- wlug - list.wlug.org.nz

Intel Planning To End Legacy BIOS Support By 2020, Report Says
by Peter Reutemann 20 Nov '17

20 Nov '17

'Intel is planning to end "legacy BIOS" support in their new platforms by 2020 in requiring UEFI Class 3 or higher. Making rounds this weekend is a slide deck from the recent UEFI Plugfest. Brian Richardson of Intel talked about the "last mile" barriers to removing legacy BIOS support from systems. By 2020, they will be supporting no less than UEFI Class 3, which means only UEFI support and no more legacy BIOS or CSM compatibility support mode. But that's not going to force on UEFI Secure Boot unconditionally: Secure Boot enabled is considered UEFI Class 3+. Intel hasn't removed legacy BIOS / CSM support yet due to many customers' software packages still relying upon legacy BIOS, among other reasons. Removing the legacy BIOS support will mitigate some security risks, needs less validation by vendors, allows for supporting more modern technologies, etc.' -- source: https://tech.slashdot.org/story/17/11/20/1251249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Tor Browser Feature Makes It Into Firefox: First-Party Isolation
by Peter Reutemann 20 Nov '17

20 Nov '17

'Unbeknown to most users, Mozilla added a privacy-enhancing feature to the Firefox browser over the summer that can help users block online advertisers from tracking them across the Internet. The feature is named First-Party Isolation (FPI) and was silently added to the Firefox browser in August, with the release of Firefox 55. FPI works by separating cookies on a per-domain basis. This is important because most online advertisers drop a cookie on the user's computer for each site the user visits and the advertisers loads an ad. With FPI enabled, the ad tracker won't be able to see all the cookies it dropped on that user's PC, but only the cookie created for the domain the user is currently viewing. This will force the ad tracker to create a new user profile for each site the user visits and the advertiser won't be able to aggregate these cookies and the user's browsing history into one big fat profile. This feature was first implemented in the Tor Browser, a privacy-focused fork of the Firefox browser managed by the Tor Project, where it is known as Cross-Origin Identifier Unlinkability. FPI was added to Firefox as part of the Tor Uplift project, an initiative to bolster the Firefox codebase with some of the Tor Browser's unique privacy-focused features. The feature is not enabled by default. Information on how to enable it is in the linked article.' -- source: https://news.slashdot.org/story/17/11/20/1713235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bluetooth Hack Affects 20 Million Amazon Echo, Google Home Devices
by Peter Reutemann 17 Nov '17

17 Nov '17

'In September, security researchers discovered eight vulnerabilities -- codenamed collectively as BlueBorne -- in the Bluetooth implementations used by over 5.3 billion devices. We have now learned that an estimated 20 million Amazon Echo and Google Home devices are also vulnerable to attacks leveraging the BlueBorne vulnerabilities. The Hacker News reports: Amazon Echo is affected by the following two vulnerabilities: a remote code execution vulnerability in the Linux kernel (CVE-2017-1000251); and an information disclosure flaw in the SDP server (CVE-2017-1000250). Since different Echo's variants use different operating systems, other Echo devices are affected by either the vulnerabilities found in Linux or Android. Whereas, Google Home devices are affected by one vulnerability: information disclosure vulnerability in Android's Bluetooth stack (CVE-2017-0785). This Android flaw can also be exploited to cause a denial-of-service (DoS) condition. Since Bluetooth cannot be disabled on either of the voice-activated personal assistants, attackers within the range of the affected device can easily launch an attack. The security firm [Armis, who disclosed the issue] notified both Amazon and Google about its findings, and both companies have released patches and issued automatic updates for the Amazon Echo and Google Home that fixes the BlueBorne attacks. ' -- source: https://it.slashdot.org/story/17/11/17/0037251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Banking Security
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Here <http://www.theregister.co.uk/2017/11/03/uk_bank_security_audit/> are the results of an audit on UK banks to check their adherence to various established security practices: * HTTP Strict Transport Security <https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security> * Security Headers <https://securityheaders.io/> * Content Security Policy <https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP> * avoidance of weak and obsolete encryption (e.g. RC4) The result: a real mixed bag. Has anyone done a similar thing for our banks?

3 3

Belgium: Skype Is Officially A Telco, Must Comply With Interception Warrants
by Lawrence D'Oliveiro 17 Nov '17

17 Nov '17

Skype has failed in its appeal against a 2016 fine in Belgium for failing to help authorities tap calls in a criminal investigation, with the court saying it must comply with the country's telecommunications laws. <http://www.theregister.co.uk/2017/11/16/skypes_belgian_appeal_fails/>

1 0

Re: [wlug] Scam -- A Service To Scam The Scammers
by Lawrence D'Oliveiro 16 Nov '17

16 Nov '17

When you get a scam e-mail, how about forwarding it to the Re:Scam service <https://www.techdirt.com/articles/20171113/02094138603/great-use-artificial…>. This activates an AI that will engage in long, fruitless conversations with the scammers--basically waste their time. And it’s run by Netsafe, here in New Zealand.

