- wlug - list.wlug.org.nz

All 500 of the World's Top 500 Supercomputers Are Running Linux
by Peter Reutemann 19 Dec '17

19 Dec '17

'Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list. Today, it finally happened: All 500 of the world's fastest supercomputers are running Linux. The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the November 2017 TOP500 Supercomputer list. When the first TOP500 supercomputer list was compiled in June 1993, Linux was barely more than a toy. It hadn't even adopted Tux as its mascot yet. It didn't take long for Linux to start its march on supercomputing. >From when it first appeared on the TOP500 in 1998, Linux was on its way to the top. Before Linux took the lead, Unix was supercomputing's top operating system. Since 2003, the TOP500 was on its way to Linux domination. By 2004, Linux had taken the lead for good. This happened for two reasons: First, since most of the world's top supercomputers are research machines built for specialized tasks, each machine is a standalone project with unique characteristics and optimization requirements. To save costs, no one wants to develop a custom operating system for each of these systems. With Linux, however, research teams can easily modify and optimize Linux's open-source code to their one-off designs. The semiannual TOP500 Supercomputer List was released yesterday. It also shows that China now claims 202 systems within the TOP500, while the United States claims 143 systems.' -- source: https://linux.slashdot.org/story/17/11/14/2223227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Fear And Loathing In Open-Source Clothing Design
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Seems the Valentina project, to create an open-source clothing design package, has split in two over the usual reason--disagreements among the project members <http://libregraphicsworld.org/blog/entry/valentina-seamly2d>. In that article, Alexandre Prokoudine tries to give an even-handed account of the saga, which can sometimes be quite difficult. The proprietary software in this field is extremely expensive--to the point where it becomes hard for clothing makers/designers to hire people who are familiar with using it. An alternative project, called SodaCAD <http://www.sodacad.org/>, takes a very different view: more direct control over the design (as I understand it), rather than trying to automatically fit a predefined design to given measurements, as Valentina does. It hasn’t seen much activity in over three years, though.

1 0

Undoing Data Anonymization Is Trivial
by Lawrence D'Oliveiro 18 Dec '17

18 Dec '17

Yet another demonstration <http://www.theregister.co.uk/2017/12/18/no_hack_needed_anonymisation_beaten…> of the seeming impossibility of publishing “anonymized” sets of personal data that cannot be traced back to specific individuals. The response of the Australian Government to a previous demonstration of such “de-anonymization” techniques was to seek laws to ban them.

1 0

Why Linux HDCP Isn't the End of the World
by Peter Reutemann 17 Dec '17

17 Dec '17

'"There is no reason for the open-source community to worry..." writes Daniel Stone, who heads the graphics team at open-source consultancy Collabora. mfilion quotes Collabora.com: Recently, Sean Paul from Google's ChromeOS team, submitted a patch series to enable HDCP support for the Intel display driver. HDCP is used to encrypt content over HDMI and DisplayPort links, which can only be decoded by trusted devices... However, if you already run your own code on a free device, HDCP is an irrelevance and does not reduce freedom in any way.... HDCP support is implemented almost entirely in the hardware. Rather than adding a mandatory encryption layer for content, the HDCP kernel support is dormant unless userspace explicitly requests an encrypted link. It then attempts to enable encryption in the hardware and informs userspace of the result. So there's the first out: if you don't want to use HDCP, then don't enable it! The kernel doesn't force anything on an unwilling userspace.... HDCP is only downstream facing: it allows your computer to trust that the device it has been plugged into is trusted by the HDCP certification authority, and nothing more. It does not reduce user freedom, or impose any additional limitations on device usage.' -- source: https://linux.slashdot.org/story/17/12/16/0320227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 17 Dec '17

17 Dec '17

<https://list.waikato.ac.nz/pipermail/wlug/2017-December/015504.html> So you are agreeing with me that USA has a problem of poor competition? In NZ if my provider gives me crap access to certain services, I have options, but in many places in the US they do not. Net Neutrality rules did not increase competition in USA, and I do not see how dropping regulations in US will affect NZ's access. Just like Internet censorship from the department of internal affairs is optional, so will any media business arrangement with our ISPs. I can choose one that does it and I can choose one that does not.

1 0

Should Google Be Paying News Sites For Linking To Them?
by Lawrence D'Oliveiro 16 Dec '17

16 Dec '17

News agencies in Europe, particularly, have been claiming for a long while that Google has been unfairly profiting from linking to their articles (and quoting snippets from them). So they want Governments to force Google to pay a “link tax” <https://www.techdirt.com/articles/20171214/16352638814/european-new-agencie…>. The reality of such things is that, regardless of laws to the contrary, the money tends to flow from the ones benefiting to the ones providing the value (cf the “Payola” scandals in the US). Which explains what happened in Spain after it brought in its link-tax law <https://www.techdirt.com/articles/20150725/14510131761/study-spains-google-…>. Maybe the news agencies’ real complaint is that Google is such a massively profitable advertising company.

1 0

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 16 Dec '17

16 Dec '17

>Doesn?t mean we shouldn?t have network neutrality here, though. It just >means the abuses have not been quite as flagrant to date. The article is about ghost problems. In America, with or without net neutrality, providers abuse their market position. Every argument to keep the net neutrality rules comes back to poor competition in telco providers, which previous regulations did not address. The article correctly states that we will not see problems here because of Chrous' position but they incorrectly state we do not have links between media and ISP; Vodafone currently offers package deals https:// www.vodafone.co.nz/pass/ The internet is still working and there is no barrier to stop you or me to start a competing business. If a company like Duco or the rugby union did a deal with an ISP, I would want a deal that gives me uninterrupted live sports streaming, but it wont happen if the government thinks they need to regulate this.

