- wlug - list.wlug.org.nz

Cloudflare's Privacy Crusade Continues With a Challenge To Google Analytics
by Peter Reutemann 30 Sep '20

30 Sep '20

'Fortune: Cloudflare is launching a privacy-friendly rival to Google Analytics. Google Analytics is a free toolkit that's used by website administrators across the globe to help them track the behavior of the people visiting those sites -- how they find them, what they do there, the devices they're using, and so on. However, the service -- the most popular of its kind -- also helps Google track websites' visitors, so it can better profile them for advertising purposes. This privacy-invasive aspect makes many people squeamish. And that's where Cloudflare would now like to step in. Around its birthday every year, the decade-old company -- which went public last year -- announces a move intended to "give back" to the wider Internet community. These moves are often related to privacy. On Tuesday, it unveiled Cloudflare Web Analytics, a free-to-use toolkit that largely replicates what Google Analytics offers -- minus the invasive tracking, and thus the ability to assess the performance of targeted ads carried on websites. Cloudflare Web Analytics is immediately available to the company's paid customers, but any website owner will be able to use it from some point in the coming months. Cloudflare's scale is crucial here [...] because it takes substantial resources to run a free analytics platform, and Cloudflare already has a giant network that can support the load. Cloudflare Web Analytics isn't the company's only big announcement this week. "On Monday, Cloudflare launched a beta testing program for a cloud technology called Durable Objects," the report adds. "You can read the technical explanation here, but in essence this is a tool that allows developers of online services to make those services comply with the increasing number of data-localization and data-protection laws that limit where users' data is supposed to go." "With Durable Objects, Cloudflare says, it is possible to specify where particular data will reside on Cloudflare's network, so -- for example -- a German user's data does not have to leave Germany. Or, with an eye to other current news, a service such as TikTok could ensure that U.S. users' data never leaves the U.S., without having to create a separate version of its service for that country." ' -- source: https://tech.slashdot.org/story/20/09/29/2011226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Removes 17 Android Apps Caught Engaging In WAP Billing Fraud
by Peter Reutemann 30 Sep '20

30 Sep '20

'Google has recently removed 17 Android applications from the official Play Store because they were infected with the Joker (aka Bread) malware. ZDNet reports: "This spyware is designed to steal SMS messages, contact lists, and device information, along with silently signing up the victim for premium wireless application protocol (WAP) services," Zscaler security researcher Viral Gandhi said this week. The 17 malicious apps were uploaded on the Play Store this month and didn't get a chance to gain a following, having been downloaded more than 120,000 times before being detected. Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices. But this recent takedown also marks the third such action from Google's security team against a batch of Joker-infected apps over the past few months. [...] The way these infected apps usually manage to sneak their way past Google's defenses and reach the Play Store is through a technique called "droppers," where the victim's device is infected in a multi-stage process. Malware authors begin by cloning the functionality of a legitimate app and uploading it on the Play Store. This app is fully functional, requests access to dangerous permissions, but also doesn't perform any malicious actions when it's first run. Because the malicious actions are usually delayed by hours or days, Google's security scans don't pick up the malicious code, and Google usually allows the app to be listed on the Play Store. But once on a user's device, the app eventually downloads and "drops" (hence the name droppers, or loaders) other components or apps on the device that contain the Joker malware or other malware strains. ' -- source: https://tech.slashdot.org/story/20/09/28/236245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu - Online upgrade to 20.04.1 now available
by Ian Stewart 29 Sep '20

29 Sep '20

Hi All, I mentioned last night at the WLUG meeting that there had been a delay in releasing the Ubuntu 18.04 to 20.04.1 online upgrade. As of today, the Focal Fossa (20.04.1 LTS) Point-Release Status Tracking webpage<https://discourse.ubuntu.com/t/focal-fossa-20-04-1-lts-point-release-status…> is still showing Status 20.04.1 Released! Upgrades from 18.04 to 20.04.1 still disabled ...but with... Upgrade blockers None Previously two bugs, 1891680<https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1891680> and 1876506<https://bugs.launchpad.net/ubuntu/focal/+source/os-prober/+bug/1876506> had been shown as the "upgrade blockers". These bugs were fixed in the last few weeks. Despite the above message, today on my Ubuntu Mate 18.04 laptop, I ran the GUI application "Software Updater". When it completed it stated: The software on this computer is up to date. However, Ubuntu 20.04.1 LTS is now available (you have 18.04). I clicked on "Upgrade". There were 384 new packages to install and 1547 packages to upgrade requiring about 1.4GB of downloading. On my rather slow 1.4GHz CPU, but with reasonably fast internet and a SSD it took 50 minutes to do the upgrade. cheers, Ian. PS: The upgrade kept my python Version 2 at V2.7.18 and upgraded Python3 to 3.8.2. If I had done a fresh install from DVD/USB of Ubuntu 20.04.1 it would not have installed Python 2.

