- wlug - list.wlug.org.nz

711 million email addresses ensnared in "largest" spambot
by Peter Reutemann 30 Aug '17

30 Aug '17

'A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.' -- source: http://www.zdnet.com/article/onliner-spambot-largest-ever-malware-campaign-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

scrollbars: click to scroll
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone Here's one for us old-fogies that don't like the new fandangled behavior of scrollbars, moving to where you click instead of scrolling (drives me nuts when scrolling through posts). For GTK do the following: - Create ~/.config/gtk-3.0/settings.ini - add the following content [Settings] gtk-primary-button-warps-slider = false --source: https://unix.stackexchange.com/a/306340 For Firefox itself do this: - go to about:config - right-click and select "New" of type "Integer" - use "ui.scrollToClick" as name and enter value "0" -- source: https://unix.stackexchange.com/a/276016 And, if you want your top/bottom buttons on the scrollbar back, have a look here: https://linuxnorth.wordpress.com/2014/06/01/vertical-scroll-bars-in-linux-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

On Internet Privacy, Be Very Afraid
by Peter Reutemann 29 Aug '17

29 Aug '17

'Cybersecurity expert and Berkman Klein fellow Bruce Schneier talked to the Gazette about what consumers can do to protect themselves from government and corporate surveillance. From the interview: GAZETTE: After whistleblower Edward Snowden's revelations concerning the National Security Agency's (NSA) mass surveillance operation in 2013, how much has the government landscape in this field changed? SCHNEIER: Snowden's revelations made people aware of what was happening, but little changed as a result. The USA Freedom Act resulted in some minor changes in one particular government data-collection program. The NSA's data collection hasn't changed; the laws limiting what the NSA can do haven't changed; the technology that permits them to do it hasn't changed. It's pretty much the same. GAZETTE: Should consumers be alarmed by this? SCHNEIER: People should be alarmed, both as consumers and as citizens. But today, what we care about is very dependent on what is in the news at the moment, and right now surveillance is not in the news. It was not an issue in the 2016 election, and by and large isn't something that legislators are willing to make a stand on. Snowden told his story, Congress passed a new law in response, and people moved on. GAZETTE: What about corporate surveillance? How pervasive is it? SCHNEIER: Surveillance is the business model of the internet. Everyone is under constant surveillance by many companies, ranging from social networks like Facebook to cellphone providers. This data is collected, compiled, analyzed, and used to try to sell us stuff. Personalized advertising is how these companies make money, and is why so much of the internet is free to users. We're the product, not the customer.' -- source: https://yro.slashdot.org/story/17/08/29/1725246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Ryzen Running Stable On Linux, Threadripper Builds Kernel In 36 Seconds
by Peter Reutemann 29 Aug '17

29 Aug '17

'After AMD confirmed the a "performance marginality problem" affecting some Ryzen Linux users, RMAs are being issued and replacement Ryzen processors arriving for affected opensource fans. Phoronix has been able to confirm that the new Ryzen CPUs are running stable without the segmentation fault problem that would occur under very heavy workloads. They have also been able to test now the Ryzen Threadripper 1950X. The Threadripper 1950X on Linux is unaffected by any issues unless you count the lack of a thermal reporting driver. With the 32 threads under Linux they have been able to build the Linux kernel in just about a half minute.' -- source: https://linux.slashdot.org/story/17/08/29/184243 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocurrencies And Autonomous Weapons
by Lawrence D'Oliveiro 29 Aug '17

29 Aug '17

Al Jazeer’s “Counting The Cost” economics program this week <http://www.aljazeera.com/programmes/countingthecost/2017/08/cryptocurrencie…> talks, among other things, a bit about: * Cryptocurrencies (e.g. Bitcoin) -- is it too early to start regulating them? Start worrying about their use for illegal activities? Start investing in them? * Autonomous military weaponry -- should we start banning the creation of weapons that can take their own decision to shoot to kill? Or is more research needed? By the way, mentioned in passing in the latter segment is that Samsung-made autonomous guns are already deployed along South Korea’s border with its northern neighbour.

1 0

Addendum to last night's presentation on RPi projects
by Peter Reutemann 29 Aug '17

29 Aug '17

Hi everyone This was the other sensor project that I came across, using multiple arduino sensors to monitor humidity/temperature, collecting them with a RF receiver (though I wouldn't use xively.com to collect the data): https://computers.tutsplus.com/tutorials/building-a-wireless-sensor-network… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the NSA Identified Satoshi Nakamoto
by Peter Reutemann 29 Aug '17

29 Aug '17

'The 'creator' of Bitcoin, Satoshi Nakamoto, is the world's most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi's real name. In fact, DHS will not publicly confirm that even THEY know the billionaire's identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him -- his own words. Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. According to my source, the NSA was able to the use the 'writer invariant' method of stylometry to compare Satoshi's 'known' writings with trillions of writing samples from people across the globe. By taking Satoshi's texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a 'fingerprint' for anything written by Satoshi that could easily be compared to any other writing. The NSA then took bulk emails and texts collected from their mass surveillance efforts. First through PRISM and then through MUSCULAR, the NSA was able to place trillions of writings from more than a billion people in the same plane as Satoshi's writings to find his true identity. The effort took less than a month and resulted in positive match' -- source: https://tech.slashdot.org/story/17/08/28/1725232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Year After Mirai: DVR Torture Chamber Test Shows Two Minutes Between Exploits
by Peter Reutemann 29 Aug '17