4 7

Will Propaganda Eat Itself?
by Lawrence D'Oliveiro 15 Nov '17

15 Nov '17

Just the latest <https://arstechnica.com/gaming/2017/11/russian-military-cites-game-screensh…> in an ever-growing line of incidents where various Governments and Press agencies mistakenly cite video-game footage as “proof” of nefarious activities by their opponents, and end up with egg on their faces as a result. Part of the trouble seems to be that such images tend to rank very highly in Google searches. But that shouldn’t be much of an obstacle for *proper* researchers, right? ;)

1 0

oldest usable Android version -- any opinions?
by Ian Young 15 Nov '17

15 Nov '17

Apologies for straying off topic. I need to get an Android phone to replace an ancient Sony-E, but hanker somewhat for the days of removable batteries, and like a stylus. This points afaict to an older Samsung Note model but then comes the problem of obsolete versions of Android. Can anyone suggest what is the oldest Android that can still be used on the web of today? Or perhaps there is a current phone with removable battery? ~ Ian Y

2 1

OnePlus Phones Come Preinstalled With a Factory App That Can Root Devices
by Peter Reutemann 14 Nov '17

14 Nov '17

'Some OnePlus devices, if not all, come preinstalled with an application named EngineerMode that can be used to root the device and may be converted into a fully-fledged backdoor by clever attackers. The app was discovered by a mobile security researcher who goes online by the pseudonym of Elliot Alderson -- the name of the main character in the Mr. Robot TV series. Speaking to Bleeping Computer, the researcher said he started investigating OnePlus devices after a story he saw online last month detailing a hidden stream of telemetry data sent by OnePlus devices to the company's servers.' -- source: https://yro.slashdot.org/story/17/11/14/140250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 27 Released
by Peter Reutemann 14 Nov '17

14 Nov '17

'The Fedora Project has announced the general availability of Fedora 27 Workstation and Fedora 27 Atomic editions. Fedora 27 brings with it "thousands of improvements" from both the Fedora Community and various upstream software projects, the team said on Tuesday. From a post on Fedora Magazine: The Workstation edition of Fedora 27 features GNOME 3.26. In the new release, both the Display and Network configuration panels have been updated, along with the overall Settings panel appearance improvement. The system search now shows more results at once, including the system actions. GNOME 3.26 also features color emoji support, folder sharing in Boxes, and numerous improvements in the Builder IDE tool. The new release also features LibreOffice ' -- source: https://linux.slashdot.org/story/17/11/14/1552228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Consumer Advice Magazine Considers Device Security
by Lawrence D'Oliveiro 14 Nov '17

14 Nov '17

Nice to see that considerations about the (in)security of these IoT devices have penetrated at least some way into the popular consciousness <http://www.theregister.co.uk/2017/11/14/bluetooth_toys_easily_hackable_says…>. Though the vendor responses are looking pretty predictable: it would be really hard to take advantage of such weaknesses in a realistic situation bla bla bla.

1 0

A History Of The Amiga, Part 11
by Lawrence D'Oliveiro 14 Nov '17

14 Nov '17

<https://arstechnica.com/gaming/2017/11/a-history-of-the-amiga-part-11-betwe…>: Then came an announcement that caused an uproar in the Amiga community; some even saw it as a betrayal. Jim Collas’ team revealed that it was switching the OS kernel for Amiga OE from QNX to Linux. ... In retrospect, this was probably the correct choice. Linux, then and now, supported a much more diverse array of hardware and was already gaining significant momentum in the tech industry. But Amiga fans didn’t see it that way at the time. They saw Linux as bloated, clunky, and slow, the exact opposite of their beloved Amiga. QNX Neutrino was seen as fast, small, and elegant, and the community had rallied behind it. This takes place in 1999. I did spend some time with Amiga fans about a decade earlier. Being a Mac fan at the time, I saw it as a bad move to tie to OS architecture so closely to particular quirks of the hardware. And sure enough, that did cause compatibility problems for Amiga software on later hardware.

1 0

Linux 4.14 Has Been Released
by Peter Reutemann 12 Nov '17

12 Nov '17

'Linux 4.14 has been released. This release adds support for bigger memory limits in x86 hardware (128PiB of virtual address space, 4PiB of physical address space); support for AMD Secure Memory Encryption; a new unwinder that provides better kernel traces and a smaller kernel size; support for the zstd compression algorithm has been added to Btrfs and Squashfs; support for zero-copy of data from user memory to sockets; support for Heterogeneous Memory Management that will be needed in future GPUs; better cpufreq behaviour in some corner cases; faster TBL flushing by using the PCID instruction; asynchronous non-blocking buffered reads; and many new drivers and other improvements. Phoronix has more on the changes in Linux 4.14 -- and notes that its codename is still "Fearless Coyote."' -- source: https://linux.slashdot.org/story/17/11/12/219238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Install Firefox Quantum in Ubuntu Right Now
by Peter Reutemann 12 Nov '17

