- wlug - list.wlug.org.nz

Can Online Elections Ever Be Secure?
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Commentary <https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html> from Bruce Schneier: We can securely bank online, but can't securely vote online. If we could do away with anonymity -- if everyone could check that their vote was counted correctly -- then it would be easy to secure the vote. ... We can't, so we need to accept that our voting systems are insecure. We need an election system that is resilient to the threats. And for many parts of the system, that means paper.

1 0

meeting next week
by Peter Reutemann 25 Apr '18

25 Apr '18

Hi guys We have a WLUG meeting next Monday: "With the Cambridge Analytics scandal around (ab)using data obtained through Facebook, how about we have a look at (self-hosted) alternatives to the social network giant? Details on scandal: https://arstechnica.com/tech-policy/2018/03/facebooks-cambridge-analytica-s… Social media alternatives (eg diaspora, gnu social): https://alternativeto.net/software/facebook/" -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737141/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4

What Private Browsing Mode Really Means
by Lawrence D'Oliveiro 25 Apr '18

25 Apr '18

Seems like a lot of people <http://www.theregister.co.uk/2018/04/24/private_web_browsing_study/> have the wrong idea about what is really “private” in private browsing mode. Many of them believe that * Activity while logged into an account (e.g. Google) will not be saved in that account’s history * Bookmarks made in private mode are not visible in standard mode * It prevents websites from tracking their location * It affords better protection against malware * It obscures their IP address. None of which is true. To its credit, when you open a private window in Firefox, it clearly states the things that are hidden and the things that are not.

1 0

Ubuntu 18.04?
by Peter Reutemann 24 Apr '18

24 Apr '18

Hi everyone Since April would be the usual month for an Ubuntu release, I was surprised that I hadn't heard anything so far. The following article mentions a release date of 26/4: https://fossbytes.com/ubuntu-18-04-bionic-beaver-release-date-features/ And according to the Ubuntu wiki, this still seems to be happening: https://wiki.ubuntu.com/BionicBeaver/ReleaseTaskSignup Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Accused of Showing 'Total Contempt' for Android Users' Privacy
by Peter Reutemann 23 Apr '18

23 Apr '18

'On the heels of a terse privacy debate, Google may have found another thing to worry about: its attempt to rethink the traditional texting system. From a report: Joe Westby is Amnesty International's Technology and Human Rights researcher. Recently, in response to Google's launch of a new messaging service called "Chat", Westby argued that Google, "shows total contempt for Android users' privacy." "With its baffling decision to launch a messaging service without end-to-end encryption, Google has shown utter contempt for the privacy of Android users and handed a precious gift to cybercriminals and government spies alike, allowing them easy access to the content of Android users' communications. Following the revelations by CIA whistleblower Edward Snowden, end-to-end encryption has become recognized as an essential safeguard for protecting people's privacy when using messaging apps. With this new Chat service, Google shows a staggering failure to respect the human rights of its customers," Westby contended. Westby continued, saying: "In the wake of the recent Facebook data scandal, Google's decision is not only dangerous but also out of step with current attitudes to data privacy."' -- source: https://tech.slashdot.org/story/18/04/23/1946251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

“Drupalgeddon2” touches off arms race to mass-exploit powerful Web servers
by Peter Reutemann 22 Apr '18

22 Apr '18

'Attackers are mass-exploiting a recently fixed vulnerability in the Drupal content management system that allows them to take complete control of powerful website servers, researchers from multiple security companies are warning. At least three different attack groups are exploiting "Drupalgeddon2," the name given to an extremely critical vulnerability Drupal maintainers patched in late March, researchers with Netlab 360 said Friday. Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers. Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can." China-based Netlab 360, meanwhile, said at least three competing attack groups are exploiting the vulnerability. The most active group, Netlab 360 researchers said in a blog post published Friday, is using it to install multiple malicious payloads, including cryptocurrency miners and software for performing distributed denial-of-service attacks on other domains. The group, dubbed Muhstik after a keyword that pops up in its code, relies on 11 separate command-and-control domains and IP addresses, presumably for redundancy in the event one gets taken down.' -- source: https://arstechnica.com/information-technology/2018/04/drupalgeddon2-touche… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers
by Peter Reutemann 19 Apr '18

19 Apr '18

'Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention." Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.' -- source: https://yro.slashdot.org/story/18/04/19/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ask Slashdot: Is There a Good Alternative to Facebook?
by Peter Reutemann 18 Apr '18

18 Apr '18

'Long-time Slashdot reader Lauren Weinstein argues that fixing Facebook may be impossible because "Facebook's entire ecosystem is predicated on encouraging the manipulation of its users by third parties who posses the skills and financial resources to leverage Facebook's model. These are not aberrations at Facebook -- they are exactly how Facebook was designed to operate." Meanwhile one fund manager is already predicting that sooner or later every social media platform "is going to become MySpace," adding that "Nobody young uses Facebook," and that the backlash over Cambridge Analytica "quickens the demise." But Slashdot reader silvergeek asks, "is there a safe, secure, and ethical alternative?" to which tepples suggests "the so-called IndieWeb stack using the h-entry microformat." He also suggests Diaspora, with an anonymous Diaspora user adding that "My family uses a server I put up to trade photos and posts... Ultimately more people need to start hosting family servers to help us get off the cloud craze... NethServer is a pretty decent CentOS based option." Meanwhile Slashdot user Locke2005 shared a Washington Post profile of Mastodon, "a Twitter-like social network that has had a massive spike in sign-ups this week." Mastodon's code is open-source, meaning anybody can inspect its design. It's distributed, meaning that it doesn't run in some data center controlled by corporate executives but instead is run by its own users who set up independent servers. And its development costs are paid for by online donations, rather than through the marketing of users' personal information... Rooted in the idea that it doesn't benefit consumers to depend on centralized commercial platforms sucking up users' personal information, these entrepreneurs believe they can restore a bit of the magic from the Internet's earlier days -- back when everything was open and interoperable, not siloed and commercialized. The article also interviews the founders of Blockstack, a blockchain-based marketplace for apps where all user data remains local and encrypted. "There's no company in the middle that's hosting all the data," they tell the Post. "We're going back to the world where it's like the old-school Microsoft Word -- where your interactions are yours, they're local and nobody's tracking them." On Medium, Mastodon founder Eugene Rochko also acknowledges Scuttlebutt and Hubzilla, ending his post with a message to all social media users: "To make an impact, we must act." Lauren Weinstein believes Google has already created an alternative to Facebook's "sick ecosystem": Google Plus. "There are no ads on Google+. Nobody can buy their way into your feed or pay Google for priority. Google doesn't micromanage what you see. Google doesn't sell your personal information to any third parties..." And most importantly, "There's much less of an emphasis on hanging around with those high school nitwits whom you despised anyway, and much more a focus on meeting new persons from around the world for intelligent discussions... G+ posts more typically are about 'us' -- and tend to be far more interesting as a result." (Even Linus Torvalds is already reviewing gadgets there.) Wired has also compiled their own list of alternatives to every Facebook service. But what are Slashdot's readers doing for their social media fix? Leave your own thoughts and suggestions in the comments. Is there a good alternative to Facebook?' -- source: https://tech.slashdot.org/story/18/03/25/0039218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft’s bid to secure the Internet of Things: Custom Linux, custom chips, Azure
by Peter Reutemann 18 Apr '18