29 Aug '17

'Over two days, the Internet Storm Center connected a default configured DVR to the internet, and rebooted it every 5 minutes in order to allow as many bots as possible to infect it. They detected about one successful attack (using the correct password xc3511) every 2 minutes. Most of the attackers were well known vulnerable devices. A year later, what used to be known as the "Mirai" botnet has branched out into many different variants. But it looks like much hyped "destructive" variants like Brickerbot had little or no impact.' -- source: https://it.slashdot.org/story/17/08/28/1812242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

One of 1st-known Android DDoS malware infects phones in 100 countries
by Peter Reutemann 29 Aug '17

29 Aug '17

'Last year, a series of record-setting attacks hitting sites including KrebsOnSecurity and a French Web host underscored a new threat that had previously gone overlooked: millions of Internet-connected digital video recorders and similar devices that could easily be wrangled into botnets that challenged the resources of even large security services. Now, for one of the first times, researchers are reporting a new platform recently used to wage powerful denial-of-service attacks that were distributed among hundreds of thousands of poorly secured devices: Google's Android operating system for phones and tablets. The botnet was made up of some 300 apps available in the official Google Play market. Once installed, they surreptitiously conscripted devices into a malicious network that sent junk traffic to certain websites with the goal of causing them to go offline or become unresponsive.' -- source: https://arstechnica.com/information-technology/2017/08/first-known-android-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How to Scan Your Linux Computer for Viruses and Rootkits
by rowan schischka 28 Aug '17

28 Aug '17

>Any volunteers? Especially people that have used one of these tools before. Unfortunately I am not in Hamilton atm, but if i was I would demonstrate an automated way to scan and alert the user. The tools are very straight forward to use. The hardest part I had was setting up local mail and sending a report to gmail without gmail marking it as spam.

1 0

Raspberry Pi - Raspbian released based on Debian 9 - Stretch
by Ian Stewart 27 Aug '17

27 Aug '17

Raspbian, the main distro for the Raspberry Pi, has now been released based on Debian 9 (Stretch). While this provides the benefits and enhancements of a more recent Linux release, another benefit is the updated products available in the Debian repository. You can download Raspian from https://www.raspberrypi.org/downloads/raspbian/ Raspbian Stretch with desktop Image with desktop based on Debian Stretch Version: August 2017 Release date: 2017-08-16 Kernel version: 4.9 Release notes: 2017-08-16: * Based on Raspbian Stretch (Debian version 9) * Version 60 of Chromium browser included * Version 3.0.1 of Sonic Pi included * Version 6.1.1 of RealVNC included * Version 0.17.4 of NodeRED included * Bluetooth audio routed via ALSA rather than Pulseaudio * SenseHAT extension added to Scratch 2 * Various desktop applications modified to prompt for sudo password if needed * lxinput control options for mouse speed simplified * lxpanel plugins moved into separate packages * Wireless firmware for Pi 3 and Pi 0W modified to address Broadpwn exploit * Latest kernel and firmware * Various small tweaks, bug fixes and theme modifications cheers, Ian.

2 1

How to Scan Your Linux Computer for Viruses and Rootkits
by Peter Reutemann 27 Aug '17

27 Aug '17

'Are you worried that your Linux computer may be infected with malware? Have you ever checked? While Linux systems tend to be less susceptible to malware than Windows, they can still be infected. Many times they’re less obviously compromised, too. There are a handful of excellent open-source tools to help you check if your Linux system has been the victim of malware. While no software is perfect, these three have a solid reputation and can be trusted to find most known threats.' -- source: https://www.maketecheasier.com/scan-linux-for-viruses-and-rootkits/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 5

A New Non-Money Oriented Crowdsourcing Platform Based On Code Contributions
by Peter Reutemann 27 Aug '17

27 Aug '17

An anonymous reader shares a new crowdfunding site built on open source principles to "remove the money element from project creation" so creators "don't have to take extreme actions such as quitting their jobs or compromising on their ideas because of investor demands. Because of the nature of crowdsourcer.io projects, project creators can remain as ambitious as funded projects and get all the contributors they need to make their idea a reality." >From the site: Crowdsourcer.io is an alternative crowd sourcing platform that allows developers and designers alike to create or join in on software related projects, build up their contribution and earn an income from the final product. Think of Crowdsourcer.io as something between open source software creation and Kickstarter start ups, a new crowd sourcing alternative, in its purest form" The site's creator recently answered questions on Reddit, saying they'd spent years fine-tuning the idea, and writing that "It's really focussed on people who don't want to quit their job to form their own software company, and don't want to become embroiled in debt or other financing." A note at the bottom of the site adds that "Crowdsourcer.io is young. We want your ideas!" -- source: https://developers.slashdot.org/story/17/08/27/0639253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

screen with a scrollbuffer / scroll wheel support
by Peter Reutemann 25 Aug '17

25 Aug '17

Hi everyone Finally figured out (well, by that I mean googled) how to change the scrollbuffer for screen sessions (running + default setting): https://stackoverflow.com/questions/8760346/how-do-i-increase-the-scrollbac… And how to get the mouse scroll wheel working (works on mate-terminal): https://stackoverflow.com/questions/359109/using-the-scrollwheel-in-gnu-scr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux expr command tutorial for beginners (with examples)
by Peter Reutemann 25 Aug '17

25 Aug '17

'Sometimes, while working on the command line (especially when dealing with a shell script), you may find yourself in a situation where you have to perform actions like searching for a substring in a string, finding its index, as well as other things like performing comparisons and arithmetic operations. For those who aren't in the know, there exists a command line utility - dubbed expr - that lets you do all this. In this tutorial, we will discuss the basics of this command along with some of the features it provides.' -- source: https://www.howtoforge.com/linux-expr-command/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Touch-panel PCs run Raspbian on Raspberry Pi CM3
by Peter Reutemann 25 Aug '17