1 0

Eric S. Raymond: Is Microsoft Switching To a Linux Kernel That Emulates Windows?
by Peter Reutemann 28 Sep '20

28 Sep '20

'Most of Microsoft's money now comes from its cloud service Azure, points out open-source advocate Eric S. Raymond. Now he posits a future where Windows development will "inevitably" become a drag on Microsoft's business: So, you're a Microsoft corporate strategist. What's the profit-maximizing path forward given all these factors? It's this: Microsoft Windows becomes a Proton-like emulation layer over a Linux kernel, with the layer getting thinner over time as more of the support lands in the mainline kernel sources. The economic motive is that Microsoft sheds an ever-larger fraction of its development costs as less and less has to be done in-house. If you think this is fantasy, think again. The best evidence that it's already the plan is that Microsoft has already ported Edge to run under Linux. There is only one way that makes any sense, and that is as a trial run for freeing the rest of the Windows utility suite from depending on any emulation layer. So, the end state this all points at is: New Windows is mostly a Linux kernel, there's an old-Windows emulation over it, but Edge and the rest of the Windows user-land utilities don't use the emulation. The emulation layer is there for games and other legacy third-party software. Economic pressure will be on Microsoft to deprecate the emulation layer... Every increment of Windows/Linux convergence helps with that — reduces administration and the expected volume of support traffic. Eventually, Microsoft announces upcoming end-of-life on the Windows emulation. The OS itself , and its userland tools, has for some time already been Linux underneath a carefully preserved old-Windows UI. Third-party software providers stop shipping Windows binaries in favor of ELF binaries with a pure Linux API... ...and Linux finally wins the desktop wars, not by displacing Windows but by co-opting it. Perhaps this is always how it had to be.' -- source: https://linux.slashdot.org/story/20/09/27/193250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNU is Not Unix Emacs Developers (Including Richard Stallman) Discuss How to Build a More 'Modern' Emacs
by Peter Reutemann 27 Sep '20

27 Sep '20

'LWN.net re-visits the emacs-devel mailing list, where the Emacs 28 development cycle has revived discussions about how to make the text editor more "modern" and attractive to new users: A default dark theme may not be in the future, leading one to think that there may yet be hope for the world in general. But there does seem to be general agreement that Emacs could benefit from a better, more centralized approach to color themes, rather than having color names hard-coded throughout various Elisp packages. From that, a proper theme engine could be supported, making dark themes and such easily available to those who want them... Another area where Emacs is insufficiently "modern", it seems, has to do with keyboard and mouse bindings. On the keyboard side, users have come to expect certain actions from certain keystrokes; ^X to cut a selection, ^V to paste it, etc. These bindings are easily had by turning on the Cua mode, but new users tend not to know about this mode or how to enable it. Many participants in the discussion said that this mode should be on by default. That, of course, would break the finger memory of large numbers of existing Emacs users, who would be unlikely to appreciate the disruption. Or, as Richard Stallman put it: It is not an option to change these basic key bindings to imitate other, newer editors. It would create a different editor that we Emacs users would never switch to. It is unfortunate that the people who implemented the newer editors chose incompatibility with Emacs.... The situation with mouse behavior is similar; as several participants in the discussion pointed out, users of graphical interfaces have come to expect that a right-button click will produce a menu of available actions. In Emacs, instead, that button marks a region ("selection"), with a second click in the same spot yanking ("cutting") the selected text. Many experienced Emacs users have come to like this behavior, but it is surprising to newcomers. The right mouse button with the control key held down does produce a menu defined by the current major mode, but that is evidently not what is being requested here; that menu, some say, should present global actions rather mode-specific ones. Stallman suggested offering a "reshuffled mode" that would bring the context menu to an unadorned right-button click, and which would add some of the expected basic editing commands there as well. This would be relatively easy to do, he said, since mouse bindings are separate from everything else. Besides, as he noted, the current mouse behavior was derived from "what was the standard in X Windows around 1990"; while one wouldn't want to act in haste, it might just be about time for an update. Other proposed changes involved "discoverability," including the default enabling of various modes, although to incorporate them into GNU Emacs "would often require the author to sign copyrights over to the Free Software Foundation, which is not something all authors are willing to do..."' -- source: https://news.slashdot.org/story/20/09/25/2213230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored Developer Creates 'DOS Subsystem For Linux'
by Peter Reutemann 27 Sep '20

