- wlug - list.wlug.org.nz

HP Replaces 'Free Ink for Life' Plan With '99 Cents a Month Or Your Printer Stops Working'
by Peter Reutemann 10 Nov '20

10 Nov '20

'In a new essay at EFF.org, Cory Doctorow re-visits HP's anti-consumer "security updates" that disabled third-party ink cartridges (while missing real vulnerabilities that could actually bypass network firewalls). Doctorow writes that it was just the beginning: HP's latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP's customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there's ink in the cartridges). If you don't print all your pages, you can "roll over" a few of those pages to the next month, but you can't bank a year's worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of "banked" pages, HP annihilates any other pages you've paid for (but continues to bill you every month). Now, you may be thinking, "All right, but at least HP's customers know what they're getting into when they take out one of these subscriptions," but you've underestimated HP's ingenuity. HP takes the position that its offers can be retracted at any time. For example, HP's "Free Ink for Life" subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit. But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their "free ink for life" plan and replaced it with "a $0.99/month for all eternity or your printer stops working" plan... For would-be robber-barons, "smart" gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms. From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don't own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense. And when it comes to "razors and blades" business-model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables. >From coffee pods to juice packets, from kitty litter to light-bulbs, the printer-ink cartridge business-model has inspired many imitators. HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company's latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP's decline is the many imitators it has inspired.' -- source: https://hardware.slashdot.org/story/20/11/09/0221226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners Lee's Startup Inrupt Releases Privacy Platform for Enterprises
by Peter Reutemann 10 Nov '20

10 Nov '20

'Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today, which allows large organizations and governments to build applications that put users in control of their data . From a report: Berners-Lee has always believed that the web should be free and open, but large organizations have grown up over the last 20 years that make their money using our data. He wanted to put people back in charge of their data, and the Solid open source project, developed at MIT, was the first step in that process. Three years ago he launched Inrupt, a startup built on top of the open source project, and hired John Bruce to run the company. The two shared the same vision of shifting data ownership without changing the way websites get developed. With Solid, developers use the same standards and methods of building sites, and these applications will work in any browser. What Solid aims to do is alter the balance of data power and redirect it to the user. "Fast forward to today, and we're releasing the first significant technology as the fruits of our labor, which is an enterprise version of Solid to be deployed at scale by large organizations," Bruce explained. The core idea behind this approach is that users control their data in online storage entities called Personal Online Data Stores or Pods for short. The enterprise version consists of Solid Server to manage the Pods, and developers can build applications using an SDK to take advantage of the Pods and access the data they need to do a particular job like pay taxes or interact with a healthcare provider. Bruce points out that the enterprise version is fully compatible with the open source Solid project specifications. The company has been working with some major organizations prior to today's release including the BBC and National Health Service in the UK and the Government of Flanders in Belgium as they have been working to bring this to market.' -- source: https://yro.slashdot.org/story/20/11/09/1453252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Compal, the Second-Largest Laptop Manufacturer in the World, Hit By Ransomware
by Peter Reutemann 10 Nov '20

10 Nov '20

'Compal, a Taiwanese electronics company that builds laptops for some of the world's largest computer brands, suffered a ransomware attack over the weekend. From a report: Responsible for the breach is believed to be the DoppelPaymer ransomware gang, according to a screenshot of the ransom note shared by Compal employees with Yahoo Taiwan reporters. According to Taiwanese media, the incident was discovered on Sunday morning and is believed to have impacted around 30% of Compal's computer fleet. Employees arriving at work were greeted by a memo from Compal's IT staff, asking workers to check the status of their workstations and back up important files on systems that were not impacted.' -- source: https://it.slashdot.org/story/20/11/09/1615207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FTC Announces a Settlement With Zoom Over Security Issues
by Peter Reutemann 10 Nov '20

10 Nov '20

'Zoom will implement new security practices as part of a proposed settlement with the Federal Trade Commission, the agency announced on Monday. From a report: "Zoom has agreed to a requirement to establish and implement a comprehensive security program, a prohibition on privacy and security misrepresentations, and other detailed and specific relief to protect its user base, which has skyrocketed from 10 million in December 2019 to 300 million in April 2020 during the COVID-19 pandemic," the FTC said in a press release.' -- source: https://news.slashdot.org/story/20/11/09/1645233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cyberattackers Now Also Make Linux Versions of Their Ransomware
by Peter Reutemann 09 Nov '20