25 Aug '17

'Comfile has launched two IP65 protected, resistive touch panel PCs with 7- and 10.2-inch 800 x 480 displays, built around the Raspberry Pi Compute Module 3. In February, Saelig Co. announced distribution of Janz Tec’s Raspberry Pi 3-based emPC-A/RPI3 industrial controller. Now, Saelig has launched North American distribution of Korea-based Comfile’s ComfilePi line of touch panel computers built around the Raspberry Pi Compute Module 3 (CM3) computer-on-module version of the Raspberry Pi 3.' -- source: http://linuxgizmos.com/touch-panel-pcs-run-raspbian-on-raspberry-pi-cm3/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Help Purism Build the Secure Open Source Linux-based Librem 5 Smartphone
by Peter Reutemann 24 Aug '17

24 Aug '17

'Thankfully, consumers are starting to wake up and become more aware of security and privacy, and some companies, such as Purism, are designing products to safeguard users. The company's laptops, for instance, run an open source Linux-based operating system, called "PureOS" with a focus on privacy. These machines even have hardware "kill switches" so you can physically disconnect a webcam or Wi-Fi card. Today, Purism announces that it is taking those same design philosophies and using them to build a new $599 smartphone called Librem 5. The planned phone will use the GNOME desktop environment and PureOS by default, but users can install different distros too. Sound good? Well you can help the company build it through crowdfunding. "Purism, the social purpose corporation which designs and produces popular privacy conscious hardware and software, has revealed its plans to build the world's first encrypted, open platform smartphone that will empower users to protect their digital identity in an increasingly unsafe mobile world. After 18 months of R&D to test hardware specifications and engage with one of the largest phone fabricators, Purism is opening a self-hosted crowdfunding campaign to gauge demand for the initial fabrication order and add the features most important to users," says Puris' -- source: https://linux.slashdot.org/story/17/08/24/147204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft .NET Core 2.0 For Linux Released; Redhat Will Bundle Microsoft's .NET
by Peter Reutemann 24 Aug '17

24 Aug '17

'Microsoft recently released Visual Studio 15.3 for Windows and Visual Studio 7.1 for Mac with .NET core 2.0. In addition to porting Microsoft Code and SQL Server to Linux, they have ported .NET. Redhat will bundle .NET in their software offerings instead of relying on Mono. .NET core is Microsoft's open-source .NET platform which is not based off Mono and available for Linux, Mac, and Windows here.' -- source: https://tech.slashdot.org/story/17/08/23/2046234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Spyware backdoor prompts Google to pull 500 apps with >100m downloads
by Peter Reutemann 23 Aug '17

23 Aug '17

'At least 500 apps collectively downloaded more than 100 million times from Google's official Play Market contained a secret backdoor that allowed developers to install a range of spyware at any time, researchers said Monday. The apps contained a software development kit called Igexin, which makes it easier for apps to connect to ad networks and deliver ads that are targeted to the specific interests of end users. Once an app using a malicious version of Igexin was installed on a phone, the developer kit could update the app to include spyware at any time, with no warning. The most serious spyware installed on phones were packages that stole call histories, including the time a call was made, the number that placed the call, and whether the call went through. Other stolen data included GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps.' -- source: https://arstechnica.com/information-technology/2017/08/500-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky Versus The Newspapers
by Lawrence D'Oliveiro 22 Aug '17

22 Aug '17

Sky TV, in its latest annual report, is blaming its poor performance on “piracy”, specifically “the newspaper industry”. [CEO John] Fellet, in the company's annual report, said media outlets were taking clips from "the best parts" of Sky sport content and placing them on their websites without permission. Fair Dealing provisions in the Copyright Act allow news outlets to use a copyrighted work in the context of reporting current events. <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11908731>

1 0

Moreutils – A Collection Of More Useful Unix Utilities
by Peter Reutemann 22 Aug '17

22 Aug '17

'We all know about GNU core utilities that comes pre-installed with all Unix-like operating systems. These are the basic file, shell and text manipulation utilities of the GNU operating system. The GNU core utilities contains the commands, such as cat, ls, rm, mkdir, rmdir, touch, tail, wc and many more, for doing the day-to-day operations. Since these commands are part of Core Utilities, you don’t have to manually install them. Among these utilities, there are also some other useful collection of Unix utilities which are not included in any Unix-like operating systems. Meet moreutilis, a growing collection of the unix tools. The moreutils can be installed on GNU/Linux, and various Unix flavours such as FreeBSD, openBSD and Mac OS.' -- source: https://www.ostechnix.com/moreutils-collection-useful-unix-utilities/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Solus 3 Released
by Peter Reutemann 21 Aug '17

21 Aug '17

'The Solus Project is proud to announce the availability of Solus 3, the latest release of its Linux-based operating system, which builds on its curated rolling release model. Solus offers users a free and modern alternative to commercial operating systems and provides users a safe and reliable vehicle to guide, guard and enable the user's journey through a shifting tech world to their destination and beyond.' -- source: http://www.linuxandubuntu.com/home/solus-3-released-here-is-whats-new-in-so… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TheSSS (The Smallest Server Suite) 22.2 Debuts
by Peter Reutemann 21 Aug '17

