- wlug - list.wlug.org.nz

Anti-systemd Trolls
by Lawrence D'Oliveiro 27 Jul '17

27 Jul '17

I keep wondering about these random names who pop up with all the badmouthing every time somebody mentions something about systemd. I don’t recall any faces at WLUG meetings that go with them. Who are you and where do you come from? Do you people have any interest in the Waikato Linux User Group at all, or are you just here to shoot your mouths off?

4 9

Some Low-Cost Android Phones Come at a Price -- Your Privacy
by Peter Reutemann 27 Jul '17

27 Jul '17

'At $60, the BLU R1 HD is the top-selling phone on Amazon. Last November, researchers caught it secretly sending private data to China. Shanghai Adups Technology, the group behind the spying software on the BLU R1 HD, called it a mistake. But analysts at Kryptowire found the software provider is still making the same "mistake" on other phones. At the Black Hat security conference in Las Vegas on Wednesday, researchers from Kryptowire, a security firm, revealed that Adups' software is still sending a device's data to the company's server in Shanghai without alerting people. But now, it's being more secretive about it. "They replaced them with nicer versions," Ryan Johnson, a research engineer and co-founder at Kryptowire, said. "I have captured the network traffic of them using the Command and Control channel when they did it." An Adups spokeswoman said that it had resolved the issues in 2016 and that the issues "are not existing anymore." Kryptowire said it has observed the company sending data without telling users on at least three different phones.' -- source: https://it.slashdot.org/story/17/07/26/187258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wellcome Trust Wants To Share
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

You’ve probably heard of the Wellcome Trust: they’re a UK-based nonprofit that funds scientific research, primarily into health. They’ve long had an open-access policy, meaning that “all original research articles and scholarly monographs resulting from our funding are made freely available”. Contrast this with what more commonly happens with scientific research, where the journal publishers get exclusive copyright over the papers, and charge an arm and a leg to everyone wanting a copy. Now the Wellcome Trust is going even further, and requiring open access in a timely manner to the raw research data (within reasonable limits, such as privacy concerns etc), material such as cell lines, antibodies and reagents, and also any software developed. No actual mention of “open source” or “Free software” licences as such, though; the news article only uses the word “freeware”, which I’m not sure is the word they should be using. <https://www.theregister.co.uk/2017/07/25/wellcome_trust_extends_research_da…> <https://wellcome.ac.uk/news/our-new-policy-sharing-research-data-what-it-me…>

1 0

Intel Abandons Consumer/Hobbyist IoT
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Intel is giving up on its consumer/hobbyist-oriented Internet of Things products <https://www.theregister.co.uk/2017/07/25/intel_arduino_board_curie_canceled/>. However, the “enterprise”-oriented efforts remain for now. Not sure what “enterprise” means in this space: are there companies building IoT-type devices for their own internal use? Or is this referring to companies selling readymade IoT products? In any case, I suspect this is the one area left where “Windows 10 IoT Edition” can be mentioned without raising hails of derisive laughter...

1 0

The systemd House Of Horror
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Came across this link in one of the comments to The Register’s article on Fedora 26, rife with the usual anti-systemd moaning. “Here are some examples of how people commonly use systemd in an egregiously wrong manner ... Don't ask me why, so far, all of these have involved starting Java programs. Maybe it's Oracle in general.” <https://jdebp.eu/FGA/systemd-house-of-horror/>

2 6

'Devil's Ivy' Is Another Wake-Up Call for IoT Security
by Peter Reutemann 26 Jul '17

26 Jul '17

'The vulnerability -- called Devil's Ivy or CVE-2017-9765 -- was made public last week by Senrio, a company that specializes in IoT security. It initially found the bug in the M3004 model security camera marketed by Axis Communications, but further research found that 249 of Axis's 251 surveillance camera models are affected. Although that's of lot of devices, it's only the tip of the iceberg, as the problem isn't with code that's native to Axis products but is in gSOAP, an open source web services library that's used by many developers. Media outlets are reporting that 34 companies use gSOAP -- a list that includes Microsoft, IBM, Xerox and Adobe.' -- source: http://windowsitpro.com/internet-things-iot/devils-ivy-another-wake-call-io… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Using Gnome Disk Utility - "Disks" - to install distro iso to USB stick.
by Ian Stewart 24 Jul '17

24 Jul '17

Hi, I mentioned this at last nights meeting, so here is the link info. You might be used to burning distro iso image files to USB sticks using the dd command line utility, or Ubuntu's Startup Disk Creator gui application. The Fedora 21 Installation Guide<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/inde…> describes another way<https://docs.fedoraproject.org/en-US/Fedora/21/html/Installation_Guide/sect…>. You launch the Gnome Disk Utility by clicking on the Disks application icon, or from the command line as gnome-disks, and follow these instructions... Procedure 3.4. Creating USB media with GNOME Disks 1. On a system with GNOME, or with the gnome-disk-utility package installed, open Disks using the system menu. 2. Click your USB device in the left column. 3. Click the menu icon in the upper right corner of the window, and choose the Restore Disk Image option. 4. Navigate to your image file and click Start Restoring. After a few minutes, it will report the process is complete and your installation media will be ready to use. cheers, Ian.