12 Nov '17

'The upcoming version of Mozilla’s web browser Firefox is called Quantum because it’s blazing fast. It has been coded in Rust instead of the usual C++ and it is the first web browser to utilize the power of a multi-core processor. There has been lots of buzz around Quantum release. It is touted as a game-changing release that will help Firefox gain its lost userbase to Google Chrome. Ideally, Firefox Quantum should be released this month. But since I wanted to test it, I thought of installing it before its official release.' -- source: https://itsfoss.com/firefox-quantum-ubuntu/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Private Browsing Google Trouble
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

Just tried to open a few Private Browsing sessions to do searches in Google in Firefox. Previously this has worked fine. But currently the connections are taking forever to complete. Explicitly connecting to google.com (instead of typing directly in the search box) has the same problem. Doing one of the same searches in a non-private tab worked fine. To compare, I connected to bing.com in a private tab, and did another of the searches there. Again, it worked fine.

2 5

Saw This In An Ad Frame On The Herald Site (Long Traceback!)
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

A little bit earlier this afternoon, while browsing nzherald.co.nz, The following popped up in a frame headed “Advertisement”: (Warning: long traceback ahead). I thought I would post it all, because it has some interesting info in it, such as all the method names beginning with “AdTrek”. And references to a particular user’s “Telepathy Client Repos”? ---- Server Error in '/' Application. The wait operation timed out Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.ComponentModel.Win32Exception: The wait operation timed out Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [Win32Exception (0x80004005): The wait operation timed out] [SqlException (0x80131904): Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.] System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3279580 System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +791 System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4927 System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +442 System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3114 System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite) +554 System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +475 System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +386 System.Data.Linq.SqlClient.SqlProvider.Execute(Expression query, QueryInfo queryInfo, IObjectReaderFactory factory, Object[] parentArgs, Object[] userArgs, ICompiledSubQuery[] subQueries, Object lastResult) +457 System.Data.Linq.SqlClient.SqlProvider.ExecuteAll(Expression query, QueryInfo[] queryInfos, IObjectReaderFactory factory, Object[] userArguments, ICompiledSubQuery[] subQueries) +213 System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query) +421 System.Data.Linq.StandardChangeDirector.DynamicInsert(TrackedObject item) +101 System.Data.Linq.ChangeProcessor.SubmitChanges(ConflictMode failureMode) +435 System.Data.Linq.DataContext.SubmitChanges(ConflictMode failureMode) +666 AdTrek.Models.AdServerRepository.saveAdEvent(AdEvent adEvent) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Models\Data\Repositories\AdServerRepository.cs:743 AdTrek.Controllers.AdServerController.fillModel(AdViewModel model, Boolean loadScriptSrc) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Controllers\AdServerController.cs:148 AdTrek.Controllers.AdServerController.Frame(AdViewModel model) in C:\Users\Scott\Documents\Telepathy Client Repos\ElectricArt\AdTrek\AdTrek\Controllers\AdServerController.cs:18 lambda_method(Closure , ControllerBase , Object[] ) +139 System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary`2 parameters) +229 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary`2 parameters) +35 System.Web.Mvc.Async.AsyncControllerActionInvoker.<BeginInvokeSynchronousActionMethod>b__39(IAsyncResult asyncResult, ActionInvocation innerInvokeState) +39 System.Web.Mvc.Async.WrappedAsyncResult`2.CallEndDelegate(IAsyncResult asyncResult) +67 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +42 System.Web.Mvc.Async.AsyncInvocationWithFilters.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3d() +72 System.Web.Mvc.Async.<>c__DisplayClass46.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3f() +386 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +42 System.Web.Mvc.Async.<>c__DisplayClass2b.<BeginInvokeAction>b__1c() +38 System.Web.Mvc.Async.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult) +186 System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +38 System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState) +29 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65 System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +53 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +36 System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +38 System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState) +44 System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65 System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +38 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +399 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +137 Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1069.1

1 0

New To Me: Game Asset Rippers
by Lawrence D'Oliveiro 12 Nov '17

12 Nov '17

While browsing around DeviantArt (as you do), I discovered this group <https://xnalaramodelandtuts.deviantart.com/>. The name “XNALara” comes from an open-source Windows program that let you create your own scenes and poses with assets (characters, props, scenery) from the “Tomb Raider: Underworld” game. (I think it has broadened its reach beyond that one game by now.) All very well, but how do you extract those assets from these games? Turns out there are these tools called “rippers”, which capture the OpenGL/DirectX drawing calls that the game makes and save all the geometry and textures and so on that are passed to those calls. (Did somebody say “copyright violation”?) Well, there are folders in that group that are absolutely full of these extracted assets. Some have been taken down on demand from the copyright owners, but the remarkable thing is that most of them are still available, and have been so for some years. And that the accounts of those uploading these collections have not been suspended. I tried loading one or two of them into Blender. There’s a range of formats, but one common combination is .obj+.mtl for the geometry and material definitions, and .dds for the texture images. The latter can be converted to PNG with ImageMagick and, after making corresponding edits to the references in the .mtl file, I was able to import the results and see something resembling the preview images. There have been artists on DeviantArt who have used these in their renders (and mentioned as much--that’s how I found out about them). I may try messing around with them a bit more, but I don’t think I’ll be publishing any such work...

