- wlug - list.wlug.org.nz

When China Hoards Its Hackers Everyone Loses
by Peter Reutemann 18 Mar '18

18 Mar '18

'For over a decade Pwn2Own -- happening this week -- has brought together security talent from across the globe in a friendly hacking competition that is a cornerstone of research and advancement on par with Black Hat and Def Con. China's hackers routinely win, sweeping the board -- notably, the Tencent and Keen teams. Pwn2Own is good-natured, and all in the name of researchers finding big bugs, nabbing great bounties and drawing attention to security holes and zero-days that need to be fixed. But this year, according to Pwn2Own manager Brian Gorenc, China is no longer allowing its researchers to compete. Prior to the start of Pwn2Own this week, Gorenc told press "There have been regulatory changes in some countries that no longer allow participation in global exploit contests, such as Pwn2Own and Capture the Flag competitions." One thing's for certain: yearly champions Tencent's Keen Labs and Qihoo 360's 360Vulcan team are nowhere to be found and Trend Micro, the conference organizer, has confirmed to Engadget that there are no Chinese competitors in this year's competition. [...] It's a worrying development in the direction of isolationism and away from the benefits of competition in the spirit of improving security for all. It comes at a time when relations between the US and China strain under the weight of Huawei security concerns, which are not at all new, but are certainly coming to a head as American companies sever business ties with the firm.' -- source: https://it.slashdot.org/story/18/03/18/2042207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says
by Peter Reutemann 18 Mar '18

18 Mar '18

'For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."' -- source: https://it.slashdot.org/story/18/03/18/1930240 cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Community Considers a Crowd-Sourced Promo Video
by Peter Reutemann 17 Mar '18

17 Mar '18

'Slashdot reader Beacon11 writes that "Alan Pope, a community advocate for Ubuntu, has requested comments and ideas regarding the creation of a crowd-sourced promo video that, in 30 seconds, conveys that Ubuntu is for everyone." Alan Pope writes: So for example you might see a woman on a train typing an article, a guy in an office creating a presentation, a kid on the sofa playing a game with a controller on their TV, someone watching a film, someone developing code, kids playing with robots, a farmer planning animal feeding. You get the idea... So I'd really like to do this as a shared community project, with video clips submitted by Ubuntu users from around the world, perhaps even taking in a landmark or two here and there. I'd expect the video to represent the diversity of users, and variety of activities people are able to do with Ubuntu. Though they're currently just discussing its feasibility, Alan writes that "I think if we work together we could make something amazing."' -- source: https://news.slashdot.org/story/18/03/17/0524228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal "Reader's Choice Awards"
by Peter Reutemann 17 Mar '18

17 Mar '18

'The newly-relaunched Linux Journal is conducting its annual "Reader's Choice Awards," and this month announced the winners for Best Text Editor, Best Laptop, and Best Domain Registrar. Vim was chosen as the best editor by 35% of respondents, handily beating GNU Emacs (19%) Sublime Text (10%) and Atom (8%). Readers' Choice winner Vim is an extremely powerful editor with a user interface based on Bill Joy's 40-plus-year-old vi, but with many improved-upon features including extensive customization with key mappings and plugins. Linux Journal reader David Harrison points out another great thing about Vim "is that it's basically everywhere. It's available on every major platform." For best laptop their readers picked Lenovo (32%), followed by Dell (25%) and System76 (11%). The ThinkPad began life at IBM, but in 2005, it was purchased by Lenovo along with the rest of IBM's PC business. Lenovo evolved the line, and today the company is well known as a geek favorite. Lenovo's ThinkPads are quiet, fast and arguably have one of the best keyboards (fighting words!). Linux Journal readers say Lenovo's Linux support is excellent, leaving many to ponder why the company doesn't ship laptops with Linux installed. In February readers also voted on the best web browser, choosing Firefox (57%) over Chrome (17%) and Chromium (7%). And they also voted on the best Linux distribution, ultimately selecting Debian (33%), open SUSE (12%), and Fedora (11%).' -- source: https://linux.slashdot.org/story/18/03/17/0438256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel: Our Next Chips Won’t Have Data Leak Flaws We Told You Totally Not To Worry About
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<http://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/>: In public statements and private briefings to reporters and analysts, it has shifted from claiming these bugs are overblown and not a problem, to admitting they are a problem but are easy to mitigate, to confessing they are not so easy to mitigate but at least there are no ill effects, to conceding there are some ill effects but it's nothing to worry about, to finally confirming: the issues are so embarrassing, we've redesigned our processors to address the design blunders.

1 0

How A Norwegian Comment Section Turned Chaos Into Order—With A Simple Quiz
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turn…>: "It was a basic idea," NRKbeta developer Ståle Grut told a South By Southwest crowd on Tuesday. "Readers had to prove they read a story before they were able to comment on it."

