confidential. They may contain privileged information or copyright material. If you are not an intended recipient, you should not read, copy, use or disclose the contents without authorisation and we request you contact us at once by return email. Please then delete the email and any attachments from your system. We do not accept liability in connection with computer viruses, data corruption, delay, interruption, unauthorised access or unauthorised amendment. Any views expressed in this email and any attachments do not necessarily reflect the views of the company. _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Security Flaw Could Let Nearby Attacker Grab Your Private Data
by Peter Reutemann 24 Jul '18

24 Jul '18

'A recently discovered bug in many Bluetooth firmware and OS drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices. Researchers at the Israel Institute of Technology discovered the flaw, which was flagged today by Carnegie Mellon University CERT. It affects Bluetooth's Secure Simple Pairing and Low Energy Secure Connections. ZDNet reports: As the CERT notification explains, the vulnerability is caused by some vendors' Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel. This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and "passively intercept and decrypt all device messages, and/or forge and inject malicious messages." Thankfully, patches are on the way. "Intel recommended users upgrade to the latest support driver and to check with vendors if they have provided one in their respective updates," reports ZDNet. "Dell has released a new driver for the Qualcomm driver it uses while Lenovo's update is for the flaw in Intel software. LG and Huawei have referenced fixes for CVE-2018-5383 in their respective July updates for mobile devices." It is not yet known if Android, Google, or the Linux kernel are affected. Apple has released a patch for the flaw earlier this month.' -- source: https://it.slashdot.org/story/18/07/24/2121215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ReactOS 0.4.9 Is Entirely Self-Hosting, Fixes FastFAT Crashes
by Peter Reutemann 24 Jul '18

24 Jul '18

'ReactOS, the "free Windows clone" operating system, has pushed out ReactOS 0.4.9 just recently, which brings a whole slew of improvements. With this latest 0.4.9 version, ReactOS has become entirely self-hosting without any issues, which means ReactOS can fully build itself from within itself, it does not require any third-party operating system to compile ReactOS. Self-hosting was built into older ReactOS versions, but it came with a myriad of issues -- the system would become too stressed under memory usage and storage I/O loads. This was due to a flawed NT-compliant kernel. Additional improvements in ReactOS 0.4.9 include overall stability and performance enhancements. The hardware abstraction layer and the FastFAT drivers received significant attention, and FastFAT should no longer eat through the cache so fast it causes system crashes due to resource leakage. FastFAT has also been rewritten to trigger a "chkdsk" repair on dirty / corrupt volumes during boot detections. Some other quality improvements are the addition of a built-in zipfldr extension -- ReactOS can now natively unpackage zipped archives, without the need of a third-party tool like WinZip.' -- source: https://news.slashdot.org/story/18/07/24/0139247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

In Encryption Push, Chrome Flags HTTP Sites as 'Not Secure'
by Peter Reutemann 24 Jul '18

24 Jul '18

'On Tuesday, Chrome started marking sites that don't use HTTPS as "not secure." From a report: First announced two years ago, Google said it would flag any site that still uses unencrypted HTTP to deliver its content in the latest version of Chrome, out Tuesday. It's part of the company's years-long effort effort to gradually nudge more webmasters and site owners into adopting HTTPS, a secure encryption standard for data in transit. Any site that doesn't load with green padlock or a "secure" message in the browser's address bar will be flagged -- and shamed -- as insecure. [...] According to nightly data compiled by security experts Troy Hunt and Scott Helme, roughly 100 of the top 500 websites are still serving their pages over unencrypted HTTP -- all of which will today be flagged as "insecure." Many of those sites -- like Baidu, JD.com, and Google.cn -- are Chinese language sites, but many popular Western sites -- including BBC.com, DailyMail.co.uk, and Fedex.com -- are HTTP. Of the top million sites, a little over half do not redirect to HTTPS. Chrome 68 also brings with it Page Lifecycle API, and the Payment Handler API. From a report: The Payment Handler API builds on the Payment Request API, which helped users check out online. The new API enables web-based payment apps to facilitate payments directly within the Payment Request experience, as seen above. As with every version, Chrome 68 includes an update to the V8 JavaScript engine: version 6.8. It reduces memory consumption as well as includes improvements to array destructuring, Object.assign, and TypedArray.prototype.sort. Check out the full list of changes for more information.' -- source: https://tech.slashdot.org/story/18/07/24/177207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Blocks Autoplaying Web Audio
by Peter Reutemann 24 Jul '18