1 0

The Power Of Non-Mainstream Media
by Lawrence D'Oliveiro 11 Nov '17

11 Nov '17

<https://arstechnica.com/science/2017/11/unusual-experiment-reveals-the-powe…>: Pundits and activists have long blamed the "mainstream media" for having an outsized effect on public perceptions. ... But a new long-term study reveals that small media outlets have a far greater effect on public discussions than anyone realized. To be more precise, it only takes three or more stories from small news outlets covering the same topic to make discussions of that topic go up by 62.7 percent on Twitter.

1 0

3D Metal Printing At 100 Times The Speed And A Twentieth Of The Cost
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

3D printing has mainly been confined to parts made out of various kinds of plastics up till now. Metal has been hard to deal with, because at some point you have to melt it, and that requires temperatures higher than any printing-type device could cope with. Now a company called “Desktop Metal” <http://www.theregister.co.uk/2017/11/10/metal_3d_printing_at_desktop_metal/> has come up with a scheme involving binding layers of metal powder, laid down in the right shape, using a temporary compound which is then removed when the part is melted in a furnace so it becomes a proper solid piece. Obviously this has to be done without losing its shape. The process can also do clever things like make a hinge, where there is no metal between the parts, so once the binding compound is removed, you have two solid parts that can freely rotate without falling apart.

1 0

How Antivirus Can Open You To Attacks That Otherwise Wouldn’t Be Possible
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

From <https://arstechnica.com/information-technology/2017/11/how-av-can-open-you-…>: Antivirus programs, in many cases, make us safer on the Internet. Other times, they open us to attacks that otherwise wouldn't be possible. On Friday, a researcher documented an example of the latter—a vulnerability he found in about a dozen name-brand AV programs that allows attackers who already have a toehold on a targeted computer to gain complete system control.

1 0

Google Patches KRACK WiFi Flaw in Android November Security Update
by Peter Reutemann 10 Nov '17

10 Nov '17

'Some vendors take longer than others to update for critical vulnerabilities - case in point is Google's Android mobile operating system. On Nov. 6, Google released an Android update patching a vulnerability that IT vendors have known about for months. On Oct. 16, security researcher Mathy Vanhoef working at Belgian University KU Leuven publicly disclosed the KRACK WiFi vulnerability that impacted all WiFi devices that use WPA2 encryption, including every Android device ever built.' -- source: https://www.esecurityplanet.com/mobile-security/google-patches-krack-wifi-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Samsung Demos Linux Desktop on Its Galaxy Smartphones
by Lawrence D'Oliveiro 10 Nov '17

10 Nov '17

“Concept Demo”, it says, running Ubuntu <http://www.theregister.co.uk/2017/11/10/linux_on_galaxy_video_demo/>.

1 0

Intel To Ship Processors With Integrated AMD Graphics And Memory
by Lawrence D'Oliveiro 09 Nov '17

09 Nov '17

Intel’s gen-8 H-series mobile processors will integrate an AMD Radeon GPU <https://arstechnica.com/gadgets/2017/11/intel-will-ship-processors-with-int…>.

3 4

MINIX: Intel's Hidden In-chip Operating System
by Peter Reutemann 09 Nov '17

09 Nov '17

'Matthew Garrett, the well-known Linux and security developer who works for Google, explained recently that, "Intel chipsets for some years have included a Management Engine [ME], a small microprocessor that runs independently of the main CPU and operating system. Various pieces of software run on the ME, ranging from code to handle media DRM to an implementation of a TPM. AMT [Active Management Technology] is another piece of software running on the ME." [...] At a presentation at Embedded Linux Conference Europe, Ronald Minnich, a Google software engineer reported that systems using Intel chips that have AMT, are running MINIX. So, what's it doing in Intel chips? A lot. These processors are running a closed-source variation of the open-source MINIX 3. We don't know exactly what version or how it's been modified since we don't have the source code. In addition, thanks to Minnich and his fellow researchers' work, MINIX is running on three separate x86 cores on modern chips. There, it's running: TCP/IP networking stacks (4 and 6), file systems, drivers (disk, net, USB, mouse), web servers. MINIX also has access to your passwords. It can also reimage your computer's firmware even if it's powered off. Let me repeat that. If your computer is "off" but still plugged in, MINIX can still potentially change your computer's fundamental settings. And, for even more fun, it "can implement self-modifying code that can persist across power cycles." So, if an exploit happens here, even if you unplug your server in one last desperate attempt to save it, the attack will still be there waiting for you when you plug it back in. How? MINIX can do all this because it runs at a fundamentally lower level. [...] According to Minnich, "there are big giant holes that people can drive exploits through." He continued, "Are you scared yet? If you're not scared yet, maybe I didn't explain it very well, because I sure am scared." Also read: Andrew S. Tanenbaum's (a professor of Computer Science at Vrije Universiteit) open letter to Intel' -- source: https://tech.slashdot.org/story/17/11/07/1041236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