1 0

New Raspberry Pi - Model 3B+
by Ian Stewart 14 Mar '18

14 Mar '18

A new model of Raspberry Pi single board computer was appropriately released yesterday (...being the 14th day of the 3rd month of the year, or Pi Day 3.14) Its the latest revision of their third-generation single-board computers. This model 3B+ is an enhanced version of the 3B, which was released two years ago. Some details<https://www.raspberrypi.org/blog/raspberry-pi-3-model-bplus-sale-now-35/>, the technical data sheet<http://www.farnell.com/datasheets/2582162.pdf?_ga=2.61358060.1158065867.152…>, and a 7 minute youtube clip<https://www.youtube.com/watch?v=zQZxdiz2UAs> Raspberry Pi 3 Model B+ is now on sale for US$35, and features: A 1.4GHz 64-bit quad-core ARM Cortex-A53 CPU Dual-band 802.11ac wireless LAN and Bluetooth 4.2 Faster Ethernet (Gigabit Ethernet over USB 2.0) Power-over-Ethernet support (with separate PoE HAT) Improved PXE network and USB mass-storage booting Improved thermal management A Power-over-Ethernet (PoE<https://en.wikipedia.org/wiki/Power_over_Ethernet>) Hat is to be released shortly. The R-Pi will default to attempting to do a PXE boot over Ethernet. Thus the R-Pi may be positioned and operated at quite a long physical distance from what is its supply of power and from where it loads its operating system. The NZ on-line outlet of Element14<http://nz.element14.com/raspberry-pi/2773729/raspberry-pi-3-model-b/dp/2842…> have the R-Pi 3B+ available at NZ $51.52 + $7.73 GST = $59.25 What is a little strange is the R-Pi Zero-W, released over a year ago, is still not available in NZ from Element14. cheers, Ian.

2 2

GNOME 3.28 'Chongqing' Linux Is Here
by Peter Reutemann 14 Mar '18

14 Mar '18

'GNOME 3.28 is the latest version of GNOME 3, and is the result of 6 months' hard work by the GNOME community. It contains several major new features, as well as many smaller improvements and bug fixes. In total, the release incorporates 24105 changes, made by approximately 778 contributors. The Project explains, "GNOME 3.28 comes with more beautiful things! First, and most significantly, GNOME's default interface font (called Cantarell) has undergone a significant update. Character forms and spacing have been evolved, so that text is more readable and attractive. Several new weights have also been added -- light and extra bold -- which are being used to produce interfaces that are both modern and beautiful. Other beautiful things include GNOME's collection of background wallpapers, which has been updated to include a lovely set of photographs, and the selection of profile pictures, which has been completely updated with attractive new images to pick from." Unfortunately, you can't just click on a button and upgrade to GNOME 3.28 today. Actually, for the most part, you will need to wait for it to become available for your operating system. Sadly, this can take a while. Fedora users, for instance, will have to wait for a major OS upgrade for it to become available. ' -- source: https://linux.slashdot.org/story/18/03/14/1624227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0

Let’s Encrypt takes free “wildcard” certificates live
by Peter Reutemann 14 Mar '18

14 Mar '18

'In July of 2017, the nonprofit certificate authority Let's Encrypt promised to deliver something that would put secure websites and Web applications within reach of any Internet user: free "wildcard" certificates to enable secure HTTP connections for entire domains. Today, Let's Encrypt took that promised service live, in addition to a new version of the Automated Certificate Management Environment (ACME) protocol, an interface that can be used by a variety of client software packages to automate verification of certificate requests. ACME version 2 "has gone through the IETF standards process," said Josh Aas, executive director of the Internet Security Research Group (ISRG), the group behind Let's Encrypt, in a blog post on the release. ACME v2 is currently a draft Internet Engineering Task Force standard, so it may not yet be in its final form. But the current version is the result of significant feedback from the industry. And its use is required to obtain wildcard certificates. In addition to the ACME v2 requirement, requests for wildcard certificates require the modification of a Domain Name Service "TXT" record to verify control over the domain—a similar method to that used by Google and other service providers to prove domain ownership. But much of this can be automated by hosting providers that provide DNS services. A single Let's Encrypt account can request up to 300 wildcard certificates over a period of three hours, allowing a hosting provider to handle requests for customers who may not have shell access to their sites.' -- source: https://arstechnica.com/information-technology/2018/03/lets-encrypt-takes-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Rowan Schischka 13 Mar '18

13 Mar '18

>And yet here we are, watching prosecutorial discretion morph into >putting someone's head on a platter over recovery disks any one of us >could download hundreds of times from Microsoft's website without a >single murmur about "lost sales" from the tech giant. Just because something is available online without a fee does not mean it can be treated as public domain. The punishment may not appear to reasonably fit the crime, but this is what was laid out by lawmakers. I would hope a reasonable fine would be equivalent to what an OEM would profit from selling a disc. I worked in anti-piracy a few years back, I should have given a lecture on licensing while I was in Hamilton. Microsoft is very smart in taking money.