18 Apr '18

'The drive to connect everything to the Internet and build the Internet of Things has created a new security nightmare. Millions of devices with little to no active maintenance are now permanently online, enabling the creation of massive botnets as the devices go unpatched and unloved. Microsoft today announced its solution: Azure Sphere.' -- source: https://arstechnica.com/gadgets/2018/04/microsofts-bid-to-secure-the-intern… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When Two Secure Systems Make An Insecure Combination
by Lawrence D'Oliveiro 13 Apr '18

13 Apr '18

Just goes to show <https://www.schneier.com/blog/archives/2018/04/obscure_e-mail_.html> that two separate systems may be reasonably secure in their own right, but the interaction between them can create unexpected vulnerabilities.

1 0

Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
by Peter Reutemann 12 Apr '18

12 Apr '18

'Catalin Cimpanu, reporting for BleepingComputer: Cyber-espionage groups -- also referred to as advanced persistent threats (APTs) -- are using hacked routers more and more during their attacks, according to researchers at Kaspersky Lab. "It's not necessarily something new. Not something that just exploded," said Costin Raiu, director of Global Research and Analysis Team (GReAT) at Kaspersky Lab, in a webinar today. "We've seen a bunch of router attack throughout the years. A very good example is SYNful Knock, a malicious implant for Cisco [routers] that was discovered by FireEye but also threat actors such as Regin and CloudAtlas. Both APTs have been known to have and own proprietary router implants." But the number of APTs leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. For example, the Slingshot APT (believed to be a US Army JSOC operation targeting ISIS militants) has used hacked MikroTik routers to infect victims with malware.' -- source: https://tech.slashdot.org/story/18/04/12/1932248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Some Android Device Makers Are Lying About Security Patch Updates
by Peter Reutemann 12 Apr '18

12 Apr '18

'Security patches for smartphones are extremely important because many people store personal data on their devices. Lots of Android phones out there get regularly security patches, but according to a new report, some of them are lying about the patches that they've actually gotten. According to a study by Security Research Labs, some Android phones are missing patches that they claim to have. Wired explains that SRL tested 1,200 phones from more than a dozen phone makers for every Android security patch released in 2017. The devices tested include ones from Google, Samsung, Motorola, LG, HTC, Xiaomi, OnePlus, Nokia, TCL, and ZTE. The study found that outside of Google and its Pixel phones, well-known phone makers had devices that were missing patches that they claimed to have. "We found several vendors that didn't install a single patch but changed the patch date forward by several months," says SRL founder Karsten Nohl.' -- source: https://tech.slashdot.org/story/18/04/12/1851203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD Releases Spectre v2 Microcode Updates for CPUs Going Back To 2011
by Peter Reutemann 11 Apr '18

11 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. Microsoft has released KB4093112, an update that also includes special OS-level patches for AMD users in regards to the Spectre v2 vulnerability. Similar OS-level updates have been released for Linux users earlier this year. Yesterday's microcode patches announcement is AMD keeping a promise it made to users in January, after the discovery of the Meltdown and Spectre (v1 and v2) vulnerabilities.' -- source: https://tech.slashdot.org/story/18/04/11/1826222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Biometric and App Logins Will Soon Be Pushed Across the Web
by Peter Reutemann 10 Apr '18

10 Apr '18

'Soon, it will be much easier to log into more websites using a hardware key plugged into your laptop, a dedicated app, or even the fingerprint scanner on your phone. Motherboard: On Tuesday, a spread of organizations and businesses, including top browser vendors such as Microsoft and Google, announced a new standards milestone that will streamline the process for web developers to add extra login methods to their sites, potentially keeping consumers' accounts and data more secure. "For users, this will be a natural transition. People everywhere are already using their fingers and faces to 'unlock' their mobile phones and PCs, so this will be natural to them -- and more convenient," Brett McDowell, executive director at the FIDO Alliance, one of the organizations involved in setting up the standard, told Motherboard in an email. "What they use today to 'unlock' will soon allow them to 'login' to all their favorite websites and a growing number of native apps that already includes Bank of America, PayPal, eBay and Aetna," he added. Passwords continue to be one of the weaker points in online security. A hacker may phish a target's password and log into their account, or take passwords from one data breach and use them to break into accounts on another site. The login standard, called Web Authentication (WebAuthn), will let potentially any website or online service use apps, security keys, or biometrics as a login method instead of a password, or use those alternative approaches as a second method of verification. The key here is making it easy and open for developers to use, and for it to work across all different brands of browsers. The functionality is already available in Mozilla's Firefox, and will be rolled out to Microsoft's Edge and Google Chrome in the new few months. Opera has committed to supporting WebAuthn as well.' -- source: https://yro.slashdot.org/story/18/04/10/1357241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux: Beep Command Can Be Used to Probe for the Presence of Sensitive Files
by Peter Reutemann 10 Apr '18