How to Install Cacti with Cacti-Spine in Debian and Ubuntu
by Peter Reutemann 09 Nov '17

09 Nov '17

'In this tutorial we’ll learn how to install and configure Cacti network monitoring tool in the latest version of Debian and Ubuntu 16.04 LTS. Cacti will be build and installed from source files during this guide. Cacti is an open source monitoring tool created for monitoring networks, especially network devices, such as switches, routers, servers via SNMP protocol. Cacti interacts with end-users and can be administered via a web tool interface.' -- source: https://www.tecmint.com/install-cacti-with-cacti-spine-in-debian-and-ubuntu/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ubuntu.com down?
by Peter Reutemann 09 Nov '17

09 Nov '17

Tried to go to Ubuntu's homepage and was greeted with a 503 error message (see attachment)... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Bruce Schneier On The Equifax Breach
by Lawrence D'Oliveiro 08 Nov '17

08 Nov '17

Security expert Bruce Schneier has published <https://www.schneier.com/blog/archives/2017/11/me_on_the_equif.html> the testimony he gave to the US House Energy and Commerce Committee on the breach of confidential personal information on close to half the entire population of the US. His main points are worth summarizing: 1. The Equifax breach was a serious security breach that puts millions of Americans at risk. 2. Equifax was solely at fault. 3. There are thousands of data brokers with similarly intimate information, similarly at risk. 4. These data brokers deliberately hide their actions, and make it difficult for consumers to learn about or control their data. 5. The existing regulatory structure is inadequate. 6. The market cannot fix this because we are not the customers of data brokers. 7. We need effective regulation of data brokers. 8. Resist complaints from the industry that this is "too hard." 9. This has foreign trade implications. 10. This has national security implications. 11. We need to do something about it. Read the article for more detail. I would say this is more than a US-specific problem, it is a worldwide problem. Other places may have stricter privacy regulations, but that might not be enough.

1 0

Linux Has a USB Driver Security Problem
by Peter Reutemann 08 Nov '17

08 Nov '17

'USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users' computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. "All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine," Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code.' -- source: https://linux.slashdot.org/story/17/11/08/1730210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Create & manage docker hosts with Docker Machine on VirtualBox
by Peter Reutemann 08 Nov '17

08 Nov '17

'Docker Machine is a tool that let us install Docker Engine on virtual hosts on various platforms, on local environment as well on cloud. With Docker Machine, we can easily install docker hosts a Windows machine, a MAC machine or on cloud platform like AWS, AZURE etc. As we know that Docker Engine runs natively on Linux machines, so its pretty easy to get Docker working on Linux machines but for other OS like MAC or Windows this was a problem. So Docker Machine was introduced, especially for older versions of MAC & Windows (there are new native Docker apps for latest OS). Not meant only for Windows or MAC, Docker machine also provides efficient way to provision multiple Docker hosts on local as well as cloud network. To manage the docker hosts, we use rather than using ‘docker’ command, which is used with docker engine. In this tutorial, we will discuss how we can create & manage docker hosts with Docker Machine on VirtualBox.' -- source: http://linuxtechlab.com/create-manage-docker-hosts-with-docker-machine/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apache OpenOffice: We're OK With Not Being Super Cool
by Peter Reutemann 08 Nov '17

08 Nov '17

'Despite being the subject of a deathwatch -- perhaps mainly by fans of rival LibreOffice -- AOO appears to be rather popular, with the 4.1.4 update racking up at least 1.6 million downloads. [...] While AOO and the ASF formulate a formal statement of direction for the project, Jagielski said more or less that all's well. "AOO is not, and isn't designed to be, the 'super coolest open source office suite with all the latest bells and whistles,'" Jagielski continued. "Our research shows that a 'basic,' functional office suite, which is streamlined with a 'simple' and uncluttered, uncomplicated UI, serves an incredible under-represented community. "Other office suites are focusing on the 'power user' which is a valuable market, for sure, but the real power and range for an open-source office suite alternative is the vast majority which is the 'rest of us. Sometimes we all forget how empowering open source is to the entire world."' -- source: https://news.slashdot.org/story/17/11/07/1944255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Improve your bash/sh shell script with ShellCheck lint script analysis tool
by Peter Reutemann 07 Nov '17