2 1

Researchers Find Critical Vulnerabilities in AMD's Ryzen and EPYC Processors, But They Gave the Chipmaker Only 24 Hours Before Making the Findings Public
by Peter Reutemann 13 Mar '18

13 Mar '18

'Alfred Ng, reporting for CNET: Researchers have discovered critical security flaws in AMD chips that could allow attackers to access sensitive data from highly guarded processors across millions of devices. Particularly worrisome is the fact that the vulnerabilities lie in the so-called secure part of the processors -- typically where your device stores sensitive data like passwords and encryption keys. It's also where your processor makes sure nothing malicious is running when you start your computer. CTS-Labs, a security company based in Israel, announced Tuesday that its researchers had found 13 critical security vulnerabilities that would let attackers access data stored on AMD's Ryzen and EPYC processors, as well as install malware on them. Ryzen chips power desktop and laptop computers, while EPYC processors are found in servers. The researchers gave AMD less than 24 hours to look at the vulnerabilities and respond before publishing the report. Standard vulnerability disclosure calls for 90 days' notice so that companies have time to address flaws properly. An AMD spokesperson said, "At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings," an AMD spokesman said. Zack Whittaker, a security reporter at CBS, said: Here's the catch: AMD had less than a day to look at the research. No wonder why its response is so vague.' -- source: https://it.slashdot.org/story/18/03/13/1558221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 59, 'By Far the Biggest Update Since Firefox 1.0', Arrives With Faster Page Loads and Improved Private Browsing
by Peter Reutemann 13 Mar '18

13 Mar '18

'Mozilla today launched Firefox 59 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 59 brings faster page load times, private browsing mode that strips path information, and Android Assist. In related news, Mozilla is giving Amazon Fire TV owners a new design later this week that lets them save their preferred websites by pinning them to the Firefox home screen. Enterprise users also have something to look forward to: On Wednesday, Firefox Quantum for Enterprise is entering the beta phase. Firefox 59 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.' -- source: https://tech.slashdot.org/story/18/03/13/1623251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN
by Peter Reutemann 13 Mar '18

13 Mar '18

'A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.' -- source: https://yro.slashdot.org/story/18/03/13/1836218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
by Peter Reutemann 12 Mar '18

12 Mar '18

'Stating with Firefox 60 -- expected to be released in May 2018 -- websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information. >From a report: Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs. But at the start of the month, Mozilla engineers decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default. This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors. The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.' -- source: https://news.slashdot.org/story/18/03/12/1641205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Lawrence D'Oliveiro 12 Mar '18

12 Mar '18

<https://www.techdirt.com/articles/20180223/17294539295/microsoft-helps-get-…>: Someone dedicates his life to keeping landfills free of harmful material and the government wants to send him to prison. And it's all based on Microsoft's assertion it would have sold as many recovery disks as Lundgren created if only Lundgren hadn't created them. Ignored is the fact they never were distributed. Also ignored is the dubiousness of "lost sales" assertions, which are always 100% conjecture and always presented as a simplistic equation: "1 Piracy = 1 Lost Sale." But in this case, no sales were lost because no sales were replaced with bootleg boot disks. And "sales" must be a legal term of art. Microsoft allows anyone to download a recovery disk for free. But in court, these are suddenly worth money because infringement. To ensure someone gets tossed in jail for breaking the chain of planned obsolescence, Microsoft (and prosecutors) want the court to believe the existence of recovery disks that do nothing unless a person already has a licensed copy of Windows has somehow made the company $700,000 poorer. Given the limitations of burned recovery disks, it's impossible to see where infringement even comes into play. And yet here we are, watching prosecutorial discretion morph into putting someone's head on a platter over recovery disks any one of us could download hundreds of times from Microsoft's website without a single murmur about "lost sales" from the tech giant.

1 0

Command Line Text Processing
by Peter Reutemann 11 Mar '18

11 Mar '18

Useful tutorials: https://github.com/learnbyexample/Command-line-text-processing Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz

1 0

SgxSpectre Attack Can Extract Data From Intel SGX Enclaves
by Peter Reutemann 11 Mar '18

11 Mar '18

'A new variation of the Spectre attack has been revealed this week by six scientists from the Ohio State University. Named SgxSpectre, researchers say this attack can extract information from Intel SGX enclaves. Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more... Neither Meltdown and Spectre were able to extract data from SGX enclaves. This is where SgxSpectre comes in. According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to implement SGX support into their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX. Academics say an attacker can leverage the repetitive code execution patterns that these SDKs introduce in SGX enclaves and watch for small variations of cache size. This allows for side-channel attacks that allow a threat actor to infer and slowly recover data from secure enclaves. Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16. Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.' -- source: https://it.slashdot.org/story/18/03/10/0446211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 9.4 Released
by Peter Reutemann 11 Mar '18

11 Mar '18

'The Debian project is pleased to announce the fourth update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. Phoronix adds that Debian 9.4 "has a new upstream Linux kernel release, various dependency fixes for some packages, an infinite loop fix in Glade, several CVE security fixes, a larger stack size for NTP, a new upstream release of their NVIDIA proprietary driver package, Python 3 dependency fixes, and other security fixes."' -- source: https://linux.slashdot.org/story/18/03/10/2120216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Developer McHardy Drops GPLv2 'Shake Down' Case
by Peter Reutemann 11 Mar '18