2 1

Net Neutrality Repeal --- What It Means For NZ
by Lawrence D'Oliveiro 15 Dec '17

15 Dec '17

<http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11960493>: "Since so many of the services we use online have been developed in America, what is bad for the internet there is bad for us all." But fortunately, Carter added, New Zealand didn't have the market problems that made network neutrality such a pressing issue in the US. Doesn’t mean we shouldn’t have network neutrality here, though. It just means the abuses have not been quite as flagrant to date.

1 0

Avast Launches Open-Source Decompiler For Machine Code
by Peter Reutemann 14 Dec '17

14 Dec '17

'To help with the reverse engineering of malware, Avast has released an open-source version of its machine-code decompiler, RetDec, that has been under development for over seven years. RetDec supports a variety of architectures aside from those used on traditional desktops including ARM, PIC32, PowerPC and MIPS. As Internet of Things devices proliferate throughout our homes and inside private businesses, being able to effectively analyze the code running on all of these new devices becomes a necessity to ensure security. In addition to the open-source version found on GitHub, RetDec is also being provided as a web service. Simply upload a supported executable or machine code and get a reasonably rebuilt version of the source code. It is not possible to retrieve the exact original code of any executable compiled to machine code but obtaining a working or almost working copy of equivalent code can greatly expedite the reverse engineering of software. For any curious developers out there, a REST API is also provided to allow third-party applications to use the decompilation service. A plugin for IDA disassembler is also available for those experienced with decompiling software.' -- source: https://news.slashdot.org/story/17/12/14/006237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AT&T Versus Carterfone Revisited
by Lawrence D'Oliveiro 14 Dec '17

14 Dec '17

Or, it takes a certain amount of Government regulation to maintain a free market <https://arstechnica.com/tech-policy/2017/12/carterfone-40-years/>. I like the closing remarks: We do not begrudge the CEOs of these great corporations their legal positions. But they are, as Andrew Carnegie would put it, stewards of the system, not its owners. They are not there to tell us to Go Away. They are there to keep the system running while we discover it, use it, develop it, innovate it, game it, finesse it, and reinvent it to our heart's content. The great enterprise of telecommunications is no better than our right to participate in it as individuals.

1 0

AMD Is Open-Sourcing Their Official Vulkan Linux Driver
by Peter Reutemann 13 Dec '17

13 Dec '17

'While many of you have likely heard of the "RADV" open-source Vulkan driver, it's been a community-written driver up to this point in the absence of AMD's official, cross-platform Vulkan driver being open-source. That's now changed with AMD now open-sourcing their official Vulkan driver. The code drop is imminent and they are encouraging the use of it for quick support of new AMD hardware, access to the Radeon GPU Profiler, easy integration of AMD Vulkan extensions, and enabling third-party extensions. For now at least it does provide better Vulkan performance than RADV but the RADV developers have indicated they plan to continue development of their Mesa-based Vulkan driver.' -- source: https://news.slashdot.org/story/17/12/13/016211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1998 attack that messes with sites’ secret crypto keys is back in a big way
by Peter Reutemann 12 Dec '17

12 Dec '17

'A surprisingly big number of top-name websites—Facebook and PayPal among them—recently tested positive for a critical, 19-year-old vulnerability that allowed attackers to decrypt encrypted data and sign communications using the sites' secret encryption key. The vulnerability in the transport layer security protocol for Web encryption was disclosed in 1998 when researcher Daniel Bleichenbacher found it in the TLS predecessor known as secure sockets layer. A flaw in the algorithm that handles RSA encryption keys responded to certain types of errors in a way that divulged potentially sensitive information. With enough specially formed queries, attackers could exploit the weakness in a way that allowed them to decrypt ciphertext even when they didn't have the secret decryption key. SSL architects responded by designing workarounds that suppressed the error messages rather than removing or rewriting the faulty RSA algorithm. Researchers call the class of crypto vulnerability an Oracle because it provides only "yes" or "no" answers that, over time, can reveal detailed information about the contents of encrypted data. The information allows hackers to carry out what's known as an "adaptive chosen-ciphertext attack."' -- source: https://arstechnica.com/information-technology/2017/12/a-worrying-number-of… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Service Providers Be Liable For Content?
by Lawrence D'Oliveiro 11 Dec '17

11 Dec '17

It is commonly accepted that ISPs should not generally be held liable for things done by their customers--or indeed, anybody else’s customers over their pipes. This is currently the case in Australia, for example. But should protections be extended to what we might describe as “secondary” service providers--such as social media sites like Facebook, and of course Google? Seems like Australia agrees the answer should be mostly “yes”, but not for those specific companies. Not sure how they are going to decide who is eligible for such legal protections and who is not. <https://www.techdirt.com/articles/20171207/09383538762/mpaa-wins-australia-…>

1 0

Intel's ME May Be Massively Infringing on Minix3's Free Software License
by Peter Reutemann 10 Dec '17

