- wlug - list.wlug.org.nz

“When Elephants Fight, The Grass Gets Trampled”
by Lawrence D'Oliveiro 22 Jan '21

22 Jan '21

When big news organizations tussle with big Web search engines and social media outfits over who is stealing revenue from whom, how do you decide who is right and who is wrong? The Aussie Government is trying to protect one lot of multinational companies from the encroachments of another lot; where does fair competition end and protectionism or exploitation begin? <https://www.nzherald.co.nz/business/google-threatens-to-ban-search-button-i…> (By the way, in that old African proverb, the “grass” is the ordinary people who are the inevitable victims in any conflict between major powers.)

1 0

Ubuntu Now Runs On Apple Silicon, Devs Say It's 'Completely Usable'
by Peter Reutemann 22 Jan '21

22 Jan '21

'Developers at ARM virtualisation company Corellium have managed to get Ubuntu 20.04 up and running on the new Apple Silicon Mac Mini. And we're not talking 'it boots and prints a load of text' running here. No, this is the full Ubuntu desktop experience -- and it's already being described as "completely usable!" Pretty impressive, right? Even Linus Torvalds wasn't convinced that Linux M1 support was likely to appear anytime soon. He told ZDnet's Steven J. Vaughan-Nichols that: "...the main problem with the M1 for me is the GPU and other devices around it, because that's likely what would hold me off using it because it wouldn't have any Linux support unless Apple opens up." Not that he was entirely wrong, mind. GPU support is indeed a current sticking point in Correllium's Linux for M1 effort. It doesn't (yet) include M1 GPU support meaning 'graphics' handling is done via software rendering.' -- source: https://news.slashdot.org/story/21/01/21/1329258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA Urges System Administrators To Replace Obsolete TLS Protocols
by Peter Reutemann 22 Jan '21

22 Jan '21

'The US National Security Agency has issued a security advisory this month urging system administrators in federal agencies and beyond to stop using old and obsolete TLS protocols. From a report: "NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used," the agency said. "Using obsolete encryption provides a false sense of security because it seems as though sensitive data is protected, even though it really is not," the agency added. Even if TLS 1.2 and TLS 1.3 are deployed, the NSA warns against configuring these two protocols with weak cryptographic parameters and cipher suites.' -- source: https://tech.slashdot.org/story/21/01/21/1646211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Leave.EU Stays In The EU
by Lawrence D'Oliveiro 21 Jan '21

21 Jan '21

The domain that was registered by Brexiteers to promote their campaign for the UK to leave the EU has been re-domiciled to an address in the EU <https://www.theregister.com/2021/01/08/leave_eu_domain_name_hilarity/>. This is because of rule changes that mean UK-based entities are no longer entitled to register .eu names. So if the site wants to stay up under that name, it cannot, contrary to its own name, leave the EU. Just to add to the fun, the individual in the Republic of Ireland who is named on the domain registration claims to know nothing about it, and says he “will be looking into the matter”.

3 3

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Wine 6.0 Released
by Peter Reutemann 20 Jan '21

20 Jan '21

'Wine 6.0 has been released today and contains over 8,300 changes, according to its full release notes. Windows Central reports: The new release of version 6.0 has thousands of changes, but Wine's website highlights some of the biggest improvements: Core modules in PE format; Vulkan backend for WineD3D; DirectShow and Media Foundation support; and Text console redesign. The full release notes for Wine 6.0 explain that the core DLLs, which include NTDLL, KERNEL32, GDI32, and USER32 are now built in the Portable Executable (PE) format. As a result, people should see improvements for certain copy protection schemes. The update also includes a new mechanism to associate a Unix library with the PE module. This change makes it so systems can call Unix libraries from PE when trying to perform a function that can't be handled by Win32 APIs. Wine 6.0 also includes an experimental Vulkan rendered that translates Direct3D shaders to SPIR-V shaders. In another change related to Direct3D, the Direct3D graphics card database now recognizes more graphics cards and includes updated driver versions. ' -- source: https://tech.slashdot.org/story/21/01/19/039257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Becomes First Browser To Add Native Support For the IPFS Protocol
by Peter Reutemann 20 Jan '21