10 Apr '18

'Catalin Cimpanu, writing for BleepingComputer: A vulnerability in the "beep" package that comes pre-installed with Debian and Ubuntu distros allows an attacker to probe for the presence of files on a computer, even those owned by root users, which are supposed to be secret and inaccessible. The vulnerability, tracked as CVE-2018-0492, has been fixed in recent versions of Debian and Ubuntu (Debian-based OS). At its core, the bug is a race condition in the beep utility that allows the OS to emit a "beep" sound whenever it is deemed necessary. Security researchers have discovered a race condition in the beep package that allows an attacker to elevate his code to root-level access.' -- source: https://linux.slashdot.org/story/18/04/10/142218 Cheers, peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Computer Maker System76 To Move Manufacturing To the US
by Peter Reutemann 10 Apr '18

10 Apr '18

'Linux computer manufacturer System76 made its mark in part because of its commitment to open source principles and doing what it believes is right. Last year it released its homegrown Linux, Pop!_OS. In early March, System76 founder Carl Richell tweeted about the company's plans to locate its computer manufacturing factory in Denver, Colorado. By moving its manufacturing from China to the United States, System76 is offering more proof that it's not afraid to buck prevailing tech norms to do things "the System76 way." Carl Richell, founder and CEO of System76, says in a Twitter exchange that they anticipate shipping products from the factory by the end of the year.' -- source: https://linux.slashdot.org/story/18/04/10/1626202 Here's a link to Pop!_OS: https://system76.com/pop It's based on Ubuntu: https://system76.com/pop/tech Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Follows Chrome and Blocks the Loading of Most FTP Resources
by Peter Reutemann 10 Apr '18

10 Apr '18

'Mozilla says it will follow in the steps of Google Chrome and start blocking the loading of FTP subresources inside HTTP and HTTPS pages. >From a report: By FTP subresources, we refer to files loaded via the FTP protocol inside img, script, or iframe tags that have a src="ftp://". FTP links placed inside normal angle bracket links or typed directly in the browser's address bar will continue to work. The reasoning is that FTP is an insecure protocol that doesn't support modern encryption techniques and will inherently break many other built-in browser security and privacy features, such as HSTS, CSP, XSA, or others. Furthermore, many malware distribution campaigns often rely on compromising FTP servers and redirecting or downloading malware on users' computers via FTP subresources. Mozilla engineers say FTP subresource blocking will ship with Firefox 61, currently scheduled for release on June 26.' -- source: https://tech.slashdot.org/story/18/04/10/188244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Torvalds Opposes Tying UEFI Secure Boot to Kernel Lockdown Mode
by Peter Reutemann 08 Apr '18

08 Apr '18

'The kernel lockdown feature further restricts access to the kernel by user-space with what can be accessed or modified... Pairing that with UEFI SecureBoot unconditionally is meeting some resistance by Linus Torvalds. The goal of kernel lockdown, which Linus Torvalds doesn't have a problem with at all, comes down to "prevent both direct and indirect access to a running kernel image, attempting to protect against unauthorised modification of the kernel image and to prevent access to security and cryptographic data located in kernel memory, whilst still permitting driver modules to be loaded." But what has the Linux kernel creator upset with are developers trying to pair this unconditionally with UEFI SecureBoot. Linus describes Secure Boot as being "pushed in your face by people with an agenda." But his real problem is that Secure Boot would then imply Kernel Lockdown mode... "Tying these things magically together IS A BAD IDEA."' -- source: https://linux.slashdot.org/story/18/04/07/2159245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Programmer Unveils OpenGL Bindings for Bash
by Peter Reutemann 08 Apr '18

08 Apr '18

'Compiled languages have long provided access to the OpenGL API, and even most scripting languages have had OpenGL bindings for a decade or more. But, one significant language missing from the list is our old friend/nemesis Bash. But worry no longer! Now you can create your dazzling 3D visuals right from the comfort of your command line! "You'll need a system with both Bash and OpenGL support to experience it firsthand," explains software engineer Michael Conrad, who created the first version 13 years ago as "the sixth in a series of 'Abuse of Technology' projects," after "having my technical sensibilities offended that someone had written a real-time video game in Perl. "Back then, my primary language was C++, and I was studying OpenGL for video game purposes. I declared to my friends that the only thing worse would be if it had been 3D and written in Bash. Having said the idea out loud, it kept prodding me, and I eventually decided to give it a try to one-up the 'awfulness'..."' -- source: https://developers.slashdot.org/story/18/04/07/0035203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel drops plans to develop Spectre microcode for ancient chips
by Peter Reutemann 04 Apr '18

04 Apr '18

'Intel has scaled back its plans to produce microcode updates for some of its older processors to address the "Spectre variant 2" attack. Core 2 processors are no longer scheduled to receive updates, and, while some first generation Core products have microcode updates available already, others have had their update cancelled.' -- source: https://arstechnica.com/gadgets/2018/04/intel-drops-plans-to-develop-spectr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 28 Beta Linux Distro is Finally Here
by Peter Reutemann 03 Apr '18

03 Apr '18

'Today, version 28 of the Fedora finally achieves beta status. After a short delay -- it was scheduled to be available a week earlier -- the distro is back on track, and looking better than ever. As is typical now, there are three versions of the operating system -- Atomic Host, Server, and Workstation. While all three have their places, normal desktop computer users will want to focus on Workstation. While there are plenty of new features (and bugs), the most exciting aspect of Fedora 28 Workstation is the inclusion of the GNOME 3.28 desktop environment.' -- source: https://linux.slashdot.org/story/18/04/03/1846233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel To Lose A Few Architectures
by Lawrence D'Oliveiro 03 Apr '18

03 Apr '18

Looking at the source code <https://elixir.bootlin.com/linux/latest/source/> for the latest (4.16) Linux kernel, I see support for 31 different major processor architectures currently <https://elixir.bootlin.com/linux/latest/source/arch>. However, the next, 4.17 kernel is due to drop the ability to run on 8 of them <http://www.theregister.co.uk/2018/04/03/linux_kernel_4_16_released/>, due to the fact that nobody is using them any more--or at least, nobody with an interest in implementing new kernels <http://lkml.iu.edu/hypermail/linux/kernel/1804.0/00306.html>. Interesting to read Arnd Bergmann’s observations on what these dead-end architectures have in common: In the end, it seems that while the eight architectures are extremely different, they all suffered the same fate: There was one company in charge of an SoC line, a CPU microarchitecture and a software ecosystem, which was more costly than licensing newer off-the-shelf CPU cores from a third party (typically ARM, MIPS, or RISC-V). It seems that all the SoC product lines are still around, but have not used the custom CPU architectures for several years at this point. In contrast, CPU instruction sets that remain popular and have actively maintained kernel ports tend to all be used across multiple licensees.