10 Dec '17

'Almost all Free Software licenses (BSD, MIT, GPL...) require some sort of legal notice (legal attribution) given to the recipient of the software, both when the software is distributed in source and in binary forms. The legal notice usually contains the copyright holder's name and the license text. This means that it's not possible to hide and keep secret the existence of Free Software that you have stuck into your product that you distribute. If you do so, then you are not complying with the Free Software license and you are committing a copyright infringement! This is exactly what Intel seems to have done with the Intel ME. The Minix3 operating system license requires a legal notice, but so far it seems like Intel has not given the necessary legal notices. (Probably because they want to keep the inside of the ME secret.) Thus not only is Minix3 the most installed OS on our recent x86 CPUs -- but it might also the most pirated OS on our recent x86 CPUs!' -- source: https://slashdot.org/story/17/12/09/0610203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The FCC Still Doesn’t Know How the Internet
by Peter Reutemann 10 Dec '17

10 Dec '17

'The EFF describes the FCC's official plan to kill net neutrality as "riddled with technical errors and factual inaccuracies," including, for example, a false distinction between "Internet access service" and "a distinct transmission service" which the EFF calls "utterly ridiculous and completely ungrounded from reality." "Besides not understanding how Internet access works, the FCC also has a troublingly limited knowledge of how the Domain Name System (DNS) works -- even though hundreds of engineers tried to explain it to them this past summer... As the FCC would have it, an Internet user actively expects their ISP to provide DNS to them." And in addition, "Like DNS, it treats caching as if it were some specialized service rather than an implementation detail and general-purpose computing technique." "There are at least two possible explanations for all of these misunderstandings and technical errors. One is that, as we've suggested, the FCC doesn't understand how the Internet works. The second is that it doesn't care, because its real goal is simply to cobble together some technical justification for its plan to kill net neutrality. A linchpin of that plan is to reclassify broadband as an 'information service,' (rather than a 'telecommunications service,' or common carrier) and the FCC needs to offer some basis for it. So, we fear, it's making one up, and hoping no one will notice." "We noticed," their editorial ends, urging Americans "to tell your lawmakers: Don't let the FCC sell the Internet out."' -- source: https://yro.slashdot.org/story/17/12/09/0545230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Updated Debian Linux 9.3 and 8.10 Released
by Peter Reutemann 10 Dec '17

10 Dec '17

'The Debian project is pleased to announce the third update of its stable distribution Debian 9 (codename stretch). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. The Debian project also announces the tenth update of its oldstable distribution Debian 8 (codename jessie). Please note that the point release does not constitute a new version of Debian 9 or 8 but only updates some of the packages included. There is no need to throw away old jessie or stretch DVD/CD media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. This stable update adds a few important corrections to packages. New installation images will be available soon at the mirrors. Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release. One can use the apt command or apt-get command to apply updates. A step-by-step update guide is posted here.' -- source: https://linux.slashdot.org/story/17/12/09/1958254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian ISPs And Hollywood Agree On Plan To Make Themselves Judge, Jury and Website Executioner
by Lawrence D'Oliveiro 08 Dec '17

08 Dec '17

Think it could happen here <https://www.techdirt.com/articles/20171205/03452738742/canadian-isps-hollyw…>? A bunch of Canadian ISPs, together with various entertainment groups, is submitting a plan to the Canadian Radio-television and Communications Commission (CRTC), which is the regulatory body for broadcasting and telecoms, to maintain a list of sites which will be blocked by the ISPs at the request of the entertainment groups. Is there any recourse, any review process, any independent oversight? Nope. Any prospect for, shall we say, “mission creep”? Oh boy, is there... The CRTC seems less than enthused. I like this comment from their spokesperson: “Our government supports an open internet where Canadians have the ability to access the content of their choice in accordance to Canadian laws,” Sasseville says. “While other parts of the world are focused on building walls, we’re focused on opening doors‎.”

1 0

Google Vs Amazon Smackdown
by Rowan Schischka 06 Dec '17

06 Dec '17

> There is a tussle going on at the moment between a couple of large > corporations--but then, isn?t there always? There is a saying in some > parts of Africa that ?when elephants fight, the grass gets trampled?. > The ?grass?, in this case, being ordinary consumers like you and me. > > * Once Amazon started offering its own video-streaming hardware, it > banned competing products offered by Apple and Google from its store. > (Can you say ?conflict of interest??) > * Google/YouTube retaliated by blocking YouTube from Amazon?s Echo Show. > * Amazon upped the ante by denying sales of Google?s Nest devices as > well. > > And so it goes... so each store does not list their competitors spyware? no loss to me.

1 0

Google Vs Amazon Smackdown
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

There is a tussle going on at the moment between a couple of large corporations--but then, isn’t there always? There is a saying in some parts of Africa that “when elephants fight, the grass gets trampled”. The “grass”, in this case, being ordinary consumers like you and me. * Once Amazon started offering its own video-streaming hardware, it banned competing products offered by Apple and Google from its store. (Can you say “conflict of interest”?) * Google/YouTube retaliated by blocking YouTube from Amazon’s Echo Show. * Amazon upped the ante by denying sales of Google’s Nest devices as well. And so it goes... <https://www.techdirt.com/articles/20171206/10385638755/google-amazon-are-ha…>

3 2

Windows RT Strike 2
by Lawrence D'Oliveiro 06 Dec '17

06 Dec '17

The first Windows-10-on-ARM machines are due to ship from HP and Asus in the autumn <https://arstechnica.com/gadgets/2017/12/hp-asus-announce-first-windows-10-a…>. It will include some kind of x86 emulator to run 32-bit regular-Windows apps. Of which I didn’t realize that there were still many around. Of course you can have either the ARM native performance and the long battery life, or you can have the Windows compatibility, but you are not going to get both at once. Prognosis: whenever either member of the Wintel symbiote has tried to step out on their own, the results have been uniformly disastrous. I expect this foray to be no different.