11 Mar '18

'Former Linux developer Patrick McHardy dropped his Gnu General Public License version 2 (GPLv2) violation case against Geniatech in a German court this week. ZDNet explains why some consider this a big "win": People who find violations typically turn to organizations such as the Free Software Foundation, Software Freedom Conservancy (SFC), and the Software Freedom Law Center to approach violators. These organizations then try to convince violating companies to mend their ways and honor their GPLv2 legal requirements. Only as a last resort do they take companies to court to force them into compliance with the GPLv2. Patrick McHardy, however, after talking with SFC, dropped out from this diplomatic approach and has gone on his own way. Specifically, McHardy has been accused of seeking his own financial gain by approaching numerous companies in German courts. Geniatech claimed McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions... In July 2016, the Netfilter developers suspended him from the core team. They received numerous allegations that he had been shaking down companies. McHardy refused to discuss these issues with them, and he refused to sign off on the Principles of Community-Oriented GPL Enforcement. In October 2017, Greg Kroah-Hartman, Linux kernel maintainer for the stable branch, summed up the Linux kernel developers' position. Kroah-Hartman wrote: "McHardy has sought to enforce his copyright claims in secret and for large sums of money by threatening or engaging in litigation...." Had McHardy continued on his way, companies would have been more reluctant to use Linux code in their products for fear that a single, unprincipled developer could sue them and demand payment for his copyrighted contributions... McHardy now has to bear all legal costs for both sides of the case. In other words, when McHardy was faced with serious and costly opposition for the first time, he waved a white flag rather than face near certain defeat in the courts. ' -- source: https://linux.slashdot.org/story/18/03/10/2323242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Well, It Got Them To The Moon And Back ...
by Lawrence D'Oliveiro 10 Mar '18

10 Mar '18

... and only crashed twice‡. Source code <https://github.com/chrislgarry/Apollo-11/blob/master/Luminary099/LUNAR_LAND…>, and note the comments on lines 179 and 180: # TEMPORARY, I HOPE HOPE HOPE ‡The famous “1202 alarm” and “1201 alarm” incidents during the landing.

1 0

Microsoft Throttles On-Prem Tech Donation Scheme For Nonprofits
by Lawrence D'Oliveiro 09 Mar '18

09 Mar '18

Cloud services will be cheaper, but actually buying premium versions of products will cost more <http://www.theregister.co.uk/2018/03/09/microsoft_charity_donation_shakeup/>. Clearly pushing people towards the rental option. Which means, when the corporate largesse runs out, the charity is left with nothing. Kind of like what has happened at the Enderley Community Centre, with all their Adobe CC products: when the funding ran out, the software stopped being usable.

1 0

Hardcoded Password Found in Cisco Software
by Peter Reutemann 08 Mar '18

08 Mar '18

'Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system. From a report: The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers. Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password. The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical." Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.' -- source: https://it.slashdot.org/story/18/03/08/145209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Disabling Super-Key App-Menu Shortcut In KDE
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

Another new “feature” that KDE has acquired in the last few months is that you just have to press and release the Super (aka “Windows”†) modifier key, and the application menu will appear. This annoys me because I frequently lean on modifier keys while thinking about whether to use them, then release them when I change my mind. And then this damn menu pops up. As is usual with KDE, turning this off is pretty easy, but in this case it’s a little counterintuitive. If you right-click on the app-menu icon in the taskbar, you can choose the “Application Launcher Settings” item in the menu that appears (the name might vary a little bit depending on which particular app menu widget you have installed). In the settings dialog that comes up, you will see two panes to choose from, “Appearance” and “Keyboard shortcuts”. Naturally you go to “Keyboard shortcuts”, only to see an entry showing Alt-F1 as the trigger keystroke. So where do you control the use of the Super key? Never fear. Remove this Alt-F1 setting, and the special behaviour of the Super key disappears as well. †No, it doesn’t have a Windows logo on my Das Keyboard Pro 4. It’s imprinted with some kind of indescribable wing-like symbol.

1 0

Ask Slashdot: Should We Worry Microsoft Will 'Embrace, Extend, and Extinguish' Linux?
by Peter Reutemann 07 Mar '18

07 Mar '18

'While there is no proof that anything nefarious is afoot, it does feel like maybe the Windows-maker is hijacking the Linux movement a bit by serving distros in its store. I hope there is no "embrace, extend, and extinguish" shenanigans going on. Just yesterday, we reported that Kali Linux was in the Microsoft Store for Windows 10. That was big news, but it was not particularly significant in the grand scheme, as Kali is not very well known. Today, there is some undeniably huge news -- Debian is joining SUSE, Ubuntu, and Kali in the Microsoft Store. Should the Linux community be worried? My concern lately is that Microsoft could eventually try to make the concept of running a Linux distro natively a thing of the past. Whether or not that is the company's intention is unknown. The Windows maker gives no reason to suspect evil plans, other than past negative comments about Linux and open source. For instance, former Microsoft CEO Steve Ballmer once called Linux "cancer" -- seriously.' -- source: https://tech.slashdot.org/story/18/03/07/159249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

British Military Spends More On Computers Than Weapons And Ammo
by Lawrence D'Oliveiro 07 Mar '18

07 Mar '18

From <http://www.theregister.co.uk/2018/03/07/mod_spends_more_computers_than_weap…>: Spending on weapons and ammunition for the Armed Forces totalled £1.15bn in fiscal year 2016/17, whereas the MoD spent £1.45bn on computer services in the same period. For the four prior years, spending on computers consistently outpaced that for arms and ammo, with half a billion more being spent on computers than weapons in 2015/16. ... Only shipbuilding and repairing, aircraft and spacecraft, and "technical and financial services" spending outpaced the MoD's expenditure on computers. Even construction, at £1.20bn, lagged behind it.