09 Nov '20

'"Security firm Kaspersky said Friday that it discovered a Linux version of the RansomEXX ransomware," reports ZDNet, "marking the first time a major Windows ransomware strain has been ported to Linux to aid in targeted intrusions." RansomEXX is a relatively new ransomware strain that was first spotted earlier this year in June. The ransomware has been used in attacks against the Texas Department of Transportation, Konica Minolta, U.S. government contractor Tyler Technologies, Montreal's public transportation system, and, most recently, against Brazil's court system (STJ)... The RansomEXX gang creating a Linux version of their Windows ransomware is in tune with how many companies operate today, with many firms running internal systems on Linux, and not always on Windows Server. A Linux version makes perfect sense from an attacker's perspective; always looking to expand and touch as much core infrastructure as possible in their quest to cripple companies and demand higher ransoms. What we see from RansomEXX may soon turn out to be an industry-defining trend, with other big ransomware groups rolling out their Linux versions in the future as well. And, this trend appears to have already begun. According to cyber-security firm Emsisoft, besides RansomEXX, the Mespinoza (Pysa) ransomware gang has also recently developed a Linux variant from their initial Windows version.' -- source: https://linux.slashdot.org/story/20/11/07/0541223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Verdict After Hackaday's Teardown of a Raspberry Pi 400: 'Very, Very Slick'
by Peter Reutemann 09 Nov '20

09 Nov '20

'"You can't send Hackaday a piece of gear without us taking it apart," warns an article shared by Slashdot reader beggarwoman. Hackady's verdict? The new Raspberry Pi 400 "is very, very slick." Inside, there's a flat-flex that connects the keyboard, and you see that big aluminum heat sink. It's almost the full size of the keyboard, and it's thick and heat-taped to the CPU. You know it means business. It's also right up against the aluminum bottom of the keyboard, suggesting it could get radiative help that way, and maybe keep your fingers warm in the winter. (I didn't feel any actual heat, but it's gotta go somewhere, right? There are also vents in the underside of the case.) Four PZ1 screws and a little bit of courage to unstick the pad get you underneath the heat spreader to find, surprise!, a Raspberry Pi 4. This was a little anticlimactic, as I've just spent a couple weeks looking over the schematics for my review of the new Compute Module 4, and it's just exactly what you'd expect. It's a Raspberry Pi 4, with all the ports broken out, inside a nice keyboard, with a beefy heat spreader. Ethernet magnetics sit on one side, and the wireless module sits on the other. That's it! "[C]ombine this with a small touch screen, and run it all off of a 5 V power pack, and you've got a ton of portable computing in a very small package. "If you're not mousing around all the time anyway, there's a certain streamlined simplicity here that's mighty tempting."' -- source: https://hardware.slashdot.org/story/20/11/07/1938245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

On Older Versions of Android, Many Let's Encrypt-Secured Sites May Stop Working in 2021
by Peter Reutemann 09 Nov '20

09 Nov '20

'This year Let's Encrypt announced that it's issued a billion certificates, and it's been estimated they've made certs for almost 30% of web domains. But Friday they posted that "The DST Root X3 root certificate that we relied on to get us off the ground is going to expire — on September 1, 2021. Fortunately, we're ready to stand on our own, and rely solely on our own root certificate." "However, this does introduce some compatibility woes." Some software that hasn't been updated since 2016 (approximately when our root was accepted to many root programs) still doesn't trust our root certificate, ISRG Root X1. Most notably, this includes versions of Android prior to 7.1.1. That means those older versions of Android will no longer trust certificates issued by Let's Encrypt. Android has a long-standing and well known issue with operating system updates. There are lots of Android devices in the world running out-of-date operating systems. The causes are complex and hard to fix: for each phone, the core Android operating system is commonly modified by both the manufacturer and a mobile carrier before an end-user receives it. When there's an update to Android, both the manufacturer and the mobile carrier have to incorporate those changes into their customized version before sending it out. Often manufacturers decide that's not worth the effort. The result is bad for the people who buy these devices: many are stuck on operating systems that are years out of date. Currently, 66.2% of Android devices are running version 7.1 or above. The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let's Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant. Let's Encrypt engineer Jacob Hoffman-Andrews explains that "In the time between now and September 29 we plan to start serving certificates with the 'alternate' link relation 186 to allow Automatic Certificate Management Environment (ACME) clients to programmatically select a chain they prefer." But Friday's blog post explains that won't solve everything: There will be site owners that receive complaints from users and we are empathetic to that being not ideal. We're working hard to alert site owners so you can plan and prepare. We encourage site owners to deploy a temporary fix (switching to the alternate certificate chain) to keep your site working while you evaluate what you need for a long-term solution: whether you need to run a banner asking your Android users on older OSes to install Firefox, stop supporting older Android versions, drop back to HTTP for older Android versions, or switch to a CA that is installed on those older versions. Gizmodo notes that Firefox will be unaffected "since it relies on its own certificate store that includes Let's Encrypt's root, though that wouldn't keep applications from breaking or ensure functionality beyond your browser." They describe Let's Encrypt as "the Mozilla-partnered nonprofit," and offers this succinct summary of the problem. "One of the world's top certificate authorities warns that phones running versions of Android prior to 7.1.1 Nougat will be cut off from large portions of the secure web starting in 2021."' -- source: https://it.slashdot.org/story/20/11/08/1654223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Generating Flag Emojis
by Lawrence D'Oliveiro 08 Nov '20