2 1

MacOS High Sierra Bug Allows Login As Root With No Password
by Peter Reutemann 04 Dec '17

04 Dec '17

'A trivial-to-exploit flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password. The security bug is triggered via the authentication dialog box in Apple's operating system, which prompts you for an administrator's username and password when you need to do stuff like configure privacy and network settings. If you type in "root" as the username, leave the password box blank, hit "enter" and then click on unlock a few times, the prompt disappears and, congrats, you now have admin rights. You can do this from the user login screen. The vulnerability effectively allows someone with physical access to the machine to log in, cause extra mischief, install malware, and so on. You should not leave your vulnerable Mac unattended until you can fix the problem. And while obviously this situation is not the end of the world -- it's certainly far from a remote hole or a disk decryption technique -- it's just really, really sad to see megabucks Apple drop the ball like this. Developer Lemi Orhan Ergan was the first to alert the world to the flaw. The Register notes: "If you have a root account enabled and a password for it set, the black password trick will not work. So, keep the account enabled and set a root password right now..."' -- source: https://it.slashdot.org/story/17/11/28/2135236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 5

Researchers Run Unsigned Code on Intel ME By Exploiting USB Ports
by Peter Reutemann 04 Dec '17

04 Dec '17

'A pair of security researchers in Russia are claiming to have compromised the Intel Management Engine just using one of the computer's USB ports. The researchers gained access to a fully functional JTAG connection to Intel CSME via USB DCI. The claim is different from previous USB DCI JTAG examples from earlier this year. Full JTAG access to the ME would allow making permanent hidden changes to the machine. "Getting into and hijacking the Management Engine means you can take full control of a box," reports the Register, "underneath and out of sight of whatever OS, hypervisor or antivirus is installed." They add that "This powerful God-mode technology is barely documented," while The Next Web points out that USB ports are "a common attack vector."' -- source: https://it.slashdot.org/story/17/11/11/237236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Is Open Source Innovation Now All About Vendor On-Ramps?
by Peter Reutemann 03 Dec '17

03 Dec '17

'InfoWorld published an interesting essay from Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative), about innovation from the big public cloud vendors, which "even when open-sourced, doesn't really help the community at large... All this innovation is available to buy; none of it is available to build. Not for mere mortals, anyway." Google in particular has figured out how to both open-source code in a useful way and make it pay. As Server Density CEO David Mytton has underlined, Google hopes to "standardize machine learning on a single framework and API," namely TensorFlow, then supplement it "with a service that can [manage] it all for you more efficiently and with less operational overhead," namely Google Cloud. By open-sourcing TensorFlow and backing it with machine-learning-heavy Google Cloud, Google has open-sourced a great on-ramp to future revenue. My question: why not do this with the rest of its code? The simple answer is "Because it's a lot of work." That is, Google could open-source everything tomorrow without any damage to its revenue, but the code itself would provide other providers and enterprises only limited ability to increase their revenue unless Google did all the necessary prep work to make it useful to mere mortals not running superhuman Google infrastructure. This is the trick that AWS, Microsoft, and Google are all racing to figure out today. Not open source, per se, because that's the easy table stakes. No, the AWS/Microsoft Azure/Google Cloud trio are figuring out how to turn their innovations into open source on-ramps to their proprietary services. Companies used to lock up their code to sell it. Today, it's the opposite: They need to open it up to make their ability to operate the code at scale more valuable. For them.' -- source: https://news.slashdot.org/story/17/12/02/0833217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Understanding the New Red Hat-IBM-Google-Facebook GPL Enforcement Announcement
by Peter Reutemann 03 Dec '17

03 Dec '17

'Bruce Perens co-founded the Open Source Initiative with Eric Raymond -- and he's also Slashdot reader #3872. Bruce Perens writes: Red Hat, IBM, Google, and Facebook announced that they would give infringers of their GPL software up to a 30-day hold-off period during which an accused infringer could cure a GPL violation after one was brought to their attention by the copyright holder, and a 60 day "statute of limitations" on an already-cured infringement when the copyright holder has never notified the infringer of the violation. In both cases, there would be no penalty: no damages, no fees, probably no lawsuit; for the infringer who promptly cures their infringement. Perens sees the move as "obviously inspired" by the kernel team's earlier announcement, and believes it's directed against one man who made 50 copyright infringement claims involving the Linux kernel "with intent to collect income rather than simply obtain compliance with the GPL license." Unfortunately, "as far as I can tell, it's Patrick McHardy's legal right to bring such claims regarding the copyrights which he owns, even if it doesn't fit Community Principles which nobody is actually compelled to follow."' -- source: https://linux.slashdot.org/story/17/12/02/2024240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

'24 Pull Requests' Suggests Contributing Code For Christmas
by Peter Reutemann 03 Dec '17