2 1

How a VC-Funded Company Is Undermining the Open-Source Community
by Peter Reutemann 24 Jul '17

24 Jul '17

'Is a $4 million venture capital-funded startup stealthily taking over popular coding tools and injecting ads and spyware into them? That's what some programmers fear may be happening. It is one of the most troubling scandals to hit the open-source community -- a robust network of programmers who work on shared tools for free -- in recent memory. It started back in April, when a programmer noticed a strange change to an open-source tool called Minimap. Minimap has had more than 3.5 million downloads, but like many open-source tools, it was maintained by a single person who no one knew much about other than their username: @abe33. At some point, @abe33, whose real name is Cedric Nehemie, was hired by Kite. Kite was started by Adam Smith, a successful tech entrepreneur who raised funding from a slew of big names including the CEO of Dropbox and the creator of WordPress. It is unclear what Kite's business model is, but it says it uses machine-learning techniques to make coding tools. Its tools are not open source. After being hired by Kite, @abe33 made an update to Minimap. The update was titled "Implement Kite promotion," and it appeared to look at a user's code and insert links to related pages on Kite's website. Kite called this a useful feature. Programmers said it was not useful and was therefore just an ad for an unrelated service, something many programmers would consider a violation of the open-source spirit. "It's not a feature, it's advertising -- and people don't want it, you want it," wrote user @p-e-w. "The least you can do is own up to that." "I have to wonder if your goal was to upset enough people that you'd generate real attention on various news sites and get Kite a ton of free publicity before your next funding round," @DevOpsJohn wrote. "That's the only sane explanation I can find for suddenly dropping ads into the core of one of the oldest and most useful Atom plugins." [...] Although Kite has no business model yet, it's widely thought in Silicon Valley that having users is the first step toward profitability. Adding users potentially benefits the company in another way, by giving it access to precious data. Kite says it uses machine learning tactics to make the best coding helper tools possible. In order to do that, it needs tons of data to learn from. The more code it can look at, the better its autocomplete suggestions will get, for example.' -- source: https://developers.slashdot.org/story/17/07/24/0118202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

DNS Lib Underscore Bug Bites Everyone's Favorite Init Tool, Blanks Netflix
by Peter Reutemann 24 Jul '17

24 Jul '17

'Systemd doing what it does best. From a report on The Register: A few Penguinistas spent a weekend working out why they can't get through to Netflix from their Linux machines, because when they tried, their DNS lookups failed. The issue emerged over the weekend, when Gentoo user Dennis Schridde submitted a bug report to the Systemd project. Essentially, he described a failure within systemd-resolve, a Systemd component that turns human-readable domain names into IP addresses for software, like web browsers, to connect to. The Systemd resolver couldn't look up Netflix's servers for Schridde's web browser, according to the report. In his detailed post, Schridde said he expected this to happen: ipv6_1-cxl0-c088.1.lhr004.ix.nflxvideo.net gets resolved to 37.77.187.142 or 2a00:86c0:5:5::142. When in reality, that wasn't happening, so Netflix couldn't be reached on his box. His speculation that libidn2, which adds internationalised domain names support to the resolver, was at fault turned out to be accurate. Rebuilding Systemd without that library cleared the problem.' -- source: https://linux.slashdot.org/story/17/07/24/1558259 Please, no flame war... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious Mac Malware Has Infected Hundreds of Victims For Years
by Peter Reutemann 24 Jul '17

24 Jul '17

'A mysterious piece of malware has been infecting hundreds of Mac computers for years -- and no one noticed until a few months ago. The malware is called "FruitFly," and one of its variants, "FruitFly 2" has infected at least 400 victims over the years. FruitFly 2 is intriguing and mysterious: its goals, who's behind it, and how it infects victims, are all unknown. Earlier this year, an ex-NSA hacker started looking into a piece of malware he described to me as "unique" and "intriguing." It was a slightly different strain of a malware discovered on four computers earlier this year by security firm Malwarebytes, known as "FruitFly." This first strain had researchers scratching their heads. On the surface, the malware seemed "simplistic." It was programmed mainly to surreptitiously monitor victims through their webcams, capture their screens, and log keystrokes. But, strangely, it went undetected since at least 2015. There was no indication of who could be behind it, and it contained "ancient" functions and "rudimentary" remote control capabilities, Malwarebytes's Thomas Reed wrote at the time.' -- source: https://it.slashdot.org/story/17/07/24/1719255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's New Open Source Voice-Recognition Project Wants Your Voice
by Peter Reutemann 23 Jul '17

23 Jul '17

'Mozilla is building a massive repository of voice recordings for the voice apps of the future -- and it wants you to add yours to the collection. The organization behind the Firefox browser is launching Common Voice, a project to crowdsource audio samples from the public. The goal is to collect about 10,000 hours of audio in various accents and make it publicly available for everyone... Mozilla hopes to hand over the public dataset to independent developers so they can harness the crowdsourced audio to build the next generation of voice-powered apps and speech-to-text programs... You can also help train the speech-to-text capabilities by validating the recordings already submitted to the project. Just listen to a short clip, and report back if text on the screen matches what you heard... Mozilla says it aims is to expand the tech beyond just a standard voice recognition experience, including multiple accents, demographics and eventually languages for more accessible programs. Past open source voice-recognition projects have included Sphinx 4 and VoxForge, but unfortunately most of today's systems are still "locked up behind proprietary code at various companies, such as Amazon, Apple, and Microsoft."' -- source: https://news.slashdot.org/story/17/07/22/2026208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian, Gnome Patched 'Bad Taste' VBScript-Injection Vulnerabilities
by Peter Reutemann 23 Jul '17