07 Nov '17

'ShellCheck is a static analysis tool for shell scripts. One can use it to finds bugs in your shell scripts. It is written in Haskell. You can find warnings and suggestions for bash/sh shell scripts with this tool. Let us see how to install and use ShellCheck on a Linux or Unix-like system to enhance your shell scripts, avoid errors and productivity.' -- source: https://www.cyberciti.biz/programming/improve-your-bashsh-shell-script-with… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Maltese Law Enforcement Trying To Decrypt Slain Journalist’s Phone
by Lawrence D'Oliveiro 06 Nov '17

06 Nov '17

Daphne Caruana Galizia, the journalist recently killed by a car bomb in Malta, used WhatsApp to communicate securely with her sources. It appears part of her smartphone was salvaged from the wreck, and now the police are enlisting the help of the US FBI to see if they can decrypt whatever information can be found on it. Quoth Bruce: “It will be interesting to see if WhatsApp's security survives this.” <https://www.schneier.com/blog/archives/2017/11/daphne_caruana_.html>

1 0

No, the Linux Desktop Hasn't Jumped in Popularity
by Peter Reutemann 06 Nov '17

06 Nov '17

'Stories have been circulating that the Linux desktop had jumped in popularity and was used more than macOS. Alas, it's not so... These reports have been based on NetMarketShare's desktop operating system analysis, which showed Linux leaping from 2.5 percent in July, to almost 5 percent in September. But unfortunately for Linux fans, it's not true... It seems to be merely a mistake. Vince Vizzaccaro, NetMarketShare's executive marketing share of marketing told me, "The Linux share being reported is not correct. We are aware of the issue and are currently looking into it"... For the most accurate, albeit US-centric operating system and browser numbers, I prefer to use data from the federal government's Digital Analytics Program (DAP). Unlike the others, DAP's numbers come from billions of visits over the past 90 days to over 400 US executive branch government domains... DAP gets its raw data from a Google Analytics account. DAP has open-sourced the code, which displays the data on the web and its data-collection code... In the US Analytics site, which summarizes DAP's data, you will find desktop Linux, as usual, hanging out in "other" at 1.5 percent. Windows, as always, is on top with 45.9 percent, followed by Apple iOS, at 25.5 percent, Android at 18.6 percent, and macOS at 8.5 percent. The article does, however, acknowledge that Linux's real market share is probably a little higher simply because "no one, not even DAP, seems to do a good job of pulling out the Linux-based Chrome OS data' -- source: https://linux.slashdot.org/story/17/11/05/202232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Walkthrough Of The Windows Subsystem For Linux
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Here <https://www.youtube.com/watch?v=VSqAyOY5huQ> is a nice intro to the Linux compatibility layer that Microsoft has added to Windows 10. Their app store gives you a choice of Ubuntu or two flavours of SuSE. But while these omit any X server functionality, they do include all the GUI X clients. So it is perfectly possible to install a Windows-native X server, such as the open-source VcXsrv <https://sourceforge.net/projects/vcxsrv/>. And then he uses this to demonstrate running a full XFCE desktop side-by-side with the regular Windows desktop.

1 0

Mozilla Might Distrust Dutch Government Certs Over 'False Keys'
by Peter Reutemann 05 Nov '17

05 Nov '17

'Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)... This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates. "Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point' -- source: https://tech.slashdot.org/story/17/11/05/1845240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CyberSquirrel1: Tracking Infrastructure Damage Caused By Wildlife
by Lawrence D'Oliveiro 05 Nov '17

05 Nov '17

Interesting Twitter account <https://twitter.com/CyberSquirrel1> including the following item from a couple of days ago: Bird trips power supply to 4000 http://gisborneherald.co.nz/localnews/3069802-135/bird-trips-power-supply-t… … - Te Hapara, New Zealand

1 0

OnionShare – A Tool To Share Any Size Of Files Securely And Anonymously
by Peter Reutemann 05 Nov '17

05 Nov '17

'When we wrote an article about file sharing utilities such as Magic Womhole & transfer.sh most of the users asked is it secure? and where the files are stored. So, we decided to bring one of the best utility that stores and share files securely over the Internet. When we dig on that, we came to know about OnionShare which fulfill all this requirements. How are you saying, it falls under this category? Yes, it’s true because most of us know about Tor Browser which allows users to browse securely, privately and anonymously by implementing Onion routing in the application layer. Onion routing is a technique for anonymous communication over a computer network. OnionShare also developed in the same manner and allows you to use the Tor network to send files anywhere in the world.' -- source: https://www.2daygeek.com/onionshare-secure-way-to-share-files-sharing-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Easy guide to secure VNC server with TLS encryption
by Peter Reutemann 05 Nov '17

