- wlug - list.wlug.org.nz

DMARC enforced
by Peter Reutemann 09 Aug '21

09 Aug '21

Hi everyone Just received an email from the IT department: "The university will be changing the DMARC action for the domain space waikato.ac.nz from quarantine to reject on Monday 16th August." However, for mailing lists they put some mitigation options in place. Please let me know if you encounter any problems posting to the WLUG list (starting next week). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Trace Toolkit Next Generation 2.13 Facilitates Quick Reaction To Kernel/User-space Instrumentation Hits
by Peter Reutemann 09 Aug '21

09 Aug '21

'LTTng has been called "the killer app for system-level debugging and performance tuning." And now long-time Slashdot reader compudj writes: It's the official release of LTTng 2.13 — Nordicité! LTTng is a kernel and user-space tracer for Linux. The most notable features of this release are: - Event-rule matches condition triggers and new actions, allowing internal actions or external monitoring applications to quickly react when kernel or user-space instrumentation is hit - Notification payload capture, allowing external monitoring applications to read elements of the instrumentation payload when instrumentation is hit. - Instrumentation API: vtracef and vtracelog (LTTng-UST) - User space time namespace context (LTTng-UST and LTTng-modules).' -- source: https://linux.slashdot.org/story/21/08/07/182213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Facebook Fiercely Guards The Privacy Of Its Advertisers
by Lawrence D'Oliveiro 07 Aug '21

07 Aug '21

Facebook has shut down all accounts and access for New York University’s Ad Observatory project <https://www.theregister.com/2021/08/04/facebook_research_lockdown/>. This project was using a browser extension to garner information about ads shown to Facebook users without the cooperation of Facebook itself. However, the project <https://adobservatory.org/> tries to be fully transparent about what it is doing to volunteers who choose to install the extension, and as is common these days, the source code is available on GitHub. Part of Facebook’s excuse is that the extension is somehow scraping information from the website that is “not publicly viewable”. How such information is getting to the user’s browser is not explained. Facebook has its own alternative research platform, called “FORT”, that it makes available to selected researchers on a strictly controlled basis. One of the conditions is that Facebook is given pre-publication access to research papers in order to identify--and remove--information that it considers to be “confidential”. Naturally, this kind of thing rings alarm bells for researchers. Another group has published an open letter <https://freedom-to-tinker.com/2021/08/05/facebooks-illusory-promise-of-tran…> pointing out why this is not an acceptable alternative.

1 1

Firefox Lost Almost 50 Million Users In 3 Years
by Peter Reutemann 05 Aug '21

05 Aug '21

'A report from It's FOSS, written by Ankush Das: Mozilla's Firefox is the only popular alternative to Chromium-based browsers. It has been the default choice for Linux users and privacy-conscious users across every platform. However, even with all benefits as one of the best web browsers around, it is losing its grip for the past few years. I came across a Reddit thread by u/nixcraft, which highlighted more details on the decline in the userbase of Firefox since 2018. And surprisingly, the original source for this information is Firefox's Public Data Report. As per the official stats, the reported number of active (monthly) users was about 244 million at the end of 2018. And, it seems to have declined to 198 million at the end of Q2 2021. So, that makes it a whopping ~46 million decline in the userbase. Considering 2021 is the year when privacy-focused tools saw a big boost in their userbase, Mozilla's Firefox is looking at a constant decline. Especially when Firefox manages to introduce some industry-first privacy practices. Quite the irony, eh? Just for fun, here's a timeline of our stories reporting on Firefox's download milestones from the mid-2000s: September 19, 2004: 1 Million Firefoxes in 4 Days December 12, 2004: Firefox Reaches 10 Million Downloads February 17, 2005: Firefox Breaks 25 Million Downloads April 26, 2005: Firefox nears 50 Million Downloads July 29, 2005: Firefox Downloads Reach 75 Million October 19, 2005: Firefox Tops 100 Million Downloads September 11, 2007: Firefox Hits 400 Million Downloads July 3, 2008: Firefox Breaks 8 Million, Gets Into Guinness' -- source: https://news.slashdot.org/story/21/08/04/2137205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome To No Longer Show Secure Website Indicators
by Peter Reutemann 04 Aug '21

04 Aug '21

'Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection. Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar. ' -- source: https://tech.slashdot.org/story/21/08/03/2049218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Will Kill Off Very Old Versions of Android Next Month
by Peter Reutemann 04 Aug '21