24 Jul '18

'Mozilla's latest Nightly builds for Firefox now include an option to mute autoplaying audio. The feature was recently added to the Chrome browser, but Mozilla's update offers a few more options. According to Engadget, "You can turn the feature off entirely, force it to ask for permission, and make exceptions for specific sites." Keep in mind that these are nightly releases, so you will most likely run into some bugs. The "polished version" is likely weeks away.' -- source: https://news.slashdot.org/story/18/07/24/2055217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Detail New CPU Side-Channel Attack Named SpectreRSB
by Peter Reutemann 24 Jul '18

24 Jul '18

'"Scientists from the University of California, Riverside (UCR) have published details last week about a new Spectre-class attack that they call SpectreRSB," reports Bleeping Computer. "Just like all 'Spectre-class' attacks, SpectreRSB takes advantage of the process of speculative execution -- a feature found in all modern CPUs that has the role of improving performance by computing operations in advance and later discarding unneeded data. The difference from previous Spectre-like attacks is that SpectreRSB recovers data from the speculative execution process by attacking a different CPU component involved in this 'speculation' routine, namely the Return Stack Buffer (RSB)." In a research paper, academics say they've used SpectreRSB attacks to recover data belonging to other processes, and have even tricked the RSB into spilling SGX secrets. The attack works on Intel, AMD, and ARM processors, known to use RSB. The attack can also bypass all the mitigations put in place for the original Spectre/Meltdown flaws.' -- source: https://it.slashdot.org/story/18/07/23/2143259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

None of Google's 85, 000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA
by Peter Reutemann 24 Jul '18

24 Jul '18

'Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. From the report: Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device). A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.' -- source: https://tech.slashdot.org/story/18/07/23/1944236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Academics Publish New Software-Level Protections Against Spectre and Rowhammer Attacks
by Peter Reutemann 23 Jul '18

23 Jul '18

'Academics from multiple universities have announced fixes for two severe security flaws known as Spectre and Rowhammer. Both these fixes are at the software level, meaning they don't require CPU or RAM vendors to alter products, and could, in theory, be applied as basic software patches. The first of these new mitigation mechanisms was announced on Thursday, last week. A research team from Dartmouth College in New Hampshire says it created a fix for Spectre Variant 1 (CVE-2017-5753), a vulnerability discovered at the start of the year affecting modern CPUs. Their fix uses ELFbac, an in-house-developed Linux kernel patch that brings access control policies to runtime virtual memory accesses of Linux processes, at the level of ELF binary executables. [...] The second fix for a major flaw announced last week came on Saturday from the Systems and Network Security Group at VU Amsterdam. Researchers announced a new technique called ZebRAM that they said is a comprehensive software protection against Rowhammer attacks.' -- source: https://it.slashdot.org/story/18/07/23/1613217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NetBSD 8.0 Released
by Peter Reutemann 22 Jul '18

22 Jul '18

'The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system. This release brings stability improvements, hundreds of bug fixes, and many new features. Some highlights of the NetBSD 8.0 release are: — USB stack rework, USB3 support added. — In-kernel audio mixer (audio_system(9)). — Reproducible builds — PaX MPROTECT (W^X) memory protection enforced by default — PaX ASLR enabled by default — Position independent executables by default [...] NetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone.' -- source: https://linux.slashdot.org/story/18/07/21/2341255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Fifth Undocumented Cisco Backdoor Has Been Discovered
by Peter Reutemann 21 Jul '18

21 Jul '18

'Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer. An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization... Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.' -- source: https://tech.slashdot.org/story/18/07/21/2133202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday
by Peter Reutemann 20 Jul '18

20 Jul '18

Hi everyone We have a meeting next Monday: "Tom Butz will bring his RaspberryPi to this meetup. After introducing RISCOS and how the Pi was born, he will give a short demo of RISCOS. He will also use Debian/Raspbian on the Pi and, among other things, demo web-browsing, email-checking, database handling with COBOL, playing games and videos. Instead of using an external display via HDMI, he will also show the use of a pop-on LCD screen." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737169/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Making the Windows Command Line a Lot Better
by Peter Reutemann 19 Jul '18