23 Jul '17

'A now-patched vulnerability in the "GNOME Files" file manager was recently discovered which allowed hackers to create dodgy MSI files which would run malicious VBScript code on Linux... Once Nils Dagsson Moskopp discovered the bug, he reported it to the Debian Project which fixed it very rapidly. The GNOME Project also patched the gnome-exe-thumbnailer file which is responsible for parsing MSI and EXE files inside the GNOME Files app... If you run a Linux distribution with the GNOME desktop it's advisable to run the update manager and check for updates as soon as possible before you become affected by this critical vulnerability.' -- source: https://tech.slashdot.org/story/17/07/22/1911237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 'Stretch' Updated With 9.1 Release
by Peter Reutemann 23 Jul '17

23 Jul '17

'The Debian project is pleased to announce the first update of its stable distribution Debian 9 (codename "stretch"). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems... Please note that the point release does not constitute a new version of Debian 9 but only updates some of the packages included. There is no need to throw away old "stretch" media... Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release.' -- source: https://linux.slashdot.org/story/17/07/23/1930253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next week?
by Peter Reutemann 22 Jul '17

22 Jul '17

Hi everyone We don't have any topics lined up yet for next Monday's meeting. Any ideas? A new Fedora release (https://getfedora.org/) is out - give it a spin? Maybe an introduction on how to use man pages efficiently? For commands and programming? Introduction to useful basic commands: ls, cat/tac/zcat, less, column, grep, find, sort, sed, ... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

next lug meet -fedora 26
by Ian Young 22 Jul '17

22 Jul '17

I will bring a live version of Fedora 26 if there is time available at the meeting ~ Ian Y

2 1

Sysadmin position
by Stuart Inglis 20 Jul '17

20 Jul '17

We are looking for an experienced Linux Administrator to join our team. Being one of the larger website hosting providers in New Zealand our ideal candidate would come from an ISP or web hosting background. To be successful in this role, you would ideally have: - 3+ Years practical experience in the administration of Linux servers - Great multi-tasking skills - Ability to troubleshoot complex problems, software faults, and operational issues and take appropriate corrective action personally and by interacting with other members of the systems team. - Strong technical knowledge - Experience in setting up high-load, high-availability, multi-data centre environments - Experience in supporting MySQL - Configuring and fine-tuning Apache - Knowledge of web architecture - Disaster recovery management - Experience with KVM or other Virtualisation platforms - Excellent communication skills are essential In return we can offer you the chance to work for a leading organisation, work on some exciting projects and deliver key solutions to a variety of clients. This position is based in our office in Hamilton, no teleworking. Applications must be able to attend interviews in Hamilton, NZ. If this sounds like you please don't hesitate to send in your CV today. kind regards Stuart Inglis, Ph.D. | Chief Technology Officer Director NetValue Limited Level 1, SouthBloc, 19 Knox Street, Hamilton M +64 (0) 21 907 532 E stuart.inglis(a)netvalue.nz | W netvalue.nz

1 0

4 lightweight image viewers for the Linux desktop
by Peter Reutemann 18 Jul '17

18 Jul '17

'Like most people, you probably have more than a few photos and other images on your computer. And, like most people, you probably like to take a peek at those images and photos every so often. Firing up an editor like GIMP or Pinta is overkill for simply viewing images. On the other hand, the basic image viewer included with most Linux desktop environments might not be enough for your needs. If you want something with a few more features, but still want it to be lightweight, then take a closer look at these four image viewers for the Linux desktop, plus a handful of bonus options if they don't meet your needs.' -- source: https://opensource.com/article/17/7/4-lightweight-image-viewers-linux-deskt… I've just switched to Nomacs as my default viewer. Fast and displays the EXIF information in a separate pane, which is rather handy for my work. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bruce Schneier’s Book Review: “Twitter And Tear Gas”
by Lawrence D'Oliveiro 14 Jul '17

14 Jul '17

There are two opposing models of how the Internet has changed protest movements. The first is that the Internet has made protesters mightier than ever. ... The second is that it has made them more ineffectual. Derided as "slacktivism" or "clicktivism," the ease of action without commitment can result in movements like Occupy petering out in the US without any obvious effects. Of course, the reality is more nuanced ... <https://www.schneier.com/blog/archives/2017/07/book_review_twi.html>

1 0

PC Sales Still In Decline
by Lawrence D'Oliveiro 14 Jul '17

14 Jul '17

Looks like world PC shipments are now down to about 240 million a year <https://www.theregister.co.uk/2017/07/13/pc_sales_still_slumping_but_more_s…>. I think the peak, maybe ten years ago, was a million a day.