04 Aug '21

'Ars Technica: Google has started emailing users of very old Android devices to tell them it's time to say goodbye. Starting September 27, devices running Android 2.3.7 and lower will no longer be able to log in to Google services, effectively killing a big portion of the on-rails Android experience. As Google puts it in an official community post, "If you sign in to your device after September 27, you may get username or password errors when you try to use Google products and services like Gmail, YouTube, and Maps." Android is one of the most cloud-based operating systems ever. Especially in older versions, many included apps and services were tied to your Google login, and if that stops working, a large chunk of your phone is bricked. While Android can update many core components without shipping a full system update today, Android 2.3.7 Gingerbread, released around 10 years ago, was not so modular. The individual Google apps started to be updatable through the Android Market/Play Store, but signing in to Google was still a system-level service and is frozen in time. Any Google services wanting to allow sign-ins from those versions would have to conform to 2011-era security standards, which means turning off two-factor authentication and enabling a special "allow less-secure access" setting in your Google account. Really, these old Android versions have to die eventually because they're just too insecure. Google shows active user base breakdowns for Android versions in Android Studio, and Gingerbread has such a low device count that it doesn't even make the list. It's less than 0.2 percent of active devices, behind 14 other versions of Android. Users of these old devices could still sideload a third-party app store and find replacements for all the Google apps, but if you're a technical user and can't get a new device, there's a good chance you could load a whole new operating system with an aftermarket Android ROM. After September 27, the oldest version of Android you'll be able to sign in to is Android 3.0 Honeycomb, which is only for tablets.' -- source: https://tech.slashdot.org/story/21/08/03/207222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AMD and Valve Working On New Linux CPU Performance Scaling Design
by Peter Reutemann 03 Aug '21

03 Aug '21

'Along with other optimizations to benefit the Steam Deck, AMD and Valve have been jointly working on CPU frequency/power scaling improvements to enhance the Steam Play gaming experience on modern AMD platforms running Linux. Phoronix reports: It's no secret that the ACPI CPUFreq driver code has at times been less than ideal on recent AMD processors with delivering less than expected performance/behavior with being slow to ramp up to a higher performance state or otherwise coming up short of disabling the power management functionality outright. AMD hasn't traditionally worked on the Linux CPU frequency scaling code as much as Intel does to their P-State scaling driver and other areas of power management at large. AMD is ramping up efforts in these areas including around the Linux scheduler given their recent hiring spree while it now looks like thanks to the Steam Deck there is renewed interest in better optimizing the CPU frequency scaling under Linux. AMD and Valve have been working to improve the performance/power efficiency for modern AMD platforms running on Steam Play (Proton / Wine) and have spearheaded "[The ACPI CPUFreq driver] was not very performance/power efficiency for modern AMD platforms...a new CPU performance scaling design for AMD platform which has better performance per watt scaling on such as 3D game like Horizon Zero Dawn with VKD3D-Proton on Steam." AMD will be presenting more about this effort next month at XDC. It's quite possible this new effort is focused on ACPI CPPC support with the previously proposed AMD_CPUFreq. Back when Zen 2 launched in 2019, AMD did post patches for their new CPUFreq driver that leveraged ACPI Collaborative Processor Performance Controls but the driver was never mainlined nor any further iterations of the patches posted. When inquiring about that work a few times since then, AMD has always said it's been basically due to resource constraints that it wasn't a focus at that time. Upstream kernel developers also voiced their preference to seeing AMD work to improve the generic ACPI CPPC CPUFreq driver code rather than having another vendor-specific solution. It's also possible AMD has been working on better improvements around the now-default Schedutil governor for scheduler utilization data in making CPU frequency scaling decisions. ' -- source: https://hardware.slashdot.org/story/21/08/02/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GitHub Mars Helicopter Contributors
by Lawrence D'Oliveiro 03 Aug '21

03 Aug '21

I was looking at some code on GitHub, and I came across a badge I hadn’t seen before on a developer’s account. It turns out it means some of their code was used on NASA’s Mars Ingenuity helicopter <https://github.com/readme/featured/nasa-ingenuity-helicopter>.

1 0

Security Versus Requirements For Internationalization
by Lawrence D'Oliveiro 01 Aug '21

01 Aug '21

Yet another incident <https://arstechnica.com/gadgets/2021/07/with-help-from-google-impersonated-…> of substituting characters with different diacritic marks in a domain name to fool people into visiting the wrong site. Seems this problem is fundamentally unfixable. We need the ability to represent words in non-English languages, simply because the world does not revolve around the English language. And differences in meanings of words just from mixing up those diacritics can sometimes be quite major.

1 0

New Android Malware Records Smartphones via VNC To Steal Passwords
by Peter Reutemann 30 Jul '21

30 Jul '21

'Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record and broadcast a victim's smartphone activity, allowing threat actors to collect keyboard presses and app passwords. From a report: First spotted in March 2021 by Dutch security firm ThreatFabric, this new piece of malware, named Vultur, is a departure from other Android malware strains that usually rely on fake login screens floating on top of legitimate apps to collect a victim's credentials. Instead, Vultur opens a VNC server on the infected phone, and broadcasts screen captures to an attacker command and control server, where the Vultur operator extracts passwords for desired apps.' -- source: https://it.slashdot.org/story/21/07/29/1549220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0