19 Jul '18

'Over the last few years, Microsoft has been working to improve the Windows console. Console windows now maximize properly, for example. In the olden days, hitting maximize would make the window taller but not wider. Today, the action will fill the whole screen, just like any other window. Especially motivated by the Windows subsystem for Linux, the console in Windows 10 supports 16 million colors and VT escape sequences, enabling much richer console output than has traditionally been possible on Windows. Microsoft is working to build a better console for Windows, one that we hope will open the door to the same flexibility and capabilities that Unix users have enjoyed for more than 40 years. The APIs seem to be in the latest Windows 10 Insider builds, though documentation is a little scarce for now. The command-line team is publishing a series of blog posts describing the history of the Windows command-line, and how the operating system's console works. The big reveal of the new API is coming soon, and with this, Windows should finally be able to have reliable, effective tabbed consoles, with emoji support, rich Unicode, and all the other things that the Windows console doesn't do... yet.' -- source: https://tech.slashdot.org/story/18/07/17/2028206 It's probably gonna get announced as "revolutionary"... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

PC Sales Grow For A Change
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

The first year-on-year growth in quarterly PC shipments has happened in 6 years <https://arstechnica.com/gadgets/2018/07/pc-market-appears-to-have-grown-for…>. Interesting to compare the basis behind the two different figures quoted: excluding Chromebooks, but including tablets (whether running Windows or not), gives a figure of 1.4% increase (Gartner), while the converse gives 2.7% (IDC). In other words, Chromebooks are accounting for something like half that growth, possibly even more.

1 0

Python Creator Steps Down
by Lawrence D'Oliveiro 13 Jul '18

13 Jul '18

Guido van Rossum, creator of Python and (up to now) “Benevolent Dictator For Life” over the Python project, has decided to relinquish that role <https://www.theregister.co.uk/2018/07/13/python_creator_guido_van_rossum_qu…>. The reason may have been building for a while, but the last straw seems to have been the controversy over this <https://www.python.org/dev/peps/pep-0572/> proposed new feature for Python, “assignment expressions”, using a new “:=” operator. Interestingly enough, back in the day, “:=” was the operator used for assignments in what they called “ALGOL-like” languages (which included Pascal). The use of “=” for assignment was a peculiarity of FORTRAN, and also adopted by C, from which it has spread (unfortunately, in my view) to be adopted in most newer, higher-level languages, like Perl and Python. In the “ALGOL-like” languages, “=” kept close to its mathematical meaning, namely a test for equality. But if “:=” becomes valid, how long before these “assignment expressions” become acceptable stand-alone, as assignment statements? Pity that “=” can never become the equality-test operator ... unless Python 4 provides some way to guard against writing expressions as statements that simply discard their value ...

1 0

AV1 is Well On Its Way To Becoming a Viable Alternative To Patented Video Codecs, Mozilla Says
by Peter Reutemann 12 Jul '18

12 Jul '18

'Here's a surprising fact: It costs money to watch video online, even on free sites like YouTube. That's because about 4 in 5 videos on the web today rely on a patented technology called the H.264 video codec. >From a report: It took years for companies to put this complex, global set of legal and business agreements in place, so H.264 web video works everywhere. Now, as the industry shifts to using more efficient video codecs, those businesses are picking and choosing which next-generation technologies they will support. The fragmentation in the market is raising concerns about whether our favorite web past-time, watching videos, will continue to be accessible and affordable to all. Over the last decade, several companies started building viable alternatives to patented video codecs. Mozilla worked on the Daala Project, Google released VP9, and Cisco created Thor for low-complexity videoconferencing. All these efforts had the same goal: to create a next-generation video compression technology that would make sharing high-quality video over the internet faster, more reliable, and less expensive. In 2015, Mozilla, Google, Cisco, and others joined with Amazon and Netflix and hardware vendors AMD, ARM, Intel, and NVIDIA to form AOMedia. As AOMedia grew, efforts to create an open video format coalesced around a new codec: AV1. AV1 is based largely on Google's VP9 code and incorporates tools and technologies from Daala, Thor, and VP10. Mozilla loves AV1 for two reasons: AV1 is royalty-free, so anyone can use it free of charge. Software companies can use it to build video streaming into their applications. Web developers can build their own video players for their sites. The second reason we love AV1 is that it delivers better compression technology than even high-efficiency codecs -- about 30% better, according to a Moscow State University study.' -- source: https://news.slashdot.org/story/18/07/11/2246221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Typeform Data Breach Hits A Little Close To Home
by Lawrence D'Oliveiro 12 Jul '18