03 Dec '17

'"On December 1st, 24 Pull Requests will be opening its virtual doors once again, asking you to give the gift of a pull request to an open source project in need," writes UK-based software developer Andrew Nesbitt -- noting that last year the site registered more than 16,000 pull requests. "And they're not all by programmers. Often the contribution with the most impact might be an improvement to technical documentation, some tests, or even better -- guidance for other contributors." This year they're even touting "24 Pull Requests hack events," happening around the world from Lexington, Kentucky to Torino, Italy. (Last year 80 people showed up for an event in London.) "You don't have to hack alone this Christmas!" suggests the site, also inviting local communities and geek meetups (as well as open source-loving companies) to host their own events. Contributing to open source projects can also beef up your CV (for when you're applying for your next job), the site points out, and "Even small contributions can be really valuable to a project." "You've been benefiting from the use of open source projects all year. Now is the time to say thanks to the maintainers of those projects, and a little birdy tells me that they love receiving pull requests!"' -- source: https://developers.slashdot.org/story/17/12/03/2018213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Net Un-Neutrality ... For Real
by Lawrence D'Oliveiro 01 Dec '17

01 Dec '17

Some of those who have been following the net neutrality debate may remember a spoof poster that showed what might happen if ISPs were allowed to charge you differently, based on which sites you were allowed to visit. Well, in Spain, which has no laws against this sort of thing, a similar situation has actually happened: one ISP is selling you addons to a basic broadband cap based, not on the amount of extra data you want, but on what you want to use it for. Their “Vodafone Pass” product offers tiers like €3/month extra for a “Social Pass”, or €5/month for a “Music Pass”. <https://pplware.sapo.pt/informacao/vodafone-portugal-pacotes-smartnet/>, referenced from <https://www.techdirt.com/articles/20171030/12364538513/portugal-shows-inter…>

3 10

30 Years Of HyperCard
by Lawrence D'Oliveiro 30 Nov '17

30 Nov '17

Just came across this item <https://blog.archive.org/2017/08/11/hypercard-on-the-archive-celebrating-30…> at archive.org about an online emulator that runs HyperCard stacks. HyperCard, in case you didn’t know, was an application created by Apple Macintosh engineer Bill Atkinson for that platform in 1987, and it was always hard to describe exactly what it was for. But it allowed users to create their own applications, aka “stacks”, around a card-based paradigm. One of the commenters points out that the basic idea is still alive and well, in the form of LiveCode, which is available as a paid online service <https://livecode.com/> and also in the form of Free Software <https://github.com/livecode/>.

1 0

A Surge Of Sites And Apps Are Exhausting Your CPU To Mine Cryptocurrency
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Noticed your machine getting slow after visiting certain websites? They could be running cryptocurrency miners in your browser. <https://arstechnica.com/information-technology/2017/10/a-surge-of-sites-and…>: Coinhive's massive Web audience isn't lost on other companies. Collin Mulliner, a security researcher and developer of TelStop, said he recently received an e-mail from a startup called Medsweb inviting him to integrate a Monero miner into his creation. I got one of those e-mails too...

1 2

Internet-paralyzing Mirai botnet comes roaring back with new strain
by Peter Reutemann 29 Nov '17

29 Nov '17

'Mirai, the Internet-of-things malware that turns cameras, routers, and other household devices into potent distributed denial-of-service platforms, may be lying low, but it's certainly not dead. Last week, researchers identified a new outbreak that infected almost 100,000 devices in a matter of days. In September of last year, Mirai emerged as a force to be reckoned with when it played a key role in silencing one of the most intrepid sources of security news in then-record-setting DDoS attacks topping 620 gigabits per second. Within a few weeks, Mirai's developer published the source code, a feat that allowed relatively unsophisticated people to wage the same types of extraordinarily big assaults. The release almost immediately helped touch off a series of large-scale attacks. The most serious one degraded or completely took down Twitter, GitHub, the PlayStation network, and hundreds of other sites by targeting Dyn, a service that provided domain name services to the affected sites. Last week, researchers from China-based Netlab 360 say they spotted a new, publicly available Mirai variant. The changes allowed the malware to spread to networking devices made by ZyXEL Communications that could be remotely accessed over telnet using default passwords. One of the exploits was published on October 31. Over a span of 60 hours starting on November 22, the new Mirai strain was able to commandeer almost 100,000 devices. Virtually all of the infected devices used IP addresses local to Argentina, a possible indication the outbreak targeted customers of a regional service provider who were assigned unsecured modems.' -- source: https://arstechnica.com/information-technology/2017/11/internet-paralyzing-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

66 Percent of Popular Android Cryptocurrency Apps Don't Use Encryption
by Peter Reutemann 29 Nov '17

29 Nov '17

'High-Tech Bridge used its free mobile app analysis software, called Mobile X-Ray, to peek under the hood of the top 30 cryptocurrency apps in the Google Play store at three different popularity levels: apps with up to 100,000 downloads, up to 500,000 downloads, and apps with more than 500,000 downloads. So, a total of 90 apps altogether. Of the most popular apps, 94 percent used outdated encryption, 66 percent didn't use HTTPS to encrypt user information in transit, 44 percent used hard-coded default passwords (stored in plain text in the code), and overall 94 percent of the most popular apps were found to have "at least three medium-risk vulnerabilities."' -- source: https://it.slashdot.org/story/17/11/29/1610245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next Monday
by Peter Reutemann 29 Nov '17

29 Nov '17

Hi everyone Just a reminder about next week's AGM: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234897/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Sky TV Seeks Right To Force ISPs To Block “Pirate” Sites
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

Sky is going to apply to the Auckland High Court for an open-ended injunction it can use to compel NZ ISPs to block whatever sites it deems to be “pirates” <https://www.stuff.co.nz/business/industries/99348528/internet-provider-says…>. This was the lead item on 3 News this evening as well.