1 0

Google Launches First Android P Developer Preview
by Peter Reutemann 07 Mar '18

07 Mar '18

'Google today launched the first Android P developer preview, available for download now at developer.android.com. From a report: The preview includes an updated SDK with system images for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, and the official Android Emulator. Unlike last year, there is no emulator for testing Android Wear on Android P. [...] Today's preview includes the following new APIs and features (but you can expect much more; this is just the first preview, after all): Display cutout support; HDR VP9 Video, HEIF image compression, and Media APIs; HEIF (heic) images encoding has been added to the platform; multi-camera API; ImageDecoder for bitmaps and drawables; Improved messaging notifications; Data cost sensitivity in JobScheduler; indoor positioning with Wi-Fi RTT: Platform support for the IEEE 802.11mc WiFi protocol -- also known as WiFi Round-Trip-Time (RTT) -- lets you take advantage of indoor positioning in your apps.' -- source: https://tech.slashdot.org/story/18/03/07/1811201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Turning Off Software Update Notifications In KDE
by Lawrence D'Oliveiro 06 Mar '18

06 Mar '18

Seems the latest version of KDE includes an automatic notifier when there are system updates available. This is great for, shall we say, “normal” users. But I run Debian Unstable. Which means I will be nagged for more updates within a matter of hours after doing a system upgrade, and things will rapidly go downhill from there. So naturally I would rather turn these off completely. The obvious place to find this setting would be in the “Notifications” panel in the System Settings. Unfortunately, the “Event source:” menu lists about three dozen different sources of notification events, and it isn’t obvious (at least, it wasn’t to me) which one handles software updates. The answer is, it’s the one called “Discover”. You will see only one event in its list: “Updates Are Available”. Simply uncheck all the forms of notification for this event. Hmm, I wonder if this panel couldn’t do with a search box...?

1 0

No Safe Haven For Victims Of Digital Abuse
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Blocking messages from online abusers -- and even changing your identity to get away from them -- may work fine against someone on the other side of the world. But what if the abuser is your close partner? <https://slate.com/technology/2018/03/apps-cant-stop-exes-who-use-technology…>: When you learn that your privacy has been compromised, the common advice is to prevent additional access—delete your insecure account, open a new one, change your password. But in abusive romantic relationships, disconnection can be extremely fraught. For one, it can put the victim at risk of physical harm: If abusers expect digital access and that access is suddenly closed off, it can lead them to become more violent or intrusive in other ways. It may seem cathartic to delete abusive material, like alarming text messages—but if you don’t preserve that kind of evidence, it can make prosecution more difficult. And closing some kinds of accounts, like social networks, to hide from a determined abuser can cut off social support that survivors desperately need. (Found from <https://www.schneier.com/blog/archives/2018/03/intimate_partne.html>)

1 0

Libre Content Creation: 2018 In Perspective
by Lawrence D'Oliveiro 05 Mar '18

05 Mar '18

Nice roundup <http://libregraphicsworld.org/blog/entry/2018-in-perspective> from Alexandre Prokoudine on where a bunch of Free graphics/audio/video projects have gone and where they are likely to go over the coming year. Gimp 2.10 continues to be delayed, but in return the list of goodies promised continues to lengthen: The team initially intended v2.10 to be more or less a GEGL-based upgrade of v2.8 plus high bit depth precision support. Needless to say, the plan hasn't exactly worked: there will be a lot more than that. In fact, even now, when only critical bugs are supposed to be worked on, the team cannot resist making improvements that aren't blocking the release. Another interesting one is an initiative in Germany to come up with a nonproprietary alternative to common colour specifications like Pantone: In December 2017, FreieFarbe e.V. announced that their initiative for „Open Colour Communication“ standard was supported by DIN and will become a DIN SPEC (which is the first step towards DIN Norm). It is claimed that DIN intends to turn this into an international standard via ISO later. The FreieFarbe / FreeColour initiative aims to provide an open alternative to Pantone, HKS, and other proprietary colour systems. They argue that unlike Pantone and some other proprietary manufacturers like RAL, FreiFarbe has an actual color system. On the music-production front, Zyn-Fusion seems to be developing as the successor to the venerable ZynAddSubFX, while VCV Rack is the candidate for the ultimate software modular synth, complete with rat’s nest of (virtual) connecting wires. (I’ve seen a demo or two on YouTube.)