21 Aug '17

'4MLinux developer Zbigniew Konojacki informs Softpedia on Sunday about the release and general availability of TheSSS (The Smallest Server Suite) 22.2 independently-developed, 4MLinux-based server-oriented GNU/Linux distribution. [...] Those unfamiliar with TheSSS (The Smallest Server Suite) will be glad to learn that the project provides them with a live server suite that lets them run a full-featured Linux server without installing any package on their computer, directly from the bootable medium. TheSSS is a lightweight and fast server solution, and it's free.' -- source: http://news.softpedia.com/news/thesss-the-smallest-server-suite-22-2-debuts… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fdisk Versus parted
by Lawrence D'Oliveiro 21 Aug '17

21 Aug '17

When the first hard drives appeared that were bigger than the 2TiB limit that the MBR partition format could cope with, it seemed like the only tool available that could manage partitions in the new GPT format was GNU parted. So you had to say goodbye to the old fdisk and sfdisk utilities, and learn a new way of setting things up. Well, it turns out that the old programs have been updated with new features, and they can now cope with setting up and using GPT-partitioned disks just fine. I particularly like the “sfdisk -d” command, which dumps out the partition table in a detailed format that can be backed up and then used for restoration later, if the disk’s partition table should somehow get corrupted. As far as I could see, parted never gave the exact numbers, down to the sector, that were necessary for this. Also, in the past day, two problems with parted have manifested themselves acutely to me: * All partitioning changes are made immediately, unlike fdisk. * Also unlike fdisk, it didn’t seem to notice if you were clobbering existing partitions, and would happily overwrite them. Each of these (mis)features might seem bad enough on its own, but putting them together is a recipe for woe. So in future, I think I am going to abandon parted and go back to fdisk and sfdisk.

2 3

postmarketOS Pursues A Linux-Based, LTS OS For Android Phones
by Peter Reutemann 20 Aug '17

20 Aug '17

'Buy an iPhone and you might get 4-5 years of official software updates. Android phones typically get 1-3 years of updates... if they get any updates at all. But there are ways to breathe new life into some older Android phones. If you can unlock the bootloader, you may be able to install a custom ROM like LineageOS and get unofficial software updates for a few more years. The folks behind postmarketOS want to go even further: they're developing a Linux-based alternative to Android with the goal of providing up to 10 years of support for old smartphones... Right now postmarketOS is a touch-friendly operating system based on Alpine Linux that runs on a handful of devices including the Samsung Galaxy Nexus, Google Nexus 4, 5, and 7 (2012), and several other Samsung, HTC, LG, Motorola, and Sony smartphones. There are also ports for some non-Android phones such as the Nokia N900 and work-in-progress builds for the BlackBerry Bolt Touch 9900 and Jolla Phone. Note that when I say the operating system runs on those devices, I basically mean it boots. Some phones only have network access via a USB cable, for instance. None of the devices can actually be used to make phone calls. But here's the cool thing: the developers are hoping to create a single kernel that works with all supported devices, which means that postmarketOS would work a lot like a desktop operating system, allowing you to install the same OS on any smartphone with the proper hardware. One postmarketOS developer complains that Android's architecture "is based on forking (one might as well say copy-pasting) the entire code-base for each and every device and Android version. And then working on that independent, basically instantly incompatible version. Especially adding device-specific drivers plays an important role... Here is the solution: Bend an existing Linux distribution to run on smartphones. Apply all necessary changes as small patches and upstream them, where it makes sense."' -- source: https://linux.slashdot.org/story/17/08/19/2359258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intro To SELinux
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this video recently <https://www.youtube.com/watch?v=cNoVgDqqJmM> from the Red Hat Summit a couple of years ago, which gives a simplified intro to Security-Enhanced Linux (SELinux), which is a set of high-security “mandatory access control” features added to the Linux kernel. There are still some people who get conniptions when they hear that SELinux was originally created by the US National Security Agency. But the code has been through a lot of independent peer review in the time (close to two decades) since then, so rest assured you can have high confidence in it. But it can be a very complex and intimidating piece of software: particularly if you get something wrong and then some service gets denied access to some file or other for mysterious reasons that you cannot fathom. Luckily, there are tools available to help you diagnose such problems. The video talks only about RHEL, but I think those tools are not distro-specific. For a start, SELinux can be set in one of three operating modes: “enabled” (actively blocking/enabling access according to set policy); “disabled” (not active), and “permissive” (where it logs only the actions it would take, without actually blocking any access). The last one is particularly useful for seeing what you would need to fix before you actually enable SELinux, before anything actually breaks. Related to this, each system log message denying access to something also shows a command that you can use to get more detailed information about why that access was blocked, and various things you might do to enable it if that’s what you want. RHEL itself allows you to set two levels of operation of SELinux: “targeted” mode (where a particular critical set of services is controlled by SELinux, while every thing else operates as though it were not there) and “multi-level/multi-category” mode, which is the one that probably justifies the reputation of SELinux for being complex and intimidating, and which is likely only of interest to certain Government employees who don’t like to talk about their job. And which is not addressed in the talk: it only describes “targeted” operation. The video goes step-by-step through a couple of scenarios with using SELinux to control the behaviour of Apache: granting users the ability to set up their own “public_html” directories, and moving a web page created by a staffer into the server area. It shows the mistakes you might make, how they manifest themselves in the logs, and how you correct them. He makes it seem so simple, you feel tempted to actually try SELinux for yourself. Go watch the video.