05 Nov '17

'In this tutorial, we will learn to install VNC server & secure VNC server sessions with TLS encryption. This method has been tested on CentOS 6 & 7 but should work on other versions/OS as well (RHEL, Scientific Linux etc).' -- source: http://linuxtechlab.com/secure-vnc-server-tls-encryption/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released
by Peter Reutemann 04 Nov '17

04 Nov '17

'The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.' -- source: https://it.slashdot.org/story/17/11/03/2127235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lots Of Digitally-Signed Malware Out There
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

One of the security weaknesses exploited by the “Stuxnet” worm that sabotaged Iran’s nuclear enrichment program was that it had a valid digital signature from a recognized issuer of certificates for Windows software. Of course, the issuer would never knowingly have validated a piece of malware, but the certificate had been compromised so it could be used without their permission. Turns out this sort of thing is not only quite common, there is a further problem in that anti-malware software, which is supposed to pick up revoked certificates and reject signatures that use them, frequently has bugs in their implementation of the signature-checking protocol, so they can let these bad signatures through. <https://arstechnica.com/information-technology/2017/11/evasive-code-signed-…>

1 0

The Patent That Just Wouldn’t Die
by Lawrence D'Oliveiro 03 Nov '17

03 Nov '17

A holding company called Personal Audio claims to have a patent covering the entire idea of podcasting. Over the years, it has succeeded in winning some lucrative payouts, including $8 million from Apple and $1.3 million from CBS. All without making a single item of product itself. In other words, Personal Audio is what lawyers politely refer to as a “Non-Practising Entity” (NPE), or, in more common parlance, a patent troll. However, the Electronic Frontier Foundation has succeeded, with the help of a crowdfunding campaign, in invalidating this patent, using a system introduced at the USPTO called “inter partes review” (IPR). Of course, Personal Audio has not taken this lying down. It has come up with a truly imaginative series of legal counterarguments: * IPR violates the 7th Amendment of the US Constitution (right to trial by jury in a lawsuit). * IPR encourages “collective efforts to invalidate patents” which “severely tilts the playing field in favor of the party or parties seeking invalidation”. * the EFF has been working together with defendants in their litigation. Fortunately, the Court of Appeals for the Federal Circuit (CAFC) -- the same appeals court that overruled Judge William Alsup in his verdict (in Oracle vs Google) that APIs were not copyrightable -- seems to be a bit less uncritically pro-“Intellectual Property” these days (something to do with being slapped down by the Supreme Court?), and has rejected these arguments. Imagine if all this creativity had gone into producing actual useful products, instead of legal arguments ... <https://arstechnica.com/tech-policy/2017/11/eff-destroys-the-podcasting-pat…>

1 0

Microsoft Quietly Announces End of Last Free Windows 10 Upgrade Offer
by Peter Reutemann 03 Nov '17

03 Nov '17

'If you've been waiting to claim your free Windows 10 upgrade using the "assistive technologies" exception, you need to act soon. In a quiet change to an obscure web page, Microsoft announced this week that those exceptions will end on December 31, 2017. On July 29, 2016, Microsoft officially ended the Get Windows 10 program, which offered free Windows 10 upgrades to anyone currently running a supported earlier version of Windows. But the company left a giant loophole in a separate announcement at the same time. Under the terms of that announcement, individuals who use "assistive technologies" received an automatic extension of the free upgrade offer. Sometime in the past week, Microsoft quietly edited that page, to add "The accessibility upgrade offer expires on December 31, 2017."' -- source: https://tech.slashdot.org/story/17/11/03/1737219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Oreo Bug Sends Thousands of Phones Into Infinite Boot Loops
by Peter Reutemann 02 Nov '17

02 Nov '17

'A bug in the new "Adaptive Icons" feature introduced in Android Oreo has sent thousands of phones into infinite boot loops, forcing some users to reset their devices to factory settings, causing users to lose data along the way. The bug was discovered by Jcbsera, the developer of the Swipe for Facebook Android app (energy-efficient Facebook wrapper app), and does not affect Android Oreo (8.0) in its default state. The bug occurs only with apps that use adaptive icons -- a new feature introduced in Android Oreo that allows icons to change shape and size based on the device they're viewed on, or the type of launcher the user is using on his Android device. For example, adaptive icons will appear in square, rounded, or circle containers depending on the theme or launcher the user is using. The style of adaptive icons is defined a local XML file. The bug first manifested itself when the developer of the Swipe for Facebook Android app accidentally renamed the foreground image of his adaptive icon with the same name as this XML file (ic_launcher_main.png and ic_launcher_main.xml). This naming scheme sends Android Oreo in an infinite loop that regularly crashes the device. At one point, Android detects something is wrong and prompts the user to reset the device to factory settings. Users don't have to open an app, and the crashes still happen just by having an app with malformed adaptive icons artifacts on your phone. Google said it will fix the issue in Android Oreo 8.1.' -- source: https://tech.slashdot.org/story/17/11/01/1550256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