12 Jul '18

A few days ago, Typeform, a company which specializes in online survey forms, reported <https://www.theregister.co.uk/2018/07/02/typeform_breach/> that someone had gained unauthorized access to one of its backups. This turned out to impact a remarkable variety of institutions using its services <https://www.theregister.co.uk/2018/07/03/hotel_chain_and_uk_political_party…> <https://www.theregister.co.uk/2018/07/04/typeform_breach_continued/>, though the listed ones all seem to be in the UK and Australia. Now, I read today in the Hamilton Press (issue of 11th July, i.e. today), on page 6, that the affected customers include the Hamilton City Council, Waikato District Council, and Waipā District Council. “About 2800 Waikato people” may have used the Typeform service to express views to these local bodies. Information that could have been leaked was “names, email addresses, and in some cases, phone numbers”. Hamilton City used the service to run 10 surveys between November 2014 and February 2018, and a total of 1941 people “may have been affected”; it has contacted them about the breach, and it doesn’t use Typeform any more. Waipā District has similarly contacted 125 participants in its surveys. (No mention of what action Waikato District is taking...)

1 0

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Peter Reutemann 11 Jul '18

11 Jul '18

'In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability—and came away with the contents of a US Air Force captain's computer. The purloined files from the captain—the officer in charge (OIC) of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit (AMU)at Creech Air Force Base, Nevada—included export-controlled information regarding Reaper drone maintenance. The hacker took the documents to a Dark Web marketplace, where he planned on selling them for a few hundred dollars. And it's there that analysts from Recorded Future, an information security threat intelligence company, discovered them. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago. Discoverable by searching Shodan for devices with Internet Protocol port 21 open and response text including "214-ADMIN_LOGIN," the vulnerability allowed attackers to compromise routers and then gain access to the local network. They could then either grab files passing over the network or gain access to devices on it.' -- source: https://arstechnica.com/information-technology/2018/07/year-old-router-bug-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malware Found in Arch Linux AUR Package Repository
by Peter Reutemann 11 Jul '18

11 Jul '18

'Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.' -- source: https://it.slashdot.org/story/18/07/10/2136251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Stolen certificates from D-Link used to sign password-stealing malware
by Peter Reutemann 10 Jul '18

10 Jul '18

'Criminals recently stole code-signing certificates from router and camera maker D-Link and another Taiwanese company and used them to pass off malware that steals passwords and backdoors PCs, a researcher said Monday. The certificates were used to cryptographically verify that legitimate software was issued by D-Link and Changing Information Technology. Microsoft Windows, Apple’s macOS, and most other operating systems rely on the cryptographic signatures produced by such certificates to help users ensure that executable files attached to emails or downloaded on websites were developed by trusted companies rather than malicious actors masquerading as those trusted companies. Somehow, members of an advanced persistent-threat hacking group known as BlackTech obtained the certificates belonging to D-Link and Changing Information Technology, the researcher with antivirus provider Eset said in a blog post. The attackers then used the certificates to sign two pieces of malware, one a remotely controlled backdoor and the other a related password stealer. Both pieces of malware are referred to as Plead and are used in espionage campaigns against targets located in East Asia. The Japan Computer Emergency Response team recently documented the Plead malware here. AV provider Trend Micro recently wrote about BlackTech here. “The ability to compromise several Taiwan-based technology companies and reuse their code-signing certificates in future attacks shows that this group is highly skilled and focused on that region,” Eset researcher Anton Cherepanov wrote in Monday’s post.' -- source: https://arstechnica.com/information-technology/2018/07/stolen-certificates-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Spectre-like attack uses speculative execution to overflow buffers
by Peter Reutemann 10 Jul '18

10 Jul '18

'When the Spectre and Meltdown attacks were disclosed earlier this year, the expectation was that these attacks would be the first of many, as researchers took a closer look at the way that the speculative execution in modern processors could be used to leak sensitive information and undermine the security of software running on those processors. In May, we saw the speculative store bypass, and today we have a new variant on this theme: speculative buffer overflows, discovered by Vladimir Kiriansky at MIT and independent researcher Carl Waldspurger.' -- source: https://arstechnica.com/gadgets/2018/07/new-spectre-like-attack-uses-specul… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

With So Many Eyeballs, Is Open Source Security Better?
by Peter Reutemann 10 Jul '18