1 0

Intro To systemd
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this YouTube video recently <https://www.youtube.com/watch?v=S9YmaNuvw5U> from the Red Hat Summit a couple of years ago, which gives a good intro to systemd, with Lennart Poettering as co-presenter. The video explains what a “service” is, and compares how much simpler it is to define a service (usually just a few lines of declarative config) versus the hundreds of lines of shell script it typically takes to set things up under the ancient sysvinit system. Not only that, but it is possible to customize the standard service definitions without having to copy and paste the entire existing definition file: you just create a few lines of additional/overriding definition in a “drop-in” file that you place in /etc, that matches the name of the original service definition. There is even a command, “systemd-delta”, which lets you immediately see all the places where your entire systemwide configuration has been so customized. Lennart mentions that speeding up boot was never a specific design goal, it just naturally came out of the parallelization of service startup. Because systemd lets you think in terms of “services” rather than “processes”, it achieves something that was difficult to ensure before, namely reliable shutdown of a service. Consider Apache, which typically spawns a whole lot of processes, and then if you run CGI scripts, they require additional processes. Nevertheless, shutting down httpd.service with systemd will ensure that all those processes are terminated. Another important feature of systemd is the logging. Here again systemd had a goal of achieving something that was difficult before, namely capturing all log messages from the earliest possible stages of the boot process, including the initrd stage. And also because the systemd journal mechanism has access to kernel information about the processes doing the logging, it can include information in the log entries that those processes cannot forge. Me, I like the fact that the log timestamps are stored in UTC, so you can display them in whatever timezone you wish. There is more, of course: “slices” are how systemd is able to strictly limit the resource usage of services (important to the RHEL-using, Java-suffering audience), and “sockets” are how the functionality of inetd/xinetd is carried over to the systemd world, so that services can be started on demand, instead of having to run all the time. Watch the video to learn more.

1 0

Do not rely on journald to continue logging after a stop+start
by Bryan Baldwin 18 Aug '17

18 Aug '17

Whilst investigating a problem where services logging to sterr go silent after journald is stopped and started, but not when "restarted", Evgeny Vereshchagin suggests not relying on journald. In spite of its man page, it seems that "restart" isn't quite the same thing as stop+start to journald. Vereshchagin also confirms that is isn't currently possible to prevent a manual stop without also preventing a "restart", and that these shortcomings in using journald should get added to the documentation. https://github.com/systemd/systemd/issues/6620#issuecomment-322718725

1 0

Mageia 6: is it the rise of Phoenix?
by Peter Reutemann 18 Aug '17

18 Aug '17

'There is no secret that I always preferred distributions with the DEB package format. However, there is an exception. Mageia was the distribution that I ran for quite long time on various laptops. Unfortunately, the issues with outdated packages made me leave this distribution behind some time ago. Just as a reminder, Mageia is an off-spring from the famous Mandriva family that survived when the Mandriva tree crashed. And to fill out the whole forest, OpenMandriva is another off-spring, and my recent test showed that it is far below the mother quality. Coming back to Mageia, it has been a long time since the previous version of this operating system was released. Mageia 5.0 was the “most recent release” for 1.5 years, and 5.1 was merely an update to it. Mageia 6 was released just few weeks ago, in July 2017. It is a good time to check it out now.' -- source: http://linuxblog.darkduck.com/2017/08/mageia-6-is-it-rise-of-phoenix.html Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How To List The Dependencies Of A Package In Linux
by Peter Reutemann 17 Aug '17

17 Aug '17

'The other day I was trying to figure out if there is any easy way to find or list the dependencies of a package in Linux. I have been using Linux as my primary OS for few years now, yet I couldn’t how to find the dependencies for a certain package. Fortunately, I found a workaround after a few google searches and wanted to share it with our readers. So, here you go.' -- source: https://www.ostechnix.com/list-dependencies-package-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

When The Cookie Meets The Blockchain
by Lawrence D'Oliveiro 17 Aug '17

17 Aug '17

Cryptocurrencies like Bitcoin are supposed to allow for completely anonymous financial transactions. However, if you use them at an online shopping site, such places often have enough tracking information in place to link you to a particular currency transaction anyway. <http://freedom-to-tinker.com/2017/08/17/when-the-cookie-meets-the-blockchai…>

2 2

Learn the basics of the ZSH shell
by Peter Reutemann 17 Aug '17

17 Aug '17

'Bash isn't bad. It gets the job done just fine, but have you ever considered what it'd be like if Bash had some extra features to make it more convenient to work with? That's more-or-less what ZSH is. It includes all of the features that you'd expect from Bash, but it also has some really nice additions to make your life easier. Actually, you'll be amazed at how much easier they make working in the command line. ' -- source: https://linuxconfig.org/learn-the-basics-of-the-zsh-shell Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

How to secure your LAMP server
by Peter Reutemann 17 Aug '17

17 Aug '17

'The LAMP stack which stands for Linux, Apache, MySQL/MariaDB and PHP/Python/Perl is a very popular combination of free and open-source software used to run millions of websites today. Although many opt for the much efficient LEMP stack based on Nginx instead of Apache, there are still a significant number of users that choose LAMP for their projects. In fact, more than 30% of the active websites today run on top of LAMP. The stack is considered as reliable and very suitable for running high-performance high-availability web applications. In this tutorial we are going to show you how to secure the LAMP stack on your Linux VPS.' -- source: https://www.rosehosting.com/blog/how-to-secure-your-lamp-server/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Email Provider ProtonMail Says It Hacked Back, Then Walks Claim Back
by Peter Reutemann 17 Aug '17