1 0

Re: [wlug] FreeBSD's New Code of Conduct
by William Mckee 27 Feb '18

27 Feb '18

virtual contact! none of that. more sjw bs. cheers, william. On 21/02/2018 7:08 pm, "Lawrence D'Oliveiro" <ldo(a)geek-central.gen.nz> wrote: On Sun, 18 Feb 2018 11:25:31 +1300, Peter Reutemann quoted: > '> Physical contact and simulated physical contact (e.g., textual > descriptions like "hug" or "backrub") without consent or after a > request to stop.' From <http://www.theregister.co.uk/2018/02/21/freebsd_code_of_ conduct_controversy/>: OpenSUSE board member and YouTuber Bryan Lunduke has used his YouTube channel <https://www.youtube.com/watch?v=SxNdQJSlg54> to ask if FreeBSD also wants to regulate virtual high fives or fist bumps. Lunduke's video is a rather more polite expression of comments found in corners of the Internet where gender politics is derided and debate is sometimes infamously uncivil. _______________________________________________ wlug mailing list | wlug(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

2 1

Mozilla Removes Individual Cookie Management in Firefox 60
by Peter Reutemann 26 Feb '18

26 Feb '18

'The most recent version of Firefox Nightly, currently at version 60, comes with changes to Firefox's cookie management. Mozilla merged cookie settings with site data in the web browser which impacts how you configure and manage cookie options. If you run Firefox 59 or earlier, you can load about:preferences#privacy to manage privacy related settings in Firefox. If you set the history to "use custom settings for history" or "remember history", you get an option manage cookie settings and to remove individual cookies from Firefox. A click on the link or button opens a new browser window in which all set cookies are listed. You can use it to find set cookies, look up information, remove selected or all cookies. Mozilla engineers changed this in recent versions of Firefox 60 (currently on the Nightly channel).' -- source: https://news.slashdot.org/story/18/02/26/1853203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox - turning off processes per tab
by Peter Reutemann 26 Feb '18

26 Feb '18

Hi everyone In case you don't like Firefox's new feature of separating tabs into separate processes (far more resource hungry), change the following setting in "about:config" to "false": browser.tabs.remote.auto Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

OpenBSD Releases Meltdown Patch
by Peter Reutemann 25 Feb '18

25 Feb '18

'OpenBSD's Meltdown patch has landed, in the form of a Version 11 code update that separates user memory pages from the kernel's -- pretty much the same approach as was taken in the Linux kernel. From a report: A few days after the Meltdown/Spectre bugs emerged in January, OpenBSD's Phillip Guenther responded to user concerns with a post saying the operating system's developers were working out what to do. Now he's revealed the approach used to fix the free OS: "When a syscall, trap, or interrupt takes a CPU from userspace to kernel the trampoline code switches page tables, switches stacks to the thread's real kernel stack, then copies over the necessary bits from the trampoline stack. On return to userspace the opposite occurs: recreate the iretq frame on the trampoline stack, switch stack, switch page tables, and return to userspace." That explanation is somewhat obscure to non-developers, but there's a more readable discussion of what the project's developers had in mind from January, here.' -- source: https://it.slashdot.org/story/18/02/23/1519245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Botched npm Update Crashes Linux Systems, Forces Users to Reinstall
by Peter Reutemann 22 Feb '18

22 Feb '18

'A bug in npm (Node Package Manager), the most widely used JavaScript package manager, will change ownership of crucial Linux system folders, such as /etc, /usr, /boot. Changing ownership of these files either crashes the system, various local apps, or prevents the system from booting, according to reports from users who installed npm v5.7.0. -- the buggy npm update. Users who installed this update -- mostly developers and software engineers -- will likely have to reinstall their system from scratch or restore from a previous system image.' -- source: https://it.slashdot.org/story/18/02/22/2034213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ricoh MP C3003 or similar wanted
by Gregory Machin 22 Feb '18

22 Feb '18

Hi, This is very off topic. I'm working on script (currently powershell, my port to python)to manage (backup and restore) the addess book on Ricoh printers. The idea is to be able to manage large number of printers address books. I'm looking for a printer I can use for my dev work. It I don't care if the printer or scanner are faulty just need to brains to be functional. If anyone has such I could have or loan for a couple of months, that would be great. If not all good. Many thanks G

1 0

Google To Cease “Offshoring” Local Revenue
by Lawrence D'Oliveiro 21 Feb '18

21 Feb '18

Wonder of wonders <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11999548>: Government moves to crack down on tax avoidance by multinational firms are already bearing fruit, with Google telling Parliament it will no longer funnel New Zealand revenues via low-tax jurisdictions such as Singapore. ... The practice saw Google's New Zealand subsidiary provide only services as part of the sales process - paying just $356,000 in tax on only $12.2m in revenue. Estimates of Google's sales revenue from New Zealand range in the hundreds of millions of dollars annually.