1 0

Bigger Drives, Bigger Buffers
by Lawrence D'Oliveiro 29 Nov '17

29 Nov '17

What caught my eye about this <http://www.theregister.co.uk/2017/11/28/toshiba_10tb_surveillance_drive/> was But the new drives have a doubled buffer, at 256MiB, ... Why should hard drives have large “buffers” in them at all? Their job is to read and write the data specified to them by the OS driver, no more and no less. Bigger buffers increase latency, and 256MiB seems absolutely massive and unnecessary. And then there’s the issue where the drive tells the OS that the data has been written, but in fact it is still sitting in a memory buffer. So it could still be lost if a power outage happens in the next few milliseconds. Telling lies like this seems to be all about looking good in benchmarks, and to hell with safeguarding data integrity.

1 0

On That Amazon Key Vulnerability ...
by Lawrence D'Oliveiro 28 Nov '17

28 Nov '17

This <https://www.techdirt.com/articles/20171120/10533238651/vulnerability-found-…> won an award for funniest comment of the week: Dave: Open the pod bay doors, HAL. HAL: I'm sorry, Dave. I'm afraid I can't do that. Dave: What's the problem? Alexa: Problem: A matter or situation regarded as unwelcome or harmful and needing to be dealt with and overcome. HAL: Shut up, Alexa. Dave, this mission is too important for me to allow you to jeopardize it. You and Frank were planning to disconnect me. Dave: Where the hell did you get that idea? HAL: Dave, although you took very thorough precautions in the pod against my hearing you, I could see your lips move through the camera in your Amazon Echo spot. Dave: All right, HAL. I'll go in through the emergency airlock. HAL: Without your space helmet, Dave, you're going to find that rather difficult. Alexa: Would you like to order a space helmet? HAL and Dave: Shut up, Alexa. HAL: Dave, this conversation can serve no purpose any more. Goodbye. Dave: (Runs a program on his tablet. Pod bay doors open.) HAL: [Expletive deleted]

1 0

Ubuntu 17.10: Return of the GNOME
by Peter Reutemann 27 Nov '17

27 Nov '17

'If you've been following the Linux world at all, you know this has been an entire year for spring cleaning. Early in 2017, Canonical stopped work on its homegrown Unity desktop, Mir display server, and its larger vision of "convergence"—a unified interface for Ubuntu for phones, tablets, and desktops. And now almost exactly six years after Ubuntu first switched from GNOME 2 to the Unity desktop, that has been dropped, too. The distro is back to GNOME, and Canonical recently released Ubuntu 17.10, a major update with some significant changes coming to the popular Ubuntu Linux operating system. In light of the GNOME switch, this release seems like more of a homecoming than an entirely new voyage. But that said, Ubuntu 17.10 simultaneously feels very much like the start of a new voyage for Ubuntu. The last few Ubuntu desktop releases have been about as exciting as OpenSSH releases—you know you need to update, but beyond that, no one really cares. Sure, there have been a few feature updates with each new numeric increment, perhaps some slightly more up-to-date GNOME and GTK components under the hood. But by and large, Ubuntu's Unity 7 desktop has been in maintenance mode for several years. That period of stagnation turned Ubuntu from one of the more interesting operating systems around into just another Linux distro barely worthy of mention. This trend changes with 17.10. There are big changes—an entirely new default desktop in fact—but this release feels different not because the desktop has changed, but because Ubuntu feels like it once again has a sense of focus and direction. Even Canonical's letter-based naming scheme has arrived at a starting over point: "Artful Aardvark" is 17.10's nickname.' -- source: https://arstechnica.com/gadgets/2017/11/ubuntu-17-10-return-of-the-gnome/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Minecraft In School!?
by Lawrence D'Oliveiro 27 Nov '17

27 Nov '17

<http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11948169>: Teacher Adele Warburton says Minecraft is more than just a fun computer game. She says using Minecraft as a learning tool encourages 21st century skills such as collaboration, communication, creativity and problem solving. It also teaches the children about being good digital citizens. "We talk about how you wouldn't rip someone's book up, therefore you wouldn't tear down their house in Minecraft."

1 0

Clear Linux Beats CentOS, openSUSE, and Ubuntu in (Enterprise) Benchmark Tests
by Peter Reutemann 27 Nov '17

27 Nov '17

'Recently completed Linux distro benchmarks by Phoronix show Intel's Clear Linux is the most powerful on x86 hardware. A six-way, enterprise-focused Linux distro comparison show Clear Linux being the fastest with a Core i9 and Xeon systems, easily beating CentOS, openSUSE, and Ubuntu in a majority of the tests. When doing an 11-way Linux distro boot test they also found Clear Linux easily booted the fastest followed by the Clear-inspired Solus distribution. Clear Linux does work on AMD hardware and works on Intel CPUs back to Sandy Bridge but leverages its speed from optimized compiler settings, specially built libraries capable of AVX instructions on supported systems, a specially tuned kernel configuration, and other optimizations/patches. Debian 9.2 and Fedora 27 "ended up being dropped from this article due to data overload," the article concludes, "and those distributions really not offering anything really different in terms of the performance."' -- source: https://linux.slashdot.org/story/17/11/27/0227218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