17 Aug '17

'On Wednesday, encrypted email provider ProtonMail claimed it had hacked someone who was impersonating its service in phishing emails, and the company then swiftly deleted the tweet. Early Wednesday morning, the security researcher known as x0rz tweeted out a series of screenshots allegedly showing someone sending emails that directed targets to a fake ProtonMail login screen. "You have an overdue invoice," the message read. In response, ProtonMail said it had taken action. "We also hacked the phishing site so the link is down now," ProtonMail tweeted. Depending on the context and what exactly the retaliating organization did, hacking back can be illegal. Hacking could violate the Computer Fraud and Abuse Act, or perhaps even wiretapping legislation. A recently proposed bill would attempt to legalize the practice. ProtonMail swiftly deleted its tweet, but not before x0rz could grab and subsequently tweet a screenshot. x0rz then deleted his own tweet at the request of ProtonMail.' -- source: https://it.slashdot.org/story/17/08/16/2021257/email-provider-protonmail-sa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Review: System76’s Galago Pro solves “just works” Linux’s Goldilocks problem
by Peter Reutemann 16 Aug '17

16 Aug '17

'In recent years, the PC industry has finally spawned a few manufacturers offering up machines with Linux pre-installed to eliminate this issue. By this point, I've tested most of them around Ars: Dell's XPS and Precision lines both have Linux-friendly offerings, and dedicated Linux manufacturers like System76 have long offered decent hardware with Linux pre-installed. In all this testing, I've yet to encounter a driver problem, which is the real benefit of a machine with Linux pre-installed. (Though to be fair, I could say the same for the Lenovo x240 that serves as my daily driver.) Still, finding the perfect Linux laptop has always been and remains something of a Goldilocks problem: this one is too big, this one is too underpowered, this one has too little RAM, this one lacks a big SSD, and so on. Generally speaking, if you want power and storage you're going to end up with something too big to comfortably throw in a bag and carry all day. The Dell Precision 7520 and the System76 Oryx Pro are good examples of this. [...] What Linux users like myself have long wanted is a laptop with roughly the form factor and weight of a Macbook pro, but with the option to get 32GB of RAM or 3TB of storage. This is the mythical unicorn of pre-built Linux machines, a laptop that is both reasonably lightweight and powerful. And that, my fellow Linux users, is refreshingly what System76 has managed to deliver with its new Galago Pro laptop.' -- source: https://arstechnica.com/gadgets/2017/08/review-system76s-galago-pro-solves-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSource.com Test-Drives Linux Distros From 1993 To 2003
by Peter Reutemann 14 Aug '17

14 Aug '17

'A unique trait of open source is that it's never truly EOL (End of Life). The disc images mostly remain online, and their licenses don't expire, so going back and installing an old version of Linux in a virtual machine and getting a precise picture of what progress Linux has made over the years is relatively simple... Whether you're new to Linux, or whether you're such an old hand that most of these screenshots have been more biographical than historical, it's good to be able to look back at how one of the largest open source projects in the world has developed. More importantly, it's exciting to think of where Linux is headed and how we can all be a part of that, starting now, and for years to come. The article looks at seven distros -- Slackware 1.01 (1993), Debian 0.91 (1994), Jurix/S.u.S.E. (1996), SUSE 5.1 (1998), Red Hat 6.0 (1999), Mandrake 8.0 (2001), and Fedora 1 (2003). Click through for some of the highlights.' -- source: https://linux.slashdot.org/story/17/08/12/0341251 Cheers, Pete -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Clamping Down On VPNs
by Lawrence D'Oliveiro 12 Aug '17

12 Aug '17

“The Listening Post” on Al Jazeera this week <http://www.aljazeera.com/programmes/listeningpost/2017/08/great-firewall-up…> talks among other things about the attempts by China and other countries to clamp down on their citizens’ access to virtual private networks. While these have many legitimate “non-political” applications (particularly for business), they can also be used to bypass state censorship. China, as you may know, has the most advanced system for restricting access within its borders to sources of content outside them that the state has deemed undesirable. The plan for ensuring that this clampdown on VPNs is done in a way that doesn’t hurt its own business interests is to license VPN providers within the country, and make sure they allow state monitoring, and do not give access to “undesirable” sites. Apple, for one, has acquiesced to China’s demands and removed VPN apps from its Iphone app store within the PRC. However, as one of those interviewed in the piece points out, on the Android side there are 400 different app stores accessible within China, and it would be quite another matter to make sure they all comply with the new law.

1 0

That Reminds Me ...
by Lawrence D'Oliveiro 10 Aug '17

10 Aug '17

... I finally got around to writing up some notes on the tips I presented for accessing the systemd journal at that talk last year <https://github.com/WLUG/meetings/tree/master/2016/2016-06-27>.

6 11

A look at OpenSUSE based Gecko Linux
by Peter Reutemann 10 Aug '17

10 Aug '17

'I was sitting at home writing future articles for Ghacks and I decided on a spur of the moment whim that I wanted to try out a distribution I had never touched before. I’ve tried countless systems over the years, from the typical Ubuntu and Debian based systems, to Arch based systems like Manjaro, even Gentoo based systems like Sabayon. However, I was thinking about it and OpenSUSE used to be one of my favourite distributions to use but I’ve never actually sat down and tried a respin of an OpenSUSE based system; so I started digging around into what some popular ones were...And Gecko Linux caught my eye.' -- source: https://www.ghacks.net/2017/08/06/a-look-at-opensuse-based-gecko-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

exa a modern replacement for ls written in rust for Linux/Unix
by Peter Reutemann 09 Aug '17