1 0

Looking for something to celebrate today?
by Ian Stewart 14 Jul '17

14 Jul '17

Hi, If you are looking for something to celebrate today, the 14th July 2017, then there's always the storming of La Bastille<https://en.wikipedia.org/wiki/Storming_of_the_Bastille>. If this doesn't appeal, and you are looking for something a little more global, then there is a minor milestone in Unix epoch time<https://en.wikipedia.org/wiki/Unix_time>. For NZ this will occur today at 14:40. It is when Unix time ticks over the 1.5 billion seconds mark. $ date --date="@1500000000" Fri Jul 14 14:40:00 NZST 2017 If you can't think of anything else to do then you can watch it happen here... https://www.epochconverter.com/ ...or repeatedly enter this on your console... $ echo "How many seconds to go:" $((1500000000 - $(date +%s))) If this event is a little low key, and you'd rather wait for it to tick over the 2 billion mark, then you'll have to hold off with the celebrations for another 16 years... $ date --date="@2000000000" Wed May 18 15:33:20 NZST 2033 Cheers to another 1.5 billion seconds and many more. Ian.

2 1

Tim Berners-Lee Approves Web DRM, But W3C Members Have Two Weeks To Appeal
by Peter Reutemann 12 Jul '17

12 Jul '17

'der Atticus Rex writes: A high controversial Web standard has received a seal of approval from Tim Berners-Lee, the inventor of the Web and its chief technical decision-maker. Opponents like the Free Software Foundation and Electronic Frontier Foundation say that the standard, Encrypted Media Extensions, is a step backwards for freedom, privacy, and a host of other rights on the Web. There's still a two-week window in which members of the W3C can appeal the decision, and the Free Software Foundation is asking people to email and encourage them to do so.' -- source: https://news.slashdot.org/story/17/07/08/0147206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

net neutrality article on BBC
by Ian Young 12 Jul '17

12 Jul '17

Some may not have seen this. I thought it a useful summary of the current state of play around this issue. http://www.bbc.com/news/blogs-trending-40494909

2 1

Fedora 26 Linux Distro Released
by Peter Reutemann 12 Jul '17

12 Jul '17

'Today, Fedora 26 sheds its pre-release status and becomes available for download as a stable release. GNOME fans are in for a big treat, as version 3.24 is default. If you stick to stable Fedora releases, this will be your first time experiencing that version of the desktop environment since it was released in March. Also new is LibreOffice 5.3, which is an indispensable suite for productivity. If you still use mp3 music files I've moved onto streaming), support should be baked in for both encoding and decoding. "The latest version of Fedora's desktop-focused edition provides new tools and features for general users as well as developers. GNOME 3.24 is offered with Fedora 26 Workstation, which includes a host of updated functionality including Night Light, an application that subtly changes screen color based on time of day to reduce effect on sleep patterns, and LibreOffice 5.3, the latest update to the popular open source office productivity suite. For developers, GNOME 3.24 provides matured versions of Builder and Flatpak to make application development for a variety of systems, including Rust and Meson, easier across the board," says the Fedora Project.' -- source: https://linux.slashdot.org/story/17/07/11/1722202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Is Now Available On the Windows Store
by Peter Reutemann 11 Jul '17

11 Jul '17

'Ubuntu is now available for download on the Windows Store. "Initially spotted by Rafael Rivera and Necrosoft Core on Twitter, Ubuntu on the Windows Store will let you install and run the Ubuntu terminal on Windows next to your other apps," reports Windows Central. From the report: Ubuntu's arrival, and that of SUSE, are part of a recent push by Microsoft to embrace Linux and the open source community more broadly. This began with the arrival of the Windows Subsystem for Linux in 2016, allowing users to use the Bash shell from within Windows. Keep in mind that this is limited to the Fall Creators Update, which isn't set for a public release until later this year. If you're running a PC testing the Fall Creators Update through the Windows Insider Program, however, you should be able to download and try Ubuntu from the Windows Store just fine. ' -- source: https://news.slashdot.org/story/17/07/10/202218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Multics Lives!
by Lawrence D'Oliveiro 10 Jul '17

10 Jul '17

I previously mentioned <https://list.waikato.ac.nz/pipermail/wlug/2015-August/013714.html> the old Multics OS, which was so complex and so delayed in its development that a group of folks at AT&T Bell Labs decided not to wait and created their own, less ambitious OS instead, deciding to call it “UNIX” as a sort of pun on “Multics”. Well, at long last <https://www.theregister.co.uk/2017/07/10/multics_resurrected_in_new_simulat…>, you can now run Multics for yourself. The original mainframe hardware is long gone, but today’s PCs can easily support a suitable software emulation without breaking too much of a sweat--even a Raspberry π 2, it seems, can run the emulation at something close to the speed of the early mainframe units. All it took was some suitably dedicated people to build such an emulator. And now you can download their work and try it out for yourself.

1 0

Let’s Encrypt: Wildcard Certs Coming Soon
by Lawrence D'Oliveiro 07 Jul '17

07 Jul '17

Anybody using Let’s Encrypt? Having recently set it up for a client, I’m really impressed with it. It gives you HTTPS certs for your web servers at no cost, and with very little effort, since the entire process is automated (with authentication via the “ACME” protocol). The certs are only valid for 90 days, to try to minimize potential damage from any compromises, but the renewal process is equally easy to automate. The one service they haven’t offered up to now is certs for wildcard domains (e.g. “*.example.com”). Looks like they will soon have a procedure for this, too <https://arstechnica.com/information-technology/2017/07/lets-encrypt-to-star…>.