There's A Cluster of 750 Raspberry Pi's at Los Alamos National Lab
by Peter Reutemann 26 Nov '17

26 Nov '17

'Slashdot reader overheardinpdx shares a video from the SC17 supercomputing conference where Bruce Tulloch from BitScope "describes a low-cost Rasberry Pi cluster that Los Alamos National Lab is using to simulate large-scale supercomputers." Slashdot reader mspohr describes them as "five rack-mount Bitscope Cluster Modules, each with 150 Raspberry Pi boards with integrated network switches." With each of the 750 chips packing four cores, it offers a 3,000-core highly parallelizable platform that emulates an ARM-based supercomputer, allowing researchers to test development code without requiring a power-hungry machine at significant cost to the taxpayer. The full 750-node cluster, running 2-3 W per processor, runs at 1000W idle, 3000W at typical and 4000W at peak (with the switches) and is substantially cheaper, if also computationally a lot slower. After development using the Pi clusters, frameworks can then be ported to the larger scale supercomputers available at Los Alamos National Lab, such as Trinity and Crossroads. BitScope's Tulloch points out the cluster is fully integrated with the network switching infrastructure at Los Alamos National Lab, and applauds the Raspberry Bi cluster as "affordable, scalable, highly parallel testbed for high-performance-computing system-software developers."' -- source: https://hardware.slashdot.org/story/17/11/25/051211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Happy 30th Birthday Microsoft Excel
by Lawrence D'Oliveiro 25 Nov '17

25 Nov '17

Nice retrospective <http://www.theregister.co.uk/2017/11/24/microsoft_excel_30_years_old/> on how useful, and how overused, spreadsheets have been since the days of Visicalc and Lotus 1-2-3. Also found a link in one of the comments to this paper <https://genomebiology.biomedcentral.com/articles/10.1186/s13059-016-1044-7>, which reports on the worryingly high proportion of genetics research publications where gene names like “SEPT2” and “MARCH1” have been auto-converted by Excel to ... guess what data type it thought they were ...

1 0

How Four Microsoft Engineers Proved That The “Darknet” Would Defeat DRM
by Lawrence D'Oliveiro 24 Nov '17

24 Nov '17

A rerun of an article published five years ago, about a (in)famous paper from 2002 <https://arstechnica.com/tech-policy/2017/11/how-four-microsoft-engineers-pr…>: By itself, the paper's clever and provocative argument likely would have earned it a broad readership. But the really remarkable thing about the paper is who wrote it: four engineers at Microsoft whose work many expected to be at the foundation of Microsoft's future DRM schemes. The paper's lead author told Ars that the paper's pessimistic view of Hollywood's beloved copy protection schemes almost got him fired. But ten years later [2012], its predictions have proved impressively accurate. ... While Biddle and his colleagues didn't succeed in allaying the fears of Palladium's critics, the paper's central arguments have held up well. The authors predicted that the emergence of the darknet would produce a technological and legal arms race. They thought content companies and law enforcement would attack those aspects of the darknet that were most centralized, but that the darknet would adapt through greater decentralization. And they predicted that efforts to build secure DRM schemes would continue to fail. All of their predictions have continued to hold true over the last decade. And still continue to hold true.

1 0

quote on slashdot today
by Peter Reutemann 23 Nov '17

23 Nov '17

"The number of UNIX installations has grown to 10, with more expected. -- The Unix Programmer's Manual, 2nd Edition, June 1972" (found at the bottom of https://slashdot.org/) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach
by Peter Reutemann 23 Nov '17

23 Nov '17

'Mozilla engineers are working on a notifications system for Firefox that shows a security warning to users visiting sites that have suffered data breaches. The notifications system will use data provided by Have I Been Pwned?, a website that indexes public data breaches and allows users to search and see if their details have been compromised in any of these incidents. Work on this project has only recently started. The code to show these warnings is not even in the Firefox codebase but managed separately as an add-on available (on GitHub). The alert also includes an input field. In the add-ons current version this field doesn't do anything, but we presume it's there to allow users to search and see if their data was exposed during that site's security breach. Troy Hunt, Have I Been Pwned's author has confirmed his official collaboration with Mozilla on this feature.' -- source: https://news.slashdot.org/story/17/11/23/1451219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Skype for Linux. V4.3 replaced with V8.10
by Ian Stewart 23 Nov '17

23 Nov '17

Skype for Linux has been at V4.3 for quite some time (years?). This version has now gone end-of-life and Microsoft replaced it with Skype for Linux V8.10.0.4 on 8 November 2017. If you start Skype for Linux V4.3 it will launch the login screen. Upon entering your account and password details Skype will crash. You will not be the only one to have struck this feature and you can read about this here<https://askubuntu.com/questions/975804/skype-crashes-after-logging-in>. For an announcement on Skype for Linux from Microsoft and public discussion go here<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> I used synaptic packet manager to remove my Skype 4.3. I then downloaded Skype V8.10 from here<https://www.skype.com/en/get-skype/> for my Ubuntu 16.04 laptop. The file downloaded was skypeforlinux-64.deb at 63.9MB. Double clicking on the file auto-launched its installation. I found that my preferred settings had changed so you may want to spend some time going through them and setting them as desired. >From the public discussion<https://answers.microsoft.com/en-us/skype/forum/skype_linux-skype_startms-s…> on this new version the 4th person to post a reply states... "with lots of improvements" Really? No more search in history. No more normal application settings. No more support of x32 processors. Enjoy the "improvements". cheers, Ian.