09 Aug '17

'ls is a command to show files in Linux and Unix-like operating systems. A ls command first appeared in a version of AT&T UNIX as well as in Multics. BSD and GNU Coreutils package provides the ls command with minor syntax changes. There is now third alternative named exa. It is a modern replacement for ls. The exa uses colors for information by default, helping you distinguish between many types of files, such as whether you are the owner, or in the owning group. It also has extra features not present in the original ls, such as viewing the Git status for a directory or recursing into directories with a tree view. The exa command written in Rust, so it’s small, fast, and portable.' -- source: https://www.cyberciti.biz/open-source/command-line-hacks/exa-a-modern-repla… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Firefox 55 Arrives With WebVR on Windows, Performance Panel, and Click-to-Play Flash
by Peter Reutemann 08 Aug '17

08 Aug '17

'Mozilla today made available a new update to Firefox for Windows to introduce support for WebVR, that the company says, will enable desktop VR users to dive into web-based experiences with ease. Firefox 55 also includes performance panel, faster startup when restoring multiple tabs, a quicker way to search across various search engines, and click-to-play Flash by default. From a report: WebVR is an experimental JavaScript API that provides support for virtual reality devices, such as the HTC Vive, Oculus Rift, and Google Cardboard. As its name implies, the technology is meant for browsers. If you find a web game or app that supports VR, just click the VR goggles icon visible on the web page to experience it using your VR headset. WebVR supports navigating and controlling VR experiences with handset controllers or your movements in physical space. [...] Firefox 55 also allows users to adjust the number of processes and how much resources they want to allocate to any of them. This setting is at the bottom of the General section in Options. In fact, if your computer has more than 8GB of RAM, Mozilla recommends "bumping up the number of content processes that Firefox uses" because it will make Firefox faster, though at the expense of using more memory. In its own tests on Windows 10, the company found that Firefox uses less memory than Chrome, even with eight content processes running.' -- source: https://tech.slashdot.org/story/17/08/08/143246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla’s new file-transfer service isn’t perfect, but it’s drop-dead easy
by Peter Reutemann 07 Aug '17

07 Aug '17

'Mozilla is testing a new service that makes it dead simple and quick for people to semi-securely share files with anyone on the Internet. Send, as the service is called, allows senders to encrypt any 1-gigabyte or less file and upload it to a Mozilla server. The service then creates a link with a long, complex string of letters in it that's required to download and decrypt the file. Mozilla will automatically delete the encrypted file as soon as it's downloaded or within 24 hours of being uploaded, even if no one has downloaded it.' -- source: https://arstechnica.com/information-technology/2017/08/mozillas-new-file-tr… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenSSL Support In Debian Unstable Drops TLS 1.0/1.1 Support
by Peter Reutemann 07 Aug '17

07 Aug '17

'Debian Linux "sid" is deprecating TLS 1.0 Encryption. A new version of OpenSSL has been uploaded to Debian Linux unstable. This version disables the TLS 1.0 and 1.1 protocol. This currently leaves TLS 1.2 as the only supported SSL/TLS protocol version. This will likely break certain things that for whatever reason still don't support TLS 1.2. I strongly suggest that if it's not supported that you add support for it, or get the other side to add support for it. OpenSSL made a release 5 years ago that supported TLS 1.2. The current support of the server side seems to be around 90%. I hope that by the time Buster releases the support for TLS 1.2 will be high enough that I don't need to enable them again. This move caused some concern among Debian users and sysadmins. If you are running Debian Unstable on server tons of stuff is going to broken cryptographically. Not to mention legacy hardware and firmware that still uses TLS 1.0. On the client side (i.e. your users), you need to use the latest version of a browser such as Chrome/Chromium and Firefox. The Older version of Android (e.g. Android v5.x and earlier) do not support TLS 1.2. You need to use minimum iOS 5 for TLS 1.2 support. Same goes with SMTP/mail servers, desktop email clients, FTP clients and more. All of them using old outdated crypto. This move will also affect for Android 4.3 users or stock MS-Windows 7/IE users (which has TLS 1.2 switched off in Internet Options.) Not to mention all the mail servers out there running outdated crypto.' -- source: https://linux.slashdot.org/story/17/08/07/1823244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME's Text Editor gedit 'No Longer Maintained', Needs New Developers
by Peter Reutemann 06 Aug '17

06 Aug '17

'AmiMoJo brings news about gedit, the default text editor for GNOME: In a post to the gedit mailing list, Sébastien Wilmet states that gedit is no longer maintained and asks "any developer interested to take over the maintenance of gedit?" Just in case you were considering it, he warns "BTW while the gedit core is written in C (with a bit of Objective-C for Mac OS X support), some plugins are written in Vala or Python. If you take over gedit maintenance, you'll need to deal with four programming languages (without counting the build system). The Python code is not compiled, so when doing refactorings in gedit core, good luck to port all the plugins (the Python code is also less "greppable" than C). At least with Vala there is a compiler, even if I would not recommend Vala." Sébastien's comments were surrounded by a <rant-on-languages> tag, but they're still crying out for some serious discussion. Any Slashdot readers want to share their own insights on Python, some fond thoughts on gedit, or suggestions for maintaining a great piece of open source software?' -- source: https://tech.slashdot.org/story/17/08/05/025227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Red Hat Acquires Data-Cleaning Company Permabit
by Peter Reutemann 06 Aug '17