10 Best Lightweight Linux Distributions For Older Computers In 2017
by Peter Reutemann 31 Oct '17

31 Oct '17

Quick overview: 10. Peppermint 9. Lubuntu 8. Linux Lite 7. LXLE 6. CrunchBang++ 5. Bodhi Linux 4. antiX Linux 3. SparkyLinux 2. Puppy Linux 1. Tiny Core See here for full details: https://itsfoss.com/lightweight-linux-beginners/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Googler A Command Line Tool To Search Google
by Peter Reutemann 31 Oct '17

31 Oct '17

'Looking for information on the web has become something that we do day in and day out. Whether it is support you are looking for, looking for a product or news about a particular topic, all you have to do is search on the web. As a result, search engines have been designed so they can help us sift through or the garbage in order to get the information we seek. There are Google, Bing, and DuckDuckGo just to mention a few. But what do all these have in common, well, to use these you need a browser such as Firefox or Chromium first. Well does no problem at all; except when all you have is a terminal and no GUI and browser. Also, you may have a GUI and a browser but you wish you did not have to leave the terminal just for that quick search, and thus comes Googler. ' -- source: http://www.linuxandubuntu.com/home/googler-a-command-line-tool-to-search-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Appeals Court Keeps Alive The Never-Ending Linux Case, SCO v. IBM
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

“Jarndyce v. Jarndyce” for the 21st century, anybody? <https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive-the-n…>

1 0

How Kodi Took Over Piracy
by Peter Reutemann 30 Oct '17

30 Oct '17

'For years, piracy persisted mainly in the realm of torrents, with sites like The Pirate Bay and Demonoid connecting internet denizens to premium content gratis. But a confluence of factors have sent torrent usage plummeting from 23 percent of all North American daily internet traffic in 2011 to under 5 percent last year. Legal crackdowns shuttered prominent torrent sites. Paid alternatives like Netflix and Hulu made it easier just to pay up. And then there were the "fully loaded" Kodi boxes -- otherwise vanilla streaming devices that come with, or make easily accessible, so-called addons that seek out unlicensed content -- that deliver pirated movies and TV shows with push-button ease. "Kodi and the plugin system and the people who made these plugins have just dumbed down the process," says Dan Deeth, spokesperson for network-equipment company Sandvine. "It's easy for anyone to use. It's kind of set it and forget it. Like the Ron Popeil turkey roaster." Kodi itself is just a media player; the majority of addons aren't piracy focused, and lots of Kodi devices without illicit software plug-ins are utterly uncontroversial. Still, that Kodi has swallowed piracy may not surprise some of you; a full six percent of North American households have a Kodi device configured to access unlicensed content, according to a recent Sandvine study. But the story of how a popular, open-source media player called XBMC became a pirate's paradise might. And with a legal crackdown looming, the Kodi ecosystem's present may matter less than its uncertain future.' -- source: https://yro.slashdot.org/story/17/10/30/1931208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox To Get a Better Password Manager
by Peter Reutemann 30 Oct '17

30 Oct '17

'Mozilla engineers have started work on a project named Lockbox that they describe as "a work-in-progress extension [...] to improve upon Firefox's built-in password management." Mozilla released the new extension for employee-use only at first, but users can install it by going to this or this links. Lockbox revamps Firefox's antiquated password management utility with a new user interface (UI). A new Firefox UI button is also included, in case users want to add a shortcut in their browser's main interface to open Lockbox without going through all the menu options. Support for a master password is included, helping users secure their passwords from unauthorized access by co-workers, family members, or others.' -- source: https://news.slashdot.org/story/17/10/30/1245202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

If We Can’t Trust Kaspersky, Should We Trust Microsoft?
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

An opinion piece at Al Jazeera <http://www.aljazeera.com/indepth/opinion/trust-kaspersky-trust-microsoft-17…> considers: A single malicious update pushed from Microsoft could cripple almost every government worldwide. ... That a small number of vendors have the capacity to remotely shut down government infrastructure, or vacuum up secret documents, is almost too scary to wrap your head around. And that's without pondering how likely they are to be pressured by their governments. In the face of future conflict, is the first step going to be disabling auto-updates for software from that country?

1 0

Early HP Archives Destroyed
by Lawrence D'Oliveiro 30 Oct '17

30 Oct '17

Bill Hewlett and Dave Packard were the archetypal “two guys who started a business in a garage” from 1938. When the company they founded moved on to other things (computers, printers etc), the original test-equipment business they created was spun off as part of a company called Agilent, which in turn divested it as an outfit now known as Keysight. Now we hear that important historical paper archives from those early days, which were in the care of Keysight Technologies, have been lost in the recent deadly Santa Rosa wildfires. <http://www.theregister.co.uk/2017/10/29/hewlett_packard_history_lost_to_san…>

1 0