1 0

Adobe Is Helping Some 60 Companies Track People Across Devices
by Peter Reutemann 31 Mar '18

31 Mar '18

'Neowin reports of Adobe's recent announcement of its new Marketing Cloud Device Co-op initiative: The announcement of the new solution for tracking customers across devices was made at the Adobe Summit this week in Las Vegas to a digital marketing conference. According to an Adobe blog post released earlier this month citing Forrester, consumers are increasingly accessing multiple devices before making a purchase decision -- an average of 5.5 connected devices per person. This behavior creates a challenge for retailers, who cannot easily target people in their marketing campaigns, ultimately depending on Facebook or Google to track people instead of devices. Both Facebook and Google are able to do this job because of the massive amount of users logged into their ecosystems regularly, so most retailers have been opting to use those platforms as a way to reach potential customers. But Adobe's approach is to provide a platform agnostic solution acting as a glue between the world's biggest brands' own data management platforms. In order for Device Co-op to work, each company that has joined the initiative will provide Adobe with "cryptographically hashed login IDs" and HTTP header data, which Adobe claims will completely hide the customer's identity. This data will be used to create groups of devices used by the same person or household, which will then be made available to all the members of the initiative so they can target people on different devices, instead of creating one customer profile per device, as can be seen from the example given in the image above. Until now, some 60 companies have joined the Adobe initiative, including brands such as Subway, Sprint, NFL, Lenovo, Intel, Barnes & Noble, and Subaru. Also, preliminary measurements made by Adobe indicate that Device Co-op could link up to 1.2 billion devices worldwide, based on the amount of accesses seen by current members. But it is important to note that the initiative is currently collecting data of U.S. and Canada users only. Adobe is claiming the initiative will not disclose a user's identity to its members, including any personal data, but, given the recent Facebook and Cambridge Analytica scandal, many will be skeptical of those claims. Thankfully, Adobe is allowing users to completely opt out all of their devices from the services via this website.' -- source: https://yro.slashdot.org/story/18/03/31/0059259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Prestigious Free Software Award Goes to Karen Sandler
by Peter Reutemann 31 Mar '18

31 Mar '18

'Each year the Free Software award goes to someone making "a great contribution to the progress and development of free software, through activities that accord with the spirit of free software." This year's winner is a former executive of the GNOME Foundation, Karen Sandler. Jeremy Allison - Sam, Slashdot reader #8,157, brought this announcement. Richard Stallman, President of the FSF, presented Sandler with the award during a ceremony. Stallman highlighted Sandler's dedication to software freedom. Stallman told the crowd that Sandler's "vivid warning about backdoored nonfree software in implanted medical devices has brought the issue home to people who never wrote a line of code. Her efforts, usually not in the public eye, to provide pro bono legal advice to free software organizations and [with Software Freedom Conservancy] to organize infrastructure for free software projects and copyleft defense, have been equally helpful." In her acceptance speech, Sandler spoke about her dedication to free software as a patient, advocate and professional. "Coming to terms with a dangerous heart condition should never have cost me fundamental control over the technology that my life relies on", said Sandler... "This issue is personal not just for me but for anyone who relies on software, and today that means every single person." ' -- source: https://news.slashdot.org/story/18/03/31/0322217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Experts See Chromebooks as a Closed Ecosystem That Improves Security
by Peter Reutemann 31 Mar '18

31 Mar '18

'The founder of Rendition Security believes his daughter "is more safe on a Chromebook than a Windows laptop," and he's not the only one. CNET's staff reporter argues that Google's push for simplicity, speed, and security "ended up playing off each other." mspohr shared this article: Heading to my first security conference last year, I expected to see a tricked-out laptop running on a virtual machine with a private network and security USB keys sticking out -- perhaps something out of a scene from "Mr. Robot." That's not what I got. Everywhere I went I'd see small groups of people carrying Chromebooks, and they'd tell me that when heading into unknown territory it was their travel device... "If you want prehardened security, then Chromebooks are it," said Kenneth White, director of the Open Crypto Audit Project. "Not because they're Google, but because Chrome OS was developed for years and it explicitly had web security as a core design principle...." Drewry and Liu focused on four key features for the Chromebook that have been available ever since the first iteration in 2010: sandboxing, verified boots, power washing and quick updates. These provided security features that made it much harder for malware to pass through, while providing a quick fix-it button if it ever did. That's not to say Chrome OS is impervious to malware. Cybercriminals have figured out loopholes through Chrome's extensions, like when 37,000 devices were hit by the fake version of AdBlock Plus. Malicious Android apps have also been able to sneak through the Play Store. But Chrome OS users mostly avoided massive cyberattack campaigns like getting locked up with ransomware or hijacked to become part of a botnet. Major security flaws for Chrome OS, like ones that would give an attacker complete control, are so rare that Google offers rewards up to $200,000 to anyone who can hack the system. The article argues that "Fewer software choices mean limited options for hackers. Those are some of the benefits that have led security researchers to warm up to the laptops... "Chrome OS takes an approach to security that's similar to the one Apple takes with iOS and its closed ecosystem."' -- source: https://tech.slashdot.org/story/18/03/31/0443257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source RISC V Processor Gets Support From Google, Samsung, Qualcomm, and Tesla
by Peter Reutemann 31 Mar '18