1 0

uTorrent Client Affected by Some Pretty Severe Security Flaws
by Peter Reutemann 21 Feb '18

21 Feb '18

'A Google security researcher has found multiple security flaws affecting the uTorrent web and desktop client that allow an attacker to infect a victim with malware or collect data on the users' past downloads, reports BleepingComputer. From the report: The vulnerabilities have been discovered by Google Project Zero security researcher Tavis Ormandy, and they impact uTorrent Web, a new web-based version of the uTorrent BitTorrent client, and uTorrent Classic, the old uTorrent client that most people know. Ormandy says that both uTorrent clients are exposing an RPC server -- on port 10000 (uTorrent Classic) and 19575 (uTorrent Web). The expert says that attackers can hide commands inside web pages that interact with this open RPC server. The attacker only needs to trick a user with a vulnerable uTorrent client to access a malicious web page. Furthermore, the uTorrent clients are also vulnerable to DNS rebinding -- a vulnerability that allows the attacker to legitimize his requests to the RPC server.' -- source: https://it.slashdot.org/story/18/02/21/180206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Has a New Spectre and Meltdown Firmware Patch For You To Try Out
by Peter Reutemann 21 Feb '18

21 Feb '18

'The Spectre/Meltdown debacle continues to rumble on, and now the chip manufacturer has announced the availability of a new 'microcode solution' to the vulnerability. The updated firmware applies to 6th, 7th and 8th Generation Intel Core devices, and the release sees the company crossing its fingers and hoping that everything works out this time. This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.' -- source: https://it.slashdot.org/story/18/02/21/186257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FreeBSD's New Code of Conduct
by Peter Reutemann 21 Feb '18

21 Feb '18

'FreeBSD has a new code of conduct, which is making several people angry. From the blog post: This code of conduct applies to all spaces used by the FreeBSD Project, including our mailing lists, IRC channels, and social media, both online and off. Anyone who is found to violate this code of conduct may be sanctioned or expelled from FreeBSD Project controlled spaces at the discretion of the FreeBSD Code of Conduct Committee. Participants are responsible for knowing and abiding by these rules. Harassment includes but is not limited to: Comments that reinforce systemic oppression related to gender, gender identity and expression, sexual orientation, disability, mental illness, neurodiversity, physical appearance, body size, age, race, or religion. Unwelcome comments regarding a person's lifestyle choices and practices, including those related to food, health, parenting, drugs, and employment. Deliberate misgendering. Deliberate use of "dead" or rejected names. Gratuitous or off-topic sexual images or behaviour in spaces where they're not appropriate. Physical contact and simulated physical contact (e.g., textual descriptions like "hug" or "backrub") without consent or after a request to stop. Threats of violence. Incitement of violence towards any individual, including encouraging a person to commit suicide or to engage in self-harm. Deliberate intimidation. Stalking or following. Harassing photography or recording, including logging online activity for harassment purposes. Sustained disruption of discussion. Unwelcome sexual attention. Pattern of inappropriate social contact, such as requesting/assuming inappropriate levels of intimacy with others. Continued one-on-one communication after requests to cease. Deliberate "outing" of any private aspect of a person's identity without their consent except as necessary to protect vulnerable people from intentional abuse. Publication of non-harassing private communication without consent. Publication of non-harassing private communication with consent but in a way that intentionally misrepresents the communication (e.g., removes context that changes the meaning). Knowingly making harmful false claims about a person.' -- source: https://yro.slashdot.org/story/18/02/17/0826206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to Get Started Using WSL in Windows 10
by Peter Reutemann 20 Feb '18

20 Feb '18

'In this article, we will walk through the process of getting started with WSL on your Windows 10 machine. You must be running the latest version of Windows 10 with Fall Creator Update installed. Then, check which version of Windows 10 is installed on your system by searching on “About” in the search box of the Start menu. You should be running version 1709 or the latest to use WSL. If an older version is installed, you need to download and install the Windows 10 Fall Creator Update (FCU) from this page. Once FCU is installed, go to Update Settings (just search for “updates” in the search box of the Start menu) and install any available updates.' -- source: https://www.linux.com/blog/learn/2018/2/how-get-started-using-wsl-windows-10 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

meeting next Monday
by Peter Reutemann 20 Feb '18

20 Feb '18

Hi everyone Just to let you know that we have a meeting next Monday: 'Ian Young will be demoing Manjaro (https://manjaro.org/) a Linux distribution that has become very popular recently according to the Linux Journal's poll (https://linux.slashdot.org/story/18/02/14/1850259) General discussion on backup tools and strategies: What tool do you use? What approach is working for you? What should you stay away from at all costs?' Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246736977/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

cron Is Becoming Obsolete
by Lawrence D'Oliveiro 20 Feb '18

20 Feb '18

I have to get out of the habit of (only) checking various /etc/cron* locations for periodic system tasks. Debian is making more and more use of systemd timer tasks. The nice thing is, you can see them all with a simple command: systemctl status \*.timer Got caught out with this on a client’s machine the other day: when you install the certbot package (for managing certificates issued by Let’s Encrypt) on Debian, it also automatically adds a systemd timer to run certificate renewals twice a day, you don’t need to set up your own cron task to manage this.