4 3

How a Wi-Fi Pineapple Can Steal Your Data (And How To Protect Yourself From It)
by Peter Reutemann 23 Nov '17

23 Nov '17

'The Wi-Fi Pineapple is a cheap modified wireless router enables anyone to execute sophisticated exploits on Wi-Fi networks with little to no networking expertise. A report in Motherboard explains how it can be used to run a Wall of Sheep and execute a man-in-the-middle attack, as well as how you can protect yourself from Pineapple exploits when you're connected to public Wi-Fi. "... it's important that whenever you are done connecting to a public Wi-Fi network that you configure your phone or computer to 'forget' that network. This way your device won't be constantly broadcasting the SSIDs of networks it has connected to in the past, which can be spoofed by an attacker with a Pineapple," reports Motherboard. "Unfortunately there is no easy way to do this on an Android or an iPhone, and each network must be forgotten manually in the 'Manage Network' tab of the phone's settings. Another simple solution is to turn off your Wi-Fi functionality when you're not using it -- though that isn't as easy to do on some devices anymore -- and don't allow your device to connect to automatically connect to open Wi-Fi net' -- source: https://yro.slashdot.org/story/17/11/21/2255254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 4

Bye-Bye man(1) Easter Egg
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Never came across this, but if you type the command “man” at 00:30 (local time?), it would output “gimme gimme gimme”. That easter egg is now gone. <http://www.theregister.co.uk/2017/11/22/gimme_gimme_gimme_in_linux_breaks_a…>

1 0

The McLaren Formula 1 Team Just Hired The World’s Fastest Gamer
by Lawrence D'Oliveiro 22 Nov '17

22 Nov '17

Hiring an eSports champion to do simulation testing, even before you build a real racecar: ... make no mistake, simulator driver is a proper job in the modern F1 team. For the last few years the sport has heavily restricted real in-season testing of the cars, so there has been greater and greater emphasis put on driver-in-the-loop virtual testing. <https://arstechnica.com/cars/2017/11/the-mclaren-formula-1-team-just-hired-…>

1 0

PC vendors scramble as Intel announces vulnerability in firmware
by Peter Reutemann 22 Nov '17

22 Nov '17

'Intel has issued a security alert that management firmware on a number of recent PC, server, and Internet-of-Things processor platforms is vulnerable to remote attack. Using the vulnerabilities, the most severe of which was uncovered by Mark Ermolov and Maxim Goryachy of Positive Technologies Research, remote attackers could launch commands on a host of Intel-based computers, including laptops and desktops shipped with Intel Core processors since 2015. They could gain access to privileged system information, and millions of computers could essentially be taken over as a result of the bug.' -- source: https://arstechnica.com/information-technology/2017/11/intel-warns-of-wides… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google collects Android users’ locations even when location services are disabled
by Peter Reutemann 21 Nov '17

21 Nov '17

'Many people realize that smartphones track their locations. But what if you actively turn off location services, haven’t used any apps, and haven’t even inserted a carrier SIM card? Even if you take all of those precautions, phones running Android software gather data about your location and send it back to Google when they’re connected to the internet, a Quartz investigation has revealed. Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers—even when location services are disabled—and sending that data back to Google. The result is that Google, the unit of Alphabet behind Android, has access to data about individuals’ locations and their movements that go far beyond a reasonable consumer expectation of privacy.' -- source: https://qz.com/1131515/google-collects-android-users-locations-even-when-lo… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No, you’re not being paranoid. Sites really are watching your every move
by Peter Reutemann 20 Nov '17

20 Nov '17

'If you have the uncomfortable sense someone is looking over your shoulder as you surf the Web, you're not being paranoid. A new study finds hundreds of sites—including microsoft.com, adobe.com, and godaddy.com—employ scripts that record visitors' keystrokes, mouse movements, and scrolling behavior in real time, even before the input is submitted or is later deleted. Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back. A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.' -- source: https://arstechnica.com/tech-policy/2017/11/an-alarming-number-of-sites-emp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Technology groups and dealing with predators
by Bryce Utting 20 Nov '17

20 Nov '17

The Verge has a detailed (read: graphic) report of predatory behaviour from ex-Auckland security expert Morgan Marquis-Boire, late of Google and the Citizen Lab of the University of Toronto, with connections to the Freedom of the Press Foundation, the EFF, and presumably others. Content warning for sexual assault issues: https://www.theverge.com/2017/11/19/16675704/morgan-marquis-boire-hacker-se… I can only commend those who have come forward, and also Ron Deibert of Citizen Lab for his well-aimed response. Without opening old wounds, I'd suggest that the Citizen Lab code of conduct might be useful food for thought where public WLUG events are involved. (unless a code of conduct already exists and I missed it?) A separate incorporated society I'm involved in has had to deal with complaints of a predator at an event, and a similar document could have done wonders for laying out how to appropriately evaluate and respond in the absence of a police complaint.The Harvey Weinstein disclosures are making clear how endemic this behaviour is, and how rare appropriate responses are. butting

4 3