31 Mar '18

'Google, Qualcomm, and Samsung "are among 80 tech companies joining forces to develop a new open-source chip design for new technologies like self-driving vehicles," writes Seeking Alpha, citing a (pay-walled) report on The Information. "Western Digital and Nvidia also plan to use the new chip design for some of their products," while Tesla "has joined the RISC-V Foundation and is considering using the tech in its new chip efforts." MIT Technology Review adds that while Arm had hoped to bring their low-power/high performance processors to AI and self-driving cars, "The company that masterminded the processor inside your smartphone may find that a set of free-to-use alternative designs erode some of its future success."' -- source: https://news.slashdot.org/story/18/03/31/0622248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft's Windows 7 Meltdown Fixes From January and February Made PCs More Insecure
by Peter Reutemann 30 Mar '18

30 Mar '18

'Microsoft's January and February security fixes for Intel's Meltdown processor vulnerability opened up an even worse security hole on Windows 7 PCs and Server 2008 R2 boxes. From a report: This is according to researcher Ulf Frisk, who previously found glaring shortcomings in Apple's FileVault disk encryption system. We're told Redmond's early Meltdown fixes for 64-bit Windows 7 and Server 2008 R2 left a crucial kernel memory table readable and writable for normal user processes. This, in turn, means any malware on those vulnerable machines, or any logged-in user, can manipulate the operating system's memory map, gain administrator-level privileges, and extract and modify any information in RAM. The Meltdown chip-level bug allows malicious software, or unscrupulous logged-in users, on a modern Intel-powered machine to read passwords, personal information, and other secrets from protected kernel memory. But the security fixes from Microsoft for the bug, on Windows 7 and Server 2008 R2, issued in January and February, ended up granting normal programs read and write access to all of physical memory' -- source: https://tech.slashdot.org/story/18/03/28/2010240 Time to move to another operating system... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Yet Another Microsoft Windows Reorg
by Lawrence D'Oliveiro 30 Mar '18

30 Mar '18

From <https://arstechnica.com/gadgets/2018/03/windows-leader-terry-myerson-out-as…>: The Windows platform has many masters. It is important for both Microsoft's client and server businesses, of course, but it's also fundamental to the Azure platform. While it has become increasingly unified, responsibility for its development (and financial reporting) has often been split between divisions. Conway’s Law says that any piece of software reflects the organizational structure that produced it. The fact that there is no single mind in charge of the overall product will inevitably manifest itself in discontinuities in the characteristics of that product. Yes, I know: scratch that future tense. It already has.

1 0

An Open Source, Royalty-Free AV1 Codec Has Been Released
by Peter Reutemann 28 Mar '18

28 Mar '18

'After three years in development the Alliance for Open Media is releasing the royalty-free AOMedia Video Codec 1.0 (AV1) specification. The AV1 codec promises an average of 30 percent greater compression over competing codecs according to independent member tests. The release of AV1 includes: * Bitstream specification to enable the next-generation of silicon * Unoptimized, experimental software decoder and encoder to create and consume the bitstream * Reference streams for product validation * Binding specifications to allow content creation and streaming tools for user-generated and commercial vid' -- source: https://news.slashdot.org/story/18/03/28/1610215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Many VPN Providers Leak Customer's IP Address via WebRTC Bug
by Peter Reutemann 28 Mar '18

28 Mar '18

'Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.' -- source: https://yro.slashdot.org/story/18/03/28/1813213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002]
by Peter Reutemann 28 Mar '18

28 Mar '18

Apologies for cross-posting. Cheers, Peter ---------- Forwarded message ---------- From: Mark Foster <...> Date: Thu, Mar 29, 2018 at 9:20 AM Subject: [NZLUG] [Fwd: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002] To: nzlug(a)lists.nzoss.org.nz I know there's plenty of Drupal out there, and I don't usually forward these around, but in case you havn't heard... The Drupal team took the unusual step of warning that this was coming several days ago, that helps set the tone for the severity of this. I've taken the unusual step of disabling my own Drupal based website until I can attend to its update. Mark. ---------------------------- Original Message ---------------------------- Subject: [Security-news] Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 From: security-news(a)drupal.org Date: Thu, March 29, 2018 8:21 am To: security-news(a)drupal.org -------------------------------------------------------------------------- View online: https://www.drupal.org/sa-core-2018-002 Project:Â Drupal core [1] Date:Â 2018-March-28 Security risk:Â *Highly critical* 21âˆ•25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability:Â Remote Code Execution Description:Â CVE: CVE-2018-7600 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ [3] about this issue. Solution:Â Upgrade to the most recent version of Drupal 7 or 8 core. * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are unable to update immediately, you can attempt to apply this patch [5] to fix the vulnerability until such time as you are able to completely update.) * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you are unable to update immediately, you can attempt to apply this patch [7] to fix the vulnerability until such time as you are able to completely update.) Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide security releases for unsupported minor releases [8]. However, given the potential severity of this issue, we /are/ providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0. Your site's update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update. * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply this patch [10]. * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply this patch [12]. This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above. This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor [13]. Reported By:Â * Jasper Mattsson [14] Fixed By:Â * Jasper Mattsson [15] * Samuel Mortenson [16] Provisional Drupal Security Team member * David Rothstein [17] of the Drupal Security Team * Jess (xjm) [18] of the Drupal Security Team * Michael Hess [19] of the Drupal Security Team * Lee Rowlands [20] of the Drupal Security Team * Peter Wolanin [21] of the Drupal Security Team * Alex Pott [22] of the Drupal Security Team * David Snopek [23] of the Drupal Security Team * Pere Orga [24] of the Drupal Security Team * Neil Drumm [25] of the Drupal Security Team * Cash Williams [26] of the Drupal Security Team * Daniel Wehner [27] * Tim Plunkett [28] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached by email at security at drupal.org or via the contact form. Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://groups.drupal.org/security/faq-2018-002 [4] https://www.drupal.org/project/drupal/releases/7.58 [5] https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a83db50e2f97682d… [6] https://www.drupal.org/project/drupal/releases/8.5.1 [7] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [8] https://www.drupal.org/core/release-cycle-overview [9] https://www.drupal.org/project/drupal/releases/8.3.9 [10] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [11] https://www.drupal.org/project/drupal/releases/8.4.6 [12] https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635… [13] https://www.drupal.org/project/d6lts [14] https://www.drupal.org/u/Jasu_M [15] https://www.drupal.org/u/Jasu_M [16] https://www.drupal.org/user/2582268 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/65776 [19] https://www.drupal.org/user/102818 [20] https://www.drupal.org/u/larowlan [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/u/alexpott [23] https://www.drupal.org/u/dsnopek [24] https://www.drupal.org/u/pere-orga [25] https://www.drupal.org/u/drumm [26] https://www.drupal.org/u/cashwilliams [27] https://www.drupal.org/u/dawehner [28] https://www.drupal.org/u/tim.plunkett _______________________________________________ Security-news mailing list Security-news(a)drupal.org Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromebooks In Schools?
by Lawrence D'Oliveiro 28 Mar '18