08 Nov '20

You may have seen our new Foreign Minister, Nanaia Mahuta, tweeting her congratulations to the next President of the USA, including a couple of country flag emojis. I was looking through the Unicode character list for the codes for country flags, and discovered that there aren’t any, as such. Instead, there is this range of special character codes (“Regional indicator symbols”): 1F1E6 REGIONAL INDICATOR SYMBOL LETTER A ... 1F1FF REGIONAL INDICATOR SYMBOL LETTER Z with a note saying These characters can be used in pairs to represent regional codes. In some emoji implementations, certain pairs may be recognized and displayed by alternate means; for instance, an implementation might recognize F + R and display this combination with a symbol representing the flag of France. So for example if I enter U+1F1F3 (the code for N in the above block) followed by U+1F1FF (the code for Z), being the ISO-3166 regional code for NZ, the text-rendering system could replace them with the NZ flag: 🇳🇿. Anyway, I found out this works in YouTube comments as well. (Not that I’m saying the YouTube commenting system is particularly fine -- but that’s another story...)

1 0

EFF Argues RIAA is 'Abusing DMCA' to Take Down YouTube-DL
by Peter Reutemann 08 Nov '20

08 Nov '20

'While the RIAA has objected to a tool for downloading online videos, EFF senior activist Elliot Harmon responds with this question. "Who died and put them in charge of YouTube?" He asks the question in a new video "explainer" on the controversy, and argues in a new piece at EFF.org that the youtube-dl tool "doesn't infringe on any RIAA copyrights." RIAA's argument relies on a different section of the DMCA, Section 1201. DMCA 1201 says that it's illegal to bypass a digital lock in order to access or modify a copyrighted work. Copyright holders have argued that it's a violation of DMCA 1201 to bypass DRM even if you're doing it for completely lawful purposes; for example, if you're downloading a video on YouTube for the purpose of using it in a way that's protected by fair use. (And thanks to the way that copyright law has been globalized via trade agreements, similar laws exist in many other jurisdictions too.) RIAA argues that since youtube-dl could be used to download music owned by RIAA-member labels, no one should be able to use the tool, even for completely lawful purposes. This is an egregious abuse of the notice-and-takedown system, which is intended to resolve disputes over allegedly infringing material online. Again, youtube-dl doesn't use RIAA-member labels' music in any way. The makers of youtube-dl simply shared information with the public about how to perform a certain task — one with many completely lawful applications. Harmon wants to hear from people using youtube-dl for lawful purposes. And he also links to an earlier EFF piece arguing that DMCA 1201 "is incredibly broad, apparently allowing rightsholders to legally harass any 'trafficker' in code that lets users re-take control of their devices from DRM locks..." And EFF's concern over DMCA 1201 has been ongoing: DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our "Unintended Consequences" series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law. But due to the WIPO Copyright Treaty, the DMCA's anti-circumvention provisions infest much of the world's jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC.' -- source: https://yro.slashdot.org/story/20/11/07/0313228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Brave Hits 20 Million Monthly Users a Year After 1.0 Release
by Peter Reutemann 06 Nov '20

06 Nov '20

'One year after its first 1.0 release, Brave says it has hit the milestone of 20.5 million active monthly users. "At the same time last year, the browser had 8.7 million active monthly users, and of the 20 million monthly users, 7 million are daily users, which represents more than a doubling of last year's 3 million," reports ZDNet. "Brave added that since Apple allowed browsers other than its own to be the default option on iOS, it has seen its iOS user base increase by a third." From the report: One of the touted features of the browser is that it hates ads, and will go out of its way to block them, unless users decide to see Brave-powered advertisements. To that end, Brave has hit "2 billion ad confirmation events" and completed 2,215 campaigns from over 460 companies. The browser maker says its users have a click-through rate of 9%, way and away outstripping industry averages. The browser also has its own cryptocurrency, Basic Attention Tokens, that users use to "tip" content creators. Thus far, 26 million of the tokens have been sent to creators. At the time of writing, the blockchain-based token is trading for just under 18 cents, meaning $4.6 million has been sent from users. ' -- source: https://tech.slashdot.org/story/20/11/05/0424253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2