1 0

Chrome Extension Brings 'View Image' Button Back
by Peter Reutemann 19 Feb '18

19 Feb '18

'Google recently removed the convenient "view image" button from its search results as a result of a lawsuit with stock-photo agency Getty. Thankfully, one day later, a developer created an extension that brings it back. 9to5Google reports: It's unfortunate to see that button gone, but an easy to use Chrome extension brings it back. Simply install the extension from the Chrome Web Store, and then any time you view an image on Google Image Search, you'll be able to open that source image. You can see the functionality in action in the video below. The only difference we can see with this extension versus the original functionality is that instead of opening the image on the same page, it opens it in a new tab. The extension is free, and it will work with Chrome for Windows, Mac, Chrome OS, or anywhere else the full version of Chrome can be used. 9to5Google has a separate post with step-by-step instructions to get the Google Images "view image" button back.' -- source: https://tech.slashdot.org/story/18/02/19/0334208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite
by Peter Reutemann 15 Feb '18

15 Feb '18

'ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder. ' -- source: https://it.slashdot.org/story/18/02/12/2319257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Wants To Collect Data About Your System -- Starting With 18.04 LTS
by Peter Reutemann 15 Feb '18

15 Feb '18

' In an announcement on Ubuntu mailing list, Will Cooke, on behalf of the Ubuntu Desktop team, announced Canonical's plans to collect some data related to the users' system configuration and the packages installed on their machines. From a report: Before you read anything further, it's important to note that users will have the option to opt-out of this data collection. The company plans to add a checkbox to the installer, which would be checked by default. The option could be like: "Send diagnostics information to help improve Ubuntu." As per your convenience, you can opt-out during the installation. An option to do the same will also be made available in the Privacy panel of GNOME Settings. With this data collection, the team wishes to improve the daily experiences of the Ubuntu users. It's worth noting that the collected data will be sent over encrypted connections and no IP addresses will be tracked. To be precise, the collected data will include: flavour and version of Ubuntu, network connectivity or not, CPU family, RAM, disk(s) size, screen(s) resolution, GPU vendor and model, OEM manufacturer, location (based on the location selection made during install), no IP information, time taken for Installation, auto-login enabled or not, disk layout selected, third party software selected or not, download updates during install or not, livePatch enabled or not.' -- source: https://news.slashdot.org/story/18/02/15/1410203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DeepFakes Explained
by Lawrence D'Oliveiro 15 Feb '18

15 Feb '18

Heard about the latest hot new trend on the Internet? Slightly disturbing, even? It’s splicing someone’s face into a video in place of that of an entirely unrelated person, to make it look like they’re the one in the scene. Except that the result doesn’t look fake at all--you’d think it was real. Naturally, Rule 34 applies. But here <https://www.youtube.com/watch?v=7XchCsYtYMQ> is a watchable, and entirely SFW, overview of how it all works. Oh, and the software for doing this is all over GitHub.

2 2

Manjaro at meeting
by Ian Young 15 Feb '18

15 Feb '18

I have been using Manjaro of late so could try to summon up something to say ~ IanY

2 1

Critical Telegram flaw under attack disguised malware as benign images
by Peter Reutemann 14 Feb '18

14 Feb '18

'Makers of the Telegram instant messenger have fixed a critical vulnerability that hackers were actively exploiting to install malware on users' computers, researchers said Tuesday. The flaw, which resided in the Windows version of the messaging app, allowed attackers to disguise the names of attached files, researchers from security firm Kaspersky Lab said in a blog post. By using the text-formatting standard known as Unicode, attackers were able to cause characters in file names to appear from right to left, instead of the left-to-right order that's normal for most Western languages.' -- source: https://arstechnica.com/information-technology/2018/02/telegram-app-purged-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft’s compiler-level Spectre fix shows how hard this problem will be to solve
by Peter Reutemann 14 Feb '18

14 Feb '18

'The Meltdown and Spectre attacks that use processor speculative execution to leak sensitive information have resulted in a wide range of software changes to try to limit the scope for harm. Many of these are operating system-level fixes, some of which depend on processor microcode updates. But Spectre isn't a simple attack to solve; operating system changes help a great deal, but application-level changes are also needed. Apple has talked about some of the updates it has made to the WebKit rendering engine, used in its Safari browser, but this is only a single application. Microsoft is offering a compiler-level change for Spectre. The "Spectre" label actually covers two different attacks. The one that Microsoft's compiler is addressing, known as "variant 1," concerns checking the size of an array: before accessing the Nth element of an array, code should check that the array has at least N elements in it. Programmers using languages like C and C++ often have to write these checks explicitly. Other languages, like JavaScript and Java, perform them automatically. Either way, the test has to be done; attempts to access array members that don't exist are a whole class of bugs all on their own. [...] In fairness, Microsoft does warn that "there is no guarantee that all possible instances of variant 1 will be instrumented," but as Kocher's examination shows, it's not simply that some Spectre-vulnerable code will escape the compiler's fixes. Much—and perhaps even most—Spectre-vulnerable code will escape. And even if it were only a few instances, bad guys would be able to locate the unprotected routines and focus their attacks accordingly.' -- source: https://arstechnica.com/gadgets/2018/02/microsofts-compiler-level-spectre-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0