2 1

OneDrive Has Stopped Working On Non-NTFS Drives
by Peter Reutemann 07 Jul '17

07 Jul '17

'OneDrive users around the world have been upset to discover that with its latest update, Microsoft's cloud file syncing and storage system no longer works with anything other than disks formatted with the NTFS file system. Both older file systems, such as FAT32 and exFAT, and newer ones, such as ReFS, will now provoke an error message when OneDrive starts up. To continue to use the software, files will have to be stored on an NTFS volume. While FAT disks can be converted, ReFS volumes must be reformatted and wiped. This has left various OneDrive users unhappy. While NTFS is the default file system in Windows, people using SD cards to extend the storage on small laptops and tablets will typically use exFAT. Similarly, people using Storage Spaces to manage large, redundant storage volumes will often use ReFS. The new policy doesn't change anything for most Windows users, but those at the margins will feel hard done by. Microsoft said in a statement that it "discovered a warning message that should have existed was missing when a user attempted to store their OneDrive folder on a non-NTFS filesystem -- which was immediately remedied." According to Ars, Microsoft's position, apparently, is that OneDrive should always have warned about these usage scenarios and that it's only a bug or an oversight that allowed non-NTFS volumes to work.' -- source: https://hardware.slashdot.org/story/17/07/06/2012255 Time to switch to ownCloud! :-) https://owncloud.org/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs
by Peter Reutemann 07 Jul '17

07 Jul '17

'WikiLeaks has today published the 15th batch of its ongoing Vault 7 leak, this time detailing two alleged CIA implants that allowed the agency to intercept and exfiltrate SSH (Secure Shell) credentials from targeted Windows and Linux operating systems using different attack vectors. Secure Shell or SSH is a cryptographic network protocol used for remote login to machines and servers securely over an unsecured network. Dubbed BothanSpy -- implant for Microsoft Windows Xshell client, and Gyrfalcon -- targets the OpenSSH client on various distributions of Linux OS, including CentOS, Debian, RHEL (Red Hat), openSUSE and Ubuntu. Both implants steal user credentials for all active SSH sessions and then sends them to a CIA-controlled server. ' -- source: https://linux.slashdot.org/story/17/07/06/224211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Bugs Are Too Valuable To Report To Apple
by Peter Reutemann 07 Jul '17

07 Jul '17

'Last year, Apple launched a long-awaited bug bounty program to reward friendly hackers who report flaws in the iPhone to the company. Despite inviting some of the best hackers in the world to join, it's a bit of a flop so far. The iPhone's security is so tight that it's hard to find any flaws at all, which leads to sky-high prices for bugs on the grey market. Researchers I spoke to are reluctant to report bugs both because they are so valuable and because reporting some bugs may actually prevent them from doing more research. "People can get more cash if they sell their bugs to others," said Nikias Bassen, a security researcher for the company Zimperium, and who joined Apple's program last year. "If you're just doing it for the money, you're not going to give [bugs] to Apple directly." Patrick Wardle, a former NSA hacker who now specializes in MacOS research and was invited to the Apple bug bounty program, agreed. He said that iOS bugs are "too valuable to report to Apple."' -- source: https://apple.slashdot.org/story/17/07/06/1551210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Severe' Systemd Bug Allowed Remote Code Execution For Two Years
by Peter Reutemann 06 Jul '17

06 Jul '17

'A flaw in systemd, the init system used on many Linux systems, can be exploited using a malicious DNS query to either crash a system or to run code remotely. The vulnerability resides in the daemon systemd-resolved and can be triggered using a TCP payload, according to Ubuntu developer Chris Coulson. This component can be tricked into allocating less memory than needed for a look-up. When the reply is bigger it overflows the buffer allowing an attacker to overwrite memory. This would result in the process either crashing or it could allow for code execution remotely. "A malicious DNS server can exploit this by responding with a specially crafted TCP payload to trick systemd-resolved in to allocating a buffer that's too small, and subsequently write arbitrary data beyond the end of it," is how Coulson put it. Affected Linux vendors have pushed out patches -- but the bug has apparently been present in systemd code since June of 2015. And long-time Slashdot reader walterbyrd also reports a recently-discovered bug where systemd unit files that contain illegal usernames get defaulted to root.' -- source: https://it.slashdot.org/story/17/07/03/0343258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Raspberry Pi's Smaller, Cheaper Rival: NanoPi Neo Plus2 Weighs in at $25
by Peter Reutemann 05 Jul '17

05 Jul '17

'FriendlyARM, the maker of compact NanoPi developer boards, has released the NanoPi Neo Plus2 for $25. From a report: This board is an update to the recently released NanoPi Neo 2, a $15 cookie-sized developer board measuring 40mm x 40mm (1.6in) with a 64-bit Allwinner H5 processor, 512MB RAM, and one USB port. The NanoPi Neo Plus2 is slightly larger at 52mm x 40mm (2in x 1.6in) and has two USB ports. It has the same H5 quad-core A53 ARM Cortex processor, but comes with 1GB RAM and 8GB eMMC storage. The NeoPlus2's storage in addition to Gigabit Ethernet puts it ahead of the Raspberry Pi 3 on paper, and at $25 undercuts the better-known board by $10.' -- source: https://hardware.slashdot.org/story/17/07/05/0211212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Parlatype - A Manual Audio Transcription App for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Parlatype is a minimal GNOME audio player for manual speech transcription. It plays audio sources to transcribe them in your favorite text application. It features a simple themeable GUI with a track timeline (with a waveform view) and clearly visible buttons and a playback speed tuner. It doesn't come with that many settings but then again, remember - it is a simple audio transcriber.' -- source: https://www.fossmint.com/parlatype-a-audio-transcription-tool-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Lollypop – A New Modern Music Player for Linux
by Peter Reutemann 05 Jul '17