20 Jan '21

'With the release of Brave 1.19 today, Brave has become the first major browser maker to support IPFS, a peer-to-peer protocol meant for accessing decentralized or censored content. From a report: Released in 2015, IPFS stands for InterPlanetary File System. It is a classic peer-to-peer protocol similar to BitTorrent and designed to work as a decentralized storage system. IPFS allows users to host content distributed across hundreds or thousands of systems, which can be public IPFS gateways or private IPFS nodes. Users who want to access any of this content must enter an URL in the form of ipfs://{content_hash_ID}. Under normal circumstances, users would download this content from the nearest nodes or gateways rather than a central server. However, this only works if users have installed an IPFS desktop app or a browser extension. Brave says that with version 1.19, users will be able to access URLs that start with ipfs://, directly from the browser, with no extension needed, and that Brave will natively support ipfs:// links going forward. Since some major websites like Wikipedia have IPFS versions, users in oppressive countries can now use Brave's new IPFS support to go around national firewalls and access content that might be blocked inside their country for political reasons and is available via IPFS.' -- source: https://it.slashdot.org/story/21/01/19/2015252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FireEye Releases Tool For Auditing Networks for Techniques Used by SolarWinds Hackers
by Peter Reutemann 20 Jan '21

20 Jan '21

'Cybersecurity firm FireEye has released today a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached. From a report: Together with the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks. Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike. The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.' -- source: https://tech.slashdot.org/story/21/01/19/2023209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The NSA warns enterprises to beware of third-party DNS resolvers
by Peter Reutemann 19 Jan '21

19 Jan '21

'DNS over HTTPS is a new protocol that protects domain-lookup traffic from eavesdropping and manipulation by malicious parties. Rather than an end-user device communicating with a DNS server over a plaintext channel—as DNS has done for more than three decades—DoH, as DNS over HTTPS is known, encrypts requests and responses using the same encryption websites rely on to send and receive HTTPS traffic. Using DoH or a similar protocol known as DoT—short for DNS over TLS—is a no brainer in 2021, since DNS traffic can be every bit as sensitive as any other data sent over the Internet. On Thursday, however, the National Security Agency said in some cases Fortune 500 companies, large government agencies, and other enterprise users are better off not using it. The reason: the same encryption that thwarts malicious third parties can hamper engineers’ efforts to secure their networks. “DoH provides the benefit of encrypted DNS transactions, but it can also bring issues to enterprises, including a false sense of security, bypassing of DNS monitoring and protections, concerns for internal network configurations and information, and exploitation of upstream DNS traffic,” NSA officials wrote in published recommendations. “In some cases, individual client applications may enable DoH using external resolvers, causing some of these issues automatically.”' -- source: https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cryptocat Author Gets Insanely Fast Backing To Build P2P Tech For Social Media
by Peter Reutemann 19 Jan '21

19 Jan '21

'TechCrunch: The idea for Capsule started with a tweet about reinventing social media. A day later cryptography researcher, Nadim Kobeissi -- best known for authoring the open-source E2E-encrypted desktop chat app Cryptocat (now discontinued) -- had pulled in a pre-seed investment of $100,000 for his lightweight mesh-networked microservices concept, with support coming from angel investor and former Coinbase CTO Balaji Srinivasan, William J. Pulte and Wamda Capital. The nascent startup has a post-money valuation on paper of $10 million, according to Kobeissi, who is working on the prototype -- hoping to launch an MVP of Capsule in March (as a web app), after which he intends to raise a seed round (targeting $1 million-$1.5 million) to build out a team and start developing mobile apps. For now there's nothing to see beyond Capsule's landing page and a pitch deck (which he shared with TechCrunch for review). But Kobeissi says he was startled by the level of interest in the concept. "I posted that tweet and the expectation that I had was that basically 60 people max would retweet it and then maybe I'll set up a Kickstarter," he tells us. Instead the tweet "just completely exploded" and he found himself raising $100,000 "in a single day" -- with $50,000 paid in there and then. "I'm not a startup guy. I've been running a business based on consulting and based on academic R&D services," he continues. "But by the end of the day -- last Sunday, eight days ago -- I was running a Delaware corporation valued at $10 million with $100,000 in pre-seed funding, which is insane. Completely insane."' -- source: https://news.slashdot.org/story/21/01/18/2144252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0