10 Jul '18

'Back in 1999, Eric Raymond coined the term "Linus' Law," which stipulates that given enough eyeballs, all bugs are shallow. Linus' Law, named in honor of Linux creator Linus Torvalds, has for nearly two decades been used by some as a doctrine to explain why open source software should have better security. In recent years, open source projects and code have experienced multiple security issues, but does that mean Linus' Law isn't valid? According to Dirk Hohndel, VP and Chief Open Source Officer at VMware, Linus' Law still works, but there are larger software development issues that impact both open source as well as closed source code that are of equal or greater importance. "I think that in every development model, security is always a challenge," Hohndel said. Hohndel said developers are typically motivated by innovation and figuring out how to make something work, and security isn't always the priority that it should be. "I think security is not something we should think of as an open source versus closed source concept, but as an industry," Hohndel said.' -- source: https://it.slashdot.org/story/18/07/10/1642226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hacker Breaches Chrome Extension of Popular VPN Service Hola, Directs Users To Compromised Cryptocurrency Website
by Peter Reutemann 10 Jul '18

10 Jul '18

'A hacker has breached a Hola VPN developer account and has replaced the official Chrome extension with one that redirected users of the MyEtherWallet.com website to a phishing page controlled by the attacker. The compromise took place yesterday and only lasted for five hours the MyEtherWallet (MEW) team said in a tweet. The Hola VPN team admitted to the hack. "The attack was programmed to inject a JavaScript tag in to the MEW site to 'phish' information about MEW accounts that are logging in without being in 'incognito mode', by re-directing the MEW users to the hacker's website," the Hola VPN team said.' -- source: https://yro.slashdot.org/story/18/07/10/1720243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ARM’s Anti-RISC-V FUD
by Lawrence D'Oliveiro 10 Jul '18

10 Jul '18

ARM put up a site attacking the open-source RISC-V processor architecture a few days ago, then had to take it down as a result of objections from its own staff <https://www.theregister.co.uk/2018/07/10/arm_riscv_website/>. Seems ARM is feeling the heat from the increasing traction that RISC-V is getting. Even though the original site is gone, it is still accessible via the Wayback Machine. And also one of the commenters points out that this graphic <https://www.arm.com/-/media/global/company/arm-risc-v-infographic.png> is still on ARM’s own site.

1 0

Firefox and Chrome Pull Popular Browser Extension Stylish From Their Stores After Report Claimed It Logs and Shares Browsing History, Credentials
by Peter Reutemann 05 Jul '18

05 Jul '18

'Stylish, a popular extension available for Chrome and Firefox which allows for easy customization of any website, now phones home and shares its users' browser history with its corporate parent, according to blogger Robert Heaton. This prompted Firefox to ban the extension from its addons site and prompt all users to disable it. The discussion can be seen in the relevant bug report. In Heaton's words: Stylish is no longer a well-meaning product with your best interests at heart. If you use and like Stylish, please uninstall it and switch to an alternative like Stylus, an offshoot from the good old version of Stylish that works in much the same way, minus the spyware. Google too has pulled the extension from its extension store. This is not the first time Stylish is at the centre of a privacy debacle' -- source: https://yro.slashdot.org/story/18/07/04/218234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Download Bomb Trick Returns in Chrome -- Also Affects Firefox, Opera, Vivaldi and Brave
by Peter Reutemann 03 Jul '18

03 Jul '18

'The release of Google Chrome 67 has reopened a "download bomb" bug that was exploited by tech support scammers last winter, and which had been fixed with the release of Chrome 65 in March 2018. Furthermore, the issue also appears to affect other browsers as well, such as Firefox, Vilvadi, Opera, and Brave, according to tests carried out by Bleeping Computer. The "download bomb" trick is a technique that involves initiating hundreds or thousands of downloads to freeze a browser on a specific page. Across the years, there have been multiple variations of download bombs, and they have often been used by tech support scammers to trap users on shady sites that tried to lure victims into calling a tech support number to have their browser unlocked. Over the winter, security researchers from Malwarebytes noticed a tech support scam campaign that employed a new "download bomb" technique to trap users on its shady sites.' -- source: https://news.slashdot.org/story/18/07/03/1416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study Finds That a Large Number of Popular Android Apps Secretly Cast the Screen To Third Parties, But They Don't Listen To Conversations
by Peter Reutemann 03 Jul '18