05 Jul '17

'Lollypop is a lightweight modern and material design-inspired music player designed to work excellently on the GNOME desktop environment. It has a focus on an intuitive minimal design which makes it easy to pick it up and begin using right away. It features all the functions you would expect from a music player like browsing and searching through your collection of music files, fetching lyrics and artist biography from the internet, as well as automatically fetching cover arts for music files.' -- source: https://www.fossmint.com/lollypop-a-new-modern-music-player-for-linux/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GnuPG crypto library cracked, look for patches
by Lawrence D'Oliveiro 05 Jul '17

05 Jul '17

What they found is that the libgcrypt library used what's called “sliding windows”, a method for carrying out the mathematics of cryptography – but one that's known to leak data. ... What they found was an unpleasant surprise: a complete break of the library's RSA-1024... <https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_…> Cue the conspiracy theorists lining up to say “Given the controversy surrounding GnuPG and the way they operate, one just has to wonder "bug or backdoor?"”

2 2

Latte Dock – An Elegant and Intuitive Dock for Your Tasks and Plasmoids
by Peter Reutemann 03 Jul '17

03 Jul '17

'Latte Dock is arguably the best dock app for KDE Plasma especially since the release of its stable version 0.6 in April. It is based on plasma frameworks, that working together to provide users with an elegant and intuitive experience while going about their everyday PC tasks. Latte Dock is unlike some dock apps in the market in the sense that it lets you replace your desktop panels completely. You can use it to run multiple docks on one screen, mimic several panel layouts including that of Unity and Plasma, set animation styles especially using its parabolic zoom effects, and organize Plasmoids.' -- source: https://www.fossmint.com/latte-dock-an-elegant-and-intuitive-dock-for-kde-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.12 Officially Released
by Peter Reutemann 03 Jul '17

03 Jul '17

'After seven weeks of announcing release candidate versions, Linus Torvalds today informs the Linux community through a mailing list announcement about the general availability of the Linux 4.12 kernel series. Development on the Linux 4.12 kernel kicked off in mid-May with the first release candidate, and now, seven weeks later we can finally get our hands on the final release... A lot of great improvements, new hardware support, and new security features were added during all this time, which makes it one of the biggest releases, after Linux 4.9... Prominent features of the Linux 4.12 kernel include initial support for AMD Radeon RX Vega graphics cards, intial Nvidia GeForce GTX 1000 "Pascal" accelerated support, implementation of Budget Fair Queueing (BFQ) and storage-I/O schedulers, more MD RAID enhancements, support for Raspberry Pi's Broadcom BCM2835 thermal driver, a lot of F2FS optimizations, as well as ioctl for the GETFSMAP space mapping ioctl for both XFS and EXT4 filesystems. Linus said in announcing the release that "I think only 4.9 ends up having had more commits," also noting that 4.9 was a Long Term Support kernel, whereas "4.12 is just plain big." "There's also nothing particularly odd going on in the tree - it's all just normal development, just more of it than usual."' -- source: https://linux.slashdot.org/story/17/07/03/0410253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTPS Certificate Revocation Doesn’t Work: Some Fixes
by Lawrence D'Oliveiro 03 Jul '17

03 Jul '17

The traditional mechanisms for revoking compromised TLS/SSL certifications--cert revocation lists (CRLs) and Online Certificate Status Protocol (OCSP)--don’t really work. But something can be done about this, in the form of “OCSP Must Staple”. Also the issue of rogue certifications--certs issued for your domain without your knowledge or permission--can be mitigated with Certificate Transparency (CT), where the issuing Certificate Authorities (CAs) publish all the certs they have given out, to allow crosschecks. There is also Certificate Authority Authorization (CAA), where the DNS entry for your domain specifies which CA(s) are allowed to issue certs for it. <https://arstechnica.com/security/2017/07/https-certificate-revocation-is-br…>

1 0

Debian Linux reveals Intel Skylake and Kaby Lake processors have broken hyper-threading
by Peter Reutemann 03 Jul '17

03 Jul '17

'Do you have an Intel Skylake and Kaby Lake processor under your computer's hood? Have you experienced unexplained application and system hiccups, data corruption, or data loss? It could be because your chipset has hyper-threading enabled and the chips are malfunctioning. Henrique de Moraes Holschuh, a Debian Linux developer, revealed the Intel chip problem on the Debian developer list. Officially, Intel hasn't acknowledged the problem, but engineers at Dell and Intel have told me that the problem, and its fix, exists. This processor/microcode defect has been found on Intel Skylake and Intel Kaby Lake processors with hyper-threading enabled. Besides these 6th and 7th generation Intel Core processors, its also found on its related server processors, such as Xeon v5 and Xeon v6, and some select Intel Pentium processor models. While the Debian community revealed the problem, it's not Linux-specific. Any operating system -- Windows, macOS,FreeBSD, you name it -- can run into the problem. According to Intel chip errata, "Under complex micro-architectural conditions, short loops of less than 64 instructions that use AH, BH, CH or DH registers as well as their corresponding wider register (e.g. RAX, EAX or AX for AH) may cause unpredictable system behavior. This can only happen when both logical processors on the same physical processor are active." This will lead to the computer experiencing "unpredictable system behavior." What programs will cause a computer to act up? That's a good question, and we don't have a good answer. As Holschuh wrote, "We do not have enough information at this time to know how much software out there will trigger this specific defect."' -- source: http://www.zdnet.com/article/debian-linux-reveals-intel-skylake-kaby-lake-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