28 Mar '18

In among this article about Apple’s new push to get IPads used in schools <https://arstechnica.com/gadgets/2018/03/analysis-new-ipads-will-help-apple-…> is the interesting information that Google Chromebooks are heavily used throughout the US school system: Google offers G Suite for Education for free, sans some features. Adding the full suite of enterprise features costs only $4 per user per month, compared to $25 per user per month for other kinds of organizations. Papers are typed in Google Docs. Presentations are done using Google Presentations. Each student has a Google email account assigned through the district. Homework is handed out and done entirely on Chromebooks in many classes. In so many words, Google has spread its tentacles throughout the entire school district at every level ... Are Chromebooks used in schools here? I noticed a couple of units on sale in OfficeMax when I dropped in there a few weeks ago. I don’t recall seeing them anywhere else in town.

1 0

Bring your own Linux to Windows with new open source tool
by Peter Reutemann 27 Mar '18

27 Mar '18

'After starting with Ubuntu, Microsoft has added a number of Linux distributions to its Windows Subsystem for Linux (WSL) Linux runtime environment. A Windows machine can simultaneously offer an Ubuntu, SUSE, Debian, and Kali "personality," providing users with a choice of the different distributions' preferences and package management. But if your distribution isn't yet available or if you want a Linux installation that's customized just the way you like it, there's now an answer: Microsoft has an open source tool for building your own Linux package. The tool is aimed at two groups: distribution owners (so they can produce a bundle to ship through the Microsoft Store) and developers (so they can create custom distributions and sideload them onto their development systems). Microsoft's tool provides the basic glue between Windows and the Linux distribution. It handles telling the system about the distribution and performing initial setup such as user creation, and it can be customized to—for example—print a message of the day when the distribution is started.' -- source: https://arstechnica.com/gadgets/2018/03/microsofts-new-open-source-tool-let… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

As predicted, more speculative execution processor attacks are discovered
by Peter Reutemann 26 Mar '18

26 Mar '18

'Researchers from the College of William and Mary, Carnegie Mellon, the University of California Riverside, and Binghamton University have described a security attack that uses the speculative execution features of modern processors to leak sensitive information and undermine the security boundaries that operating systems and software erect to protect important data. That probably sounds familiar. The Spectre attacks, published earlier this year, take advantage of the speculative execution features of modern processors to leak sensitive information. The new attack, named BranchScope by the researchers, shares some similarity with variant 2 of the Spectre attack, as both BranchScope and Spectre 2 take advantage of the behavior of the processor's branch predictor.' -- source: https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-re… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google starts blocking “uncertified” Android devices from logging in
by Peter Reutemann 26 Mar '18

26 Mar '18

'Google is apparently stepping up its efforts to crack down on illicit distribution of Google's Android apps. According to XDA Developers, Google logins on unlicensed devices will now fail at setup, and a warning message will pop up stating "Device is not certified by Google." This warning screen has appeared on and off in the past during a test phase, but XDA (and user reports) indicate it is now headed for a wider rollout.' -- source: https://arstechnica.com/gadgets/2018/03/google-starts-blocking-uncertified-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Kritia 4.0 Released, Conversation With The Team
by Lawrence D'Oliveiro 26 Mar '18

26 Mar '18

Another high-quality article from Alexandre Prokoudine <http://libregraphicsworld.org/blog/entry/krita-4-0-interview> about the just-released major revamp of Krita. It now straddles both “paint” and “draw” worlds, with Inkscape-styled SVG-based vector functionality added to the older paint functions. Oh, and it does animations as well. The item links to the “official” release video, but another informative one worth checking out is this <https://www.youtube.com/watch?v=OXvHHJUyBDg>.

2 3

Shodan Search Exposes Thousands of Servers Hosting Passwords and Keys
by Peter Reutemann 25 Mar '18

25 Mar '18

'Thousands of etcd servers "are spitting sensitive passwords and encrypted keys," reports Fossbytes: Security researcher Giovanni Collazo was able to harvest 8781 passwords, 650 AWS access keys, 23 secret keys, and 8 private keys. First, he ran a query on the hacker search engine Shodan that returned around 2300 servers running etcd database. Then, he ran a simple script that gave him the login credentials stored on these servers which can be used to gain access to CMSs, MySQL, and PostgreSQL databases, etc. etcd is a database used by computing clusters to store and exchange passwords and configuration settings between servers and applications over the network. With the default settings, its programming interface can return administrative login credentials without any authentication upfront... All of the data he harvested from around 1500 servers is around 750MB in size... Collazo advises that anyone maintaining etcd servers should enable authentication, set up a firewall, and take other security measures. Another security research independently verified the results, and reported that one MySQL database had the root password "1234".' -- source: https://developers.slashdot.org/story/18/03/24/1943239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Scraped Call, Text Message Data For Years From Android Phones
by Peter Reutemann 25 Mar '18