06 Aug '17

'Business software company Red Hat said on Monday that it is acquiring the technology assets of Permabit, a small company that specializes in cleaning up corporate data to make storage more efficient and data access faster. Terms of the deal were not disclosed but a Red Hat spokesman said 16 people from Permabit will be joining that company... While the conventional wisdom is that data storage is cheap, it is not free. And with companies turning to more expensive flash storage, it saves money to remove redundant data, said Richard Fichera, vice president and principal analyst at Forrester Research... Red Hat, which sells a version of the Linux operating system used by many Fortune 500 companies, also offers its own storage software. And, it wants to become a more formidable challenger in data storage, a goal that can be furthered by buying Permabit's technology, Fichera said. Slashdot reader See Attached points out that this week Red Hat also released RHEL 7.4, which introduces support for Network Bound Disk Encryption (NBDE) and system protection against intrusive USB devices.' -- source: https://linux.slashdot.org/story/17/08/05/0453223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Hardeners Grsecurity Sue Open Source's Bruce Perens
by Peter Reutemann 06 Aug '17

06 Aug '17

'In late June, noted open-source programmer Bruce Perens [a longtime Slashdot reader] warned that using Grsecurity's Linux kernel security could invite legal trouble. "As a customer, it's my opinion that you would be subject to both contributory infringement and breach of contract by employing this product in conjunction with the Linux kernel under the no-redistribution policy currently employed by Grsecurity," Perens wrote on his blog. The following month, Perens was invited to court. Grsecurity sued the open-source doyen, his web host, and as-yet-unidentified defendants who may have helped him draft that post, for defamation and business interference. Grsecurity offers Linux kernel security patches on a paid-for subscription basis. The software hardens kernel defenses through checks for common errors like memory overflows. Perens, meanwhile, is known for using the Debian Free Software Guidelines to draft the Open Source Definition, with the help of others. Grsecurity used to allow others to redistribute its patches, but the biz ended that practice for stable releases two years ago and for test patches in April this year. It offers its GPLv2 licensed software through a subscription agreement. The agreement says that customers who redistribute the code -- a right under the GPLv2 license -- will no longer be customers and will lose the right to distribute subsequent versions of the software. According to Perens, "GPL version 2 section 6 explicitly prohibits the addition of terms such as this redistribution prohibition." A legal complaint (PDF) filed on behalf of Grsecurity in San Francisco, California, insists the company's software complies with the GPLv2. Grsecurity's agreement, the lawsuit states, only applies to future patches, which have yet to be developed. Perens isn't arguing that the GPLv2 applies to unreleased software. Rather, he asserts the GPLv2, under section 6, specifically forbids the addition of contractual terms.' -- source: https://yro.slashdot.org/story/17/08/04/2233239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Browser Extensions Are Undermining Privacy
by Peter Reutemann 06 Aug '17

06 Aug '17

'pizzutz writes: Chrome's popular Web Developer plugin was briefly hijacked on Wednesday when an attacker gained control of the author's Google account and released a new version (0.49) which injected ads into web pages of more than a million users who downloaded the update. The version was quickly replaced with an uncompromised version (0.5) and all users are urged to update immediately. Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts. Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."' -- source: https://yro.slashdot.org/story/17/08/05/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows console is getting a new, easier to read color scheme
by Lawrence D'Oliveiro 03 Aug '17

03 Aug '17

“Even with this work, the Windows console is still weak compared to its counterparts in macOS and Linux. In Windows, the operating systems-supplied console windows are closely tied to the command-line applications that use them; it's impossible to create a command-line application that isn't attached to a Windows console window. Linux and macOS offer a separation between the software that's displaying the console apps and the console apps themselves. Those operating systems have a built-in default console, but unlike Windows, they don't have to use it; third-party software can fill the same role. “Attractive, modern terminal applications like iTerm on macOS and Unix stalwarts such as screen (which enables multiple command-line shells to share a single console window) take advantage of this extensibility. Neither kind of application can be readily developed for command-line apps on Windows, and while people have tried to work around Windows' limitations (for example, by hiding the Windows built-in console windows off-screen somewhere), the results are imperfect. We're told that there are plans in store to finally address this weakness of Windows, though what the solution will be is at present unknown.” <https://arstechnica.com/gadgets/2017/08/the-windows-console-is-getting-a-ne…>

1 0

Systemd wins top gong for 'lamest vendor' in Pwnie security awards
by Bryan Baldwin 30 Jul '17

30 Jul '17

The lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement. Nomination Submission: Awarded to the vendor who mis-handled a security vulnerability most spectacularly. SystemD bugs 5998, 6225, 6214, 5144, 6237 Credit: Lennart Poettering Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie! https://pwnies.com/nominations/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/

3 2

Trust Me, I’m A Random-Number Generator
by Lawrence D'Oliveiro 30 Jul '17

30 Jul '17

SK Telecom has created a “quantum random number generator” chip <https://www.theregister.co.uk/2017/07/26/sk_telecom_makes_light_of_random_n…>. Seems like slapping the label “quantum” on anything is enough to make people believe you know what you are talking about. Random-number generators are notorious for being easily subverted. And hearing things like “SK Telecom hasn't specified what kind [of quantum noise source they are using]” is not exactly reassuring. You can never be sure your random numbers are truly random. But you try to stack the deck as much in your favour as you can. The Linux kernel mixes in several sources of entropy to feed /dev/random (and from there, /dev/urandom), in the hope that, as long as one of them remains unsubverted (intentionally or otherwise), the output can be trusted. This is also the principle behind the Fortuna PRNG <https://en.wikipedia.org/wiki/Fortuna_(PRNG)>, which well-known computer security guru Bruce Schneier had a hand in.

2 3