23 Years Of The Open Source 'FreeDOS' Project
by Peter Reutemann 03 Jul '17

03 Jul '17

Not quite Linux, but a good example of an open-source project: 'Jim Hall is celebrating the 23rd birthday of the FreeDOS Project, calling it "a major milestone for any free software or open-source software project," and remembering how it all started. An anonymous reader quotes Linux Journal: If you remember Windows 3.1 at the time, it was a pretty rough environment. I didn't like that you could interact with Windows only via a mouse; there was no command line. I preferred working at the command line. So I was understandably distressed in 1994 when I read via various tech magazines that Microsoft planned to eliminate MS-DOS with the next version of Windows. I decided that if the next evolution of Windows was going to be anything like Windows 3.1, I wanted nothing to do with it... I decided to create my own version of DOS. And on June 29, 1994, I posted an announcement to a discussion group... Our "PD-DOS" project (for "Public Domain DOS") quickly grew into FreeDOS. And 23 years later, FreeDOS is still going strong! Today, many people around the world install FreeDOS to play classic DOS games, run legacy business software or develop embedded systems... FreeDOS has become a modern DOS, due to the large number of developers that continue to work on it. You can download the FreeDOS 1.2 distribution and immediately start coding in C, Assembly, Pascal, BASIC or a number of other software development languages. The standard FreeDOS editor is quite nice, or you can select from more than 15 different editors, all included in the distribution. You can browse websites with the Dillo graphical web browser, or do it "old school" via the Lynx text-mode web browser. And for those who just want to play some great DOS games, you can try adventure games like Nethack or Beyond the Titanic, arcade games like Wing and Paku Paku, flight simulators, card games and a bunch of other genres of DOS games. On his "Open Source Software and Usability" blog, Jim says he's been involved with open source software "since before anyone coined the term 'open source'," and first installed Linux on his home PC in 1993. Over on the project's blog, he's also sharing appreciative stories from FreeDOS users and from people involved with maintaining it (including memories of early 1980s computers like the Sinclair ZX80, the Atari 800XL and the Coleco Adam). Any Slashdot readers have their own fond memories to share?' -- source: https://news.slashdot.org/story/17/07/02/1710200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Disputes 'Ads In MOTD' Claims
by Peter Reutemann 03 Jul '17

03 Jul '17

'Thursday Lproven (Slashdot reader #6030) wrote: It appears that Ubuntu is using a feature it has added -- intended to insert headlines of breaking tech news (security alerts and so on) into the Message of the Day displayed at login to the console -- to display advertising and promotional messages. The message in question linked to a Hacker Noon article titled "How HBO's Silicon Valley built 'Not Hotdog' with mobile TensorFlow, Keras & React Native." Later that day Dustin Kirkland, a Ubuntu Product Manager for the feature's design (and the Core Developer for its implementation) suggested the message had been mistaken for an ad, describing it on Hacker News as a "fun fact... an interesting tidbit of potpourri from the world of Ubuntu," and later saying it was intended like Google's doodles. "Last week's message actually announced an Ubuntu conference in Latin America. The week before, we linked to an article asking for feedback on Kubuntu. Before that, we announced the availability of Extended Security Maintenance updates for 12.04. And so on." He later confirmed Canonical received no money for the message, and also pointed out that the messages all come from an open source repository, and "You're welcome to propose your own messages for merging, if you have a well formatted, informative message for Ubuntu users." Click through for a condensed version of the complete response by Dustin Kirkland, Ubuntu Product and Strategy at Canonical.' -- source: https://news.slashdot.org/story/17/07/01/0550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

15 Devices (Including 6 Laptops) Awarded FSF's 'Respects Your Freedom' Certification
by Peter Reutemann 03 Jul '17

03 Jul '17

'This week the Free Software Foundation awarded its coveted 'Respects Your Freedom' certification to 15 products -- more than doubling the number of certified products (from 12 to 27) since the program began in 2012. An anonymous reader writes: The non-profit FSF certified six different laptops, two docking stations, three WiFi USB adapters and two internal WiFi devices, a mainboard, and their first-ever certified Bluetooth device, the TET-BT4 USB adapter. The products are all from Technoethical (formerly Tehnoetic), a Romania-based company who previously had just one mini wireless USB adapter on their list of FSF-certified products. "In 2014 we started selling hardware compatible with fully free systems in order to fund the free software activism work that we've been doing with our foundation," said Technoethical founder, Tiberiu C. Turbureanu. "Since then, we worked hard to build a hardware catalog that allows free software users to choose what best fits their computing needs, while also helping with the funding of different free software projects." "We are excited that Technoethical has brought out such an impressive collection of hardware whose associated software respects user freedom," said the FSF's executive director, John Sullivan. "RYF certification continues to gain speed and momentum, thanks to companies like them."' -- source: https://hardware.slashdot.org/story/17/07/02/205201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.2 (Sonya) released
by Peter Reutemann 02 Jul '17