25 Mar '18

'This past week, a New Zealand man was looking through the data Facebook had collected from him in an archive he had pulled down from the social networking site. While scanning the information Facebook had stored about his contacts, Dylan McKay discovered something distressing: Facebook also had about two years worth of phone call metadata from his Android phone, including names, phone numbers, and the length of each call made or received. This experience has been shared by a number of other Facebook users who spoke with Ars, as well as independently by us -- my own Facebook data archive, I found, contained call-log data for a certain Android device I used in 2015 and 2016, along with SMS and MMS message metadata. In response to an email inquiry about this data gathering by Ars, a Facebook spokesperson replied, "The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it's a widely used practice to begin by uploading your phone contacts." The spokesperson pointed out that contact uploading is optional and installation of the application explicitly requests permission to access contacts. And users can delete contact data from their profiles using a tool accessible via Web browser. If you granted permission to read contacts during Facebook's installation on Android a few versions ago -- specifically before Android 4.1 (Jelly Bean) -- that permission also granted Facebook access to call and message logs by default. The permission structure was changed in the Android API in version 16. But Android applications could bypass this change if they were written to earlier versions of the API, so Facebook API could continue to gain access to call and SMS data by specifying an earlier Android SDK version. Google deprecated version 4.0 of the Android API in October 2017 -- the point at which the latest call metadata in Facebook user's data was found. Apple iOS has never allowed silent access to call data. You are able to have Facebook delete the data it collects from you, "but it's not clear if this deletes just contacts or if it also purges call and SMS metadata," reports Ars. Generally speaking, if you're concerned about privacy, you shouldn't share your contacts and call-log data with any mobile application.' -- source: https://yro.slashdot.org/story/18/03/25/056246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 3 Model B+ Benchmarks Show Significantly Improved Performance
by Peter Reutemann 25 Mar '18

25 Mar '18

'Pi Day was marked this year by the launch of the Raspberry Pi 3 Model B+ as the next evolution to this $35 ARM single-board computer. Phoronix has now put out Raspberry Pi 3 B+ benchmarks showing that the Ethernet performance is indeed much faster now but still doesn't stack up to other high performance boards, the SoC temperature is noticeably lower than the very warm Raspberry Pi 3, and the overall performance is a nice upgrade while retaining the same price point as its predecessors. Follow up tests looking at the Wi-Fi performance also show the new 802.11ac dual-band wireless to be much faster as well.' -- source: https://hardware.slashdot.org/story/18/03/25/0556258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Hate-Speech Laws In Europe
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

<https://www.techdirt.com/articles/20180321/17581339475/spanish-hate-anti-te…>: People are being arrested and charged with speech having nothing to with promoting hate or terrorism. ... It's gotten so bad Amnesty International -- an entity that usually spends its time decrying the acts of dictators and brutal authoritarians -- has felt compelled to speak up about Spain's terrible speech laws. ... The report also notes several other European countries are also beginning to curtail the rights of their citizens in their quest to target hate speech and international terrorism. Germany's hate speech law roll out has been an unmitigated disaster and other countries like France and Italy seem all too willing to join Spain and Germany in killing satire, parody, and content they just don't agree with. All of this is being done under the heading of "public safety," but in reality, the public is no safer and will develop an unhealthy fear of their own governments.

1 0

TLS 1.3 Has Been Approved
by Lawrence D'Oliveiro 24 Mar '18

24 Mar '18

The latest version of TLS (the official name for what used to be called “SSL”, i.e. the protocol that your browser uses for URLs beginning “https://”) is now an official IETF standard <http://www.theregister.co.uk/2018/03/23/tls_1_3_approved_ietf/>. This should not only make the setup of secure connections quicker, but also harder to crack. ... banks and businesses complained that, thanks to the way the new protocol does security, they will be cut off from being able to inspect and analyze TLS 1.3 encrypted traffic flowing through their networks, and so potentially be at greater risk from attack. Unfortunately, that self-same ability to decrypt secure traffic on your own network can also be potentially used by third parties to grab and decrypt communications. An effort to effectively insert a backdoor into the protocol was met with disdain and some anger by internet engineers, many of whom pointed out that it will still be possible to introduce middleware to monitor and analyze internal network traffic. Note the key phrase “forward secrecy”. This means that, even if your private key should become compromised down the track, this will still not help attackers decrypt any records they may have kept of your secure communications prior to that. And yes, you can expect the usual suspects to be unhappy about the introduction of such a feature.

1 0

Firefox In 2018: We'll Tackle Bad Ads, Breach Alerts, Autoplay Video, Says Mozilla
by Peter Reutemann 24 Mar '18

24 Mar '18

'Firefox maker Mozilla has outlined its 2018 roadmap to make the web less intrusive and safer for users. First up, Mozilla says it will proceed and implement last year's experiment with a breach alerts service, which will warn users when their credentials have been leaked or stolen in a data breach. Mozilla aims to roll out the service around October. Breach Alerts is based on security consultant Troy Hunt's data breach site Have I Been Pwned. Firefox will also implement a similar block on autoplay video to the one Chrome 66 will introduce next month, and that Safari already has. However, Dotzler says Firefox's implementation will "provide users with a way to block video auto-play that doesn't break websites". This feature is set to arrive in Firefox 62, which is scheduled for release in May. After Firefox 62 the browser will gain an optional Chrome-like ad filter and several privacy-enhancing features similar to those that Apple's WebKit developers have been working on for Safari's Intelligent Tracking Prevention. By the third quarter of 2018, Firefox should also be blocking ad-retargeting through cross-domain tracking. It's also going to move all key privacy controls into a single location in the browser, and offer more "fine-grained" tracking protection. Dotzler says Mozilla is in the "early stages" of determining what types of ads Firefox should block by default. Also on the roadmap is a feature that arrived in Firefox 59, released earlier this month. A new Global Permissions feature will help users avoid having to deny every site that requests permission for location, camera, microphone and notifications. Beyond security and privacy, Mozilla plans to build on speed-focused Quantum improvements that came in Firefox 57 with smoother page rendering.' -- source: https://news.slashdot.org/story/18/03/23/2110244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows Server 2019 Will Feature Linux and Kubernetes Support
by Peter Reutemann 22 Mar '18