03 Jul '18

'It's the smartphone conspiracy theory that just won't go away: Many, many people are convinced that their phones are listening to their conversations to target them with ads. [...] Some computer science academics at Northeastern University had heard enough people talking about this technological myth that they decided to do a rigorous study to tackle it. For the last year, Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes ran an experiment involving more than 17,000 of the most popular apps on Android to find out whether any of them were secretly using the phone's mic to capture audio. The apps included those belonging to Facebook, as well as over 8,000 apps that send information to Facebook. Sorry, conspiracy theorists: They found no evidence of an app unexpectedly activating the microphone or sending audio out when not prompted to do so. Like good scientists, they refuse to say that their study definitively proves that your phone isn't secretly listening to you, but they didn't find a single instance of it happening. Instead, they discovered a different disturbing practice: apps recording a phone's screen and sending that information out to third parties.' -- source: https://yro.slashdot.org/story/18/07/03/1822250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Allows Outside App Developers To Read People's Gmails, Says Report
by Peter Reutemann 03 Jul '18

03 Jul '18

'According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative. What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails. ' -- source: https://yro.slashdot.org/story/18/07/02/2057256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Micro Focus Sells SUSE
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

<https://www.theregister.co.uk/2018/07/02/linux_makes_suse_sold_for_a_cool_2…>: Micro Focus CEO Chris Hsu subsequently decided that spending time with his family seemed more fun than piloting a juggernaut made of more offcuts than a cut-and-shut Ford Fiesta from Honest Bob's Motors. ... However, SUSE was a bright spot in the gloom, showing revenues of $164.4m and a solid, if unexciting, growth rate of 13.1 per cent in the six months to October 2017. ... For its part, SUSE is pretty happy with the deal. It will retain its CEO, Nils Brauckman, who seemed pleased to be free of Micro Focus ...

1 0

Metric-Compatible Fonts
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

I was idly doing some web searches the other day (as you do), and stumbled across this page <https://wiki.archlinux.org/index.php/Metric-compatible_fonts> at the ever-dependable Arch Wiki. My specific question was, what had happened to the “URW Palladio” font? Up until recently, this was the one that Fontconfig would offer up when I used the old “Palatino” name from Adobe PostScript days. (I used to like the way the curve of the “P” didn’t quite join up with the stem, but left a little gap with a pointy bit on the end. Ahem...) Turns out it’s still there, just under another name; it’s now called “P052” for some unfathomable reason. Anyway, that page gives a bunch of handy alternatives if you are looking for Free alternatives to proprietary fonts that preserve the metrics (widths, spacing etc), so substituting them won’t stuff up the formatting of a document.

1 0

'Why You Should Not Use Google Cloud'
by Peter Reutemann 02 Jul '18

02 Jul '18

'A user on Medium named "Punch a Server" says you should not use Google Cloud due to the "'no-warnings-given, abrupt way' they pull the plug on your entire system if they (or the machines) believe something is wrong." The user has a project running in production on Google Cloud (GCP) that is used to monitor hundreds of wind turbines and scores of solar plants scattered across 8 countries. When their project goes down, money is lost. An anonymous Slashdot reader shares the report: Early today morning (June 28, 2018) I receive an alert from Uptime Robot telling me my entire site is down. I receive a barrage of emails from Google saying there is some "potential suspicious activity" and all my systems have been turned off. EVERYTHING IS OFF. THE MACHINE HAS PULLED THE PLUG WITH NO WARNING. The site is down, app engine, databases are unreachable, multiple Firebases say I've been downgraded and therefore exceeded limits. Customer service chat is off. There's no phone to call. I have an email asking me to fill in a form and upload a picture of the credit card and a government issued photo id of the card holder. Great, let's wake up the CFO who happens to be the card holder. What if the card holder is on leave and is unreachable for three days? We would have lost everything -- years of work -- millions of dollars in lost revenue. I fill in the form with the details and thankfully within 20 minutes all the services started coming alive. The first time this happened, we were down for a few hours. In all we lost everything for about an hour. An automated email arrives apologizing for "inconvenience" caused. Unfortunately The Machine has no understanding of the "quantum of inconvenience" caused.' -- source: https://news.slashdot.org/story/18/07/01/0354200 The cloud is convenient, as you don't have to look after your own hardware and it allows you to add more processing power as needed. But this is a good example of why your own hardware might not be a bad idea... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0