02 Jul '17

Hi everyone Linux Mint 18.2, nicknamed Sonya, has been released. Here are the blog entries for the various flavors: - KDE http://blog.linuxmint.com/?p=3292 - XFCE http://blog.linuxmint.com/?p=3291 - MATE http://blog.linuxmint.com/?p=3290 - Cinnamon http://blog.linuxmint.com/?p=3289 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Govhack hamilton
by William Mckee 01 Jul '17

01 Jul '17

Hi, Govhack is happening end of July. Tickets are free. https://www.eventbrite.co.nz/e/govhack-nz-hamilton-tickets-35833922226 I'm planning on a project involving Waikato bus data. a static website that displays bus stops and when the next buses leave. Hope to see you there! Cheers, William

2 1

Open-Source Healthcare
by Lawrence D'Oliveiro 01 Jul '17

01 Jul '17

Report on a long-standing project called “NHSbuntu” to put together an open-source OS fit for use at the NHS in the UK <https://www.theregister.co.uk/2017/06/30/nhsbuntu_nhs_revolution/>. Also mentions Code4health, a “home for the growing number of open source projects in the health service”.

1 0

Tuesday’s massive ransomware outbreak was, in fact, something much worse
by Peter Reutemann 29 Jun '17

29 Jun '17

'Tuesday's massive outbreak of malware that shut down computers around the world has been almost universally blamed on ransomware, which by definition seeks to make money by unlocking data held hostage only if victims pay a hefty fee. Now, some researchers are drawing an even bleaker assessment—that the malware was a wiper with the objective of permanently destroying hard drives.' -- source: https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-… Welcome to cyber warfare... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Vulnerability Discovered In Latest Ubuntu Distributions, Users Advised To Update
by Peter Reutemann 29 Jun '17

29 Jun '17

'There is a vulnerability in the latest ubuntu distributions due to the DNS resolver included in systemd. The inclusion of the dns resolver was lamented by many on the mailing list, not without cause. All are advised to update their distribution.' -- source: https://news.slashdot.org/story/17/06/28/1659216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Testing For Windows Vulnerabilities On Linux
by Lawrence D'Oliveiro 27 Jun '17

27 Jun '17

What’s notable about this report <https://arstechnica.com/security/2017/06/latest-high-severity-flaw-in-windo…> on a vulnerability in Windows Defender is that the testing that uncovered the problem was done, not on Windows, but on Linux. The researcher, Tavis Ormandy, developed a framework <https://github.com/taviso/loadlibrary> for loading Windows DLLs (Dynamically-Loadable Libraries) under Linux so that he could take advantage of the superior tools available there.

1 0

Intel Quietly Discontinues Galileo, Joule, and Edison Development Boards
by Peter Reutemann 20 Jun '17

20 Jun '17

'Intel is discontinuing its Galileo, Joule, and Edison lineups of development boards. The chip-maker quietly made the announcement last week. From company's announcement: Intel Corporation will discontinue manufacturing and selling all skus of the Intel Galileo development board. Shipment of all Intel Galileo product skus ordered before the last order date will continue to be available from Intel until December 16, 2017. [...] Intel will discontinue manufacturing and selling all skus of the Intel Joule Compute Modules and Developer Kits (known as Intel 500 Series compute modules in People's Republic of China). Shipment of all Intel Joule products skus ordered before the last order date will continue to be available from Intel until December 16, 2017. Last time orders (LTO) for any Intel Joule products must be placed with Intel by September 16, 2017. [...] Intel will discontinue manufacturing and selling all skus of the Intel Edison compute modules and developer kits. Shipment of all Intel Edison product skus ordered before the last order date will continue to be available from Intel until December 16, 2017. Last time orders (LTO) for any Intel Edison products must be placed with Intel by September 16, 2017. All orders placed with Intel for Intel Edison products are non-cancelable and non-returnable after September 16, 2017. The company hasn't shared any explanation for why it is discontinuing the aforementioned development boards. Intel launched the Galileo, an Arduino-compatible mini computer in 2013, the Edison in 2014, and the Joule last year. The company touted the Joule as its "most powerful dev kit." You can find the announcement posts here.' -- source: https://hardware.slashdot.org/story/17/06/19/1720201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on the 26th
by Peter Reutemann 18 Jun '17

18 Jun '17

Hi everyone Unfortunately, I haven't had any inspirations as to topics for the upcoming meeting on June 26th. Any ideas or suggestions? Any cool software or distro that you'd like to demo? Personally, I've never seen an installation and day-to-day usage of Arch Linux (adding/removing applications, configuring services, etc)... Thanks. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Debian 9 "Stretch" released
by William Mckee 18 Jun '17

18 Jun '17

Hi, Debian 9 "Stretch" has been released... After 26 months of development the Debian project is proud to present its new stable version 9 (code name Stretch), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team. Debian 9 is dedicated to the project's founder Ian Murdock, who passed away on 28 December 2015. https://www.debian.org/News/2017/20170617 Cheers, William.

1 0