22 Mar '18

'Microsoft announced this week that it will launch the next major release of Windows Server later this year with better support for hybrid workloads, Linux workloads, and hyper-converged infrastructure. >From a report: This release will succeed Windows Server 2016, which was made generally available in October 2016. While Microsoft moved to twice-yearly updates for Windows Server starting last year, the company bundles those changes into a long-term servicing channel once every two or three years for administrators who prefer less frequent releases. Those companies that haven't moved over to the semi-annual channel will get their first taste of Windows Server's Linux and Kubernetes support, which are currently in beta.' -- source: https://tech.slashdot.org/story/18/03/22/1647243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NVidia Titan V GPUs Giving Wrong Answers To Scientific Simulations
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

<http://www.theregister.co.uk/2018/03/21/nvidia_titan_v_reproducibility/>: Nvidia’s flagship Titan V graphics cards may have hardware gremlins causing them to spit out different answers to repeated complex calculations under certain conditions, according to computer scientists. ... Gamers and casual users will not notice any errors or issues, however folks running scientific software may encounter the glitches.

2 1

Artificial Intelligence And The Future of Online Content Moderation
by Lawrence D'Oliveiro 21 Mar '18

21 Mar '18

Report on a workshop on the use of artificial intelligence in governing communication online <https://freedom-to-tinker.com/2018/03/21/artificial-intelligence-and-the-fu…>: Over the course of the day, [the writer] learned many things about automated filtering that [he] hadn’t previously thought about. • Regulators and platforms are under tremendous pressure to act, based on the assumption that the technical problems are easy. • Takedown requests are a frequent instrument for censorship. • The larger platforms share content hashes of unwanted content, but the database and process are opaque. • Different countries have very different definitions of unlawful content. • Norms and speech evolve over time, often rapidly. In other words, it seems to me that, whether they are doing it deliberately or not, the regulators are pushing more and more power into the hands of the social-media platforms.

1 0

Mozilla Launches a Petition Asking Facebook To Do More For User Privacy
by Peter Reutemann 21 Mar '18

21 Mar '18

'After it was revealed that the personal data of 50 million Facebook users was shared without consent, Mozilla is calling on the social network to ensure that user privacy is protected by default, particularly when it comes to apps. Ashley Boyd, Mozilla's vice president of advocacy, says that billions of Facebook users are unknowingly at risk of having their data passed on to third parties. He says: "If you play games, read news or take quizzes on Facebook, chances are you are doing those activities through third-party apps and not through Facebook itself. The default permissions that Facebook gives to those third parties currently include data from your education and work, current city and posts on your timeline."' -- source: https://tech.slashdot.org/story/18/03/21/182253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD promises firmware fixes for security processor bugs
by Peter Reutemann 20 Mar '18

20 Mar '18

'AMD has responded to the reports last week of a range of security flaws affecting its Platform Security Processor (PSP) and chipset. The company acknowledges the bugs and says that, in coming weeks, it will have new firmware available to resolve the PSP bugs. These firmware fixes will also mitigate the chipset bugs.' -- source: https://arstechnica.com/gadgets/2018/03/amd-promises-firmware-fixes-for-sec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Unveils the 'World's Smallest Computer'
by Peter Reutemann 19 Mar '18

19 Mar '18

'On the first day of IBM Think 2018, the company's flagship conference, IBM has unveiled what it claims is the world's smallest computer. It's smaller than a grain of salt and features the computer power of the x86 chip from 1990. Mashable first spotted this gem: The computer will cost less than ten cents to manufacture, and will also pack "several hundred thousand transistors," according to the company. These will allow it to "monitor, analyze, communicate, and even act on data." It works with blockchain. Specifically, this computer will be a data source for blockchain applications. It's intended to help track the shipment of goods and detect theft, fraud, and non-compliance. It can also do basic AI tasks, such as sorting the data it's given. According to IBM, this is only the beginning. "Within the next five years, cryptographic anchors -- such as ink dots or tiny computers smaller than a grain of salt -- will be embedded in everyday objects and devices," says IBM head of research Arvind Krishna. If he's correct, we'll see way more of these tiny systems in objects and devices in the years to come. It's not clear yet when this thing will be released -- IBM researchers are currently testing its first prototype. ' -- source: https://hardware.slashdot.org/story/18/03/19/210245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19 'Tara' Cinnamon Will Be Faster
by Peter Reutemann 19 Mar '18

19 Mar '18

'Mint developers say they feel the app-launching time on the Linux distro seemed slow when using the Cinnamon desktop environment. So, they are working on fixing it. BetaNews reports: Windows build time was four times slower with Cinnamon compared to Metacity, while recovery time was nearly four times slower too. So yes, app-launching on Cinnamon -- as of today -- is slow comparatively. The big benefit to pinpointing a problem, however, is that it is the first step in solving it. And so, Linux Mint 19 Cinnamon will be faster as a result. "We developed a little script and a method to measure how long it took to flood the desktop environment with the creation of 200 windows. We could then measure the time reported by the script to build these 200 windows, and the time it actually took the desktop environment to recover from it and have these windows placed/mapped correctly and ready to be interacted with. Both measures were significantly higher in Cinnamon than in other desktops," says The Linux Mint Team.' -- source: https://linux.slashdot.org/story/18/03/19/1648259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Joins Group Working To 'Cure' Open-Source Licensing Issues
by Peter Reutemann 19 Mar '18

19 Mar '18

'Microsoft is joining Red Hat, Facebook, Google and IBM in committing to extending right to "cure" open source licensing noncompliance before taking legal measures. From a report: On March 19, officials from Microsoft -- along with CA Technologies, Cisco, HPE, SAP and SUSE -- said they'd work with open together with the already-committed vendors to provide more "predictability" for users of open source software. "The large ecosystems of projects using the GPLv2 and LGPLv2.x licenses will benefit from adoption of this more balanced approach to termination derived from GPLv3," explained Red Hat in a press release announcing the new license-compliance partners. The companies which have agreed to adopt the "Common Cure Rights Commitment" said before they file or continue to prosecute those accused of violating covered licenses, they will allow for users to cure and reinstate their licenses.' -- source: https://news.slashdot.org/story/18/03/19/1720228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0