27 Sep '20

'iTnews: A software engineer in Melbourne is whiling away the city's lockdown by creating a tool that DOS users so far have lacked: an integrated Linux environment similar to what Windows 10 users enjoy... "I first started out just seeing if I could get Linux booting from the DOS command line, and that turned out to be straightforward enough so I thought it'd be fun to see if I could continue executing DOS once Linux was running," Charlie Somerville said. "I'm mostly surprised by how smoothly the whole thing works given how *dodgy* it all is haha," he added. DOS Subsystem for Linux runs a real copy of MS-DOS under the QEMU virtual machine, and starts up from that, Somerville said... "Helpfully Linux seems to leave the first megabyte of memory (where DOS lives) intact during its own boot process, so it's just a matter of jumping back to the right place to continue DOS execution," he added. Somerville had it pointed out to him that this approach of running DOS under vm8086 is actually how early Windows worked. "Kinda cool to rediscover the technique so many years later," Somerville said.' -- source: https://linux.slashdot.org/story/20/09/26/048223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 81 Released, Can Now Be Your Default Browser in iOS
by Peter Reutemann 27 Sep '20

27 Sep '20

'Engadget reports: One big benefit of iOS 14 is that you can set non-Apple-made apps as your default, including for email and web browsing. Hot on the heels of you being able to set Chrome and Gmail as your clients of choice, Firefox is enabling you to make its browser the default on iPhones and iPads. Naturally, you'll need to have both the latest version of the operating system and the apps, and then just make the switch inside settings. Meanwhile, Bleeping Computer profiles some of the new features in this week's release of Firefox 81, including: The ability to control videos via your headset and keyboard even if you're not using Firefox at the time - A new credit card autofill feature for Firefox users in the U.S. and Canada - A new theme called AlpenGlow - Firefox can now be set as the default system PDF viewer' -- source: https://news.slashdot.org/story/20/09/26/0454229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bug Allowed Hijacking Other Firefox Mobile Browsers on the Same Wi-Fi Network
by Peter Reutemann 27 Sep '20

27 Sep '20

'"Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same Wi-Fi network and force users to access malicious sites, such as phishing pages," reports ZDNet: The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab. The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device). When devices are found, the Firefox SSDP component gets the location of an XML file where that device's configuration is stored. However, Moberly discovered that in older versions of Firefox, you could hide Android "intent" commands in this XML and have the Firefox browser execute the "intent," which could be a regular command like telling Firefox to access a link... The bug was fixed in Firefox 79; however, many users may not be running the latest release. Firefox for desktop versions were not impacted. ' -- source: https://news.slashdot.org/story/20/09/26/0443215 Chers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

killedbygoogle.com
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Came across this <https://killedbygoogle.com/> little hall of -- shame? sadness? quiet desperation? schadenfreude? -- listing projects that Google created and later abandoned, or is in the process of abandoning. Found it in a reader comment to this report <https://www.theregister.com/2020/09/23/google_sunsets_chrome_web_store/> on the death of Chrome Web Store payments. By the way: Neighbourly is dead? I keep seeing mentions of neighbourly.co.nz in the local free papers -- is that different?

3 2

Facebook “Took A Page From Big Tobacco’s Playbook”
by Lawrence D'Oliveiro 26 Sep '20

26 Sep '20

Some former Facebook employees are testifying to the US Congress <https://arstechnica.com/tech-policy/2020/09/former-facebook-manager-we-took…> as part of a hearing into the role social media platforms play in spreading extremist and radical content. Tim Kendall, former director of monetization, says: “We took a page form Big Tobacco’s playbook, working to make our offering addictive at the outset.” After making some more direct comparisons with how tobacco companies made their product more addictive, he talked about “engagement”, which was the measure Facebook tried to maximize above all else: “We initially used engagement as sort of a proxy for user benefit,” Kendall explained. “But we also started to realize that engagement could also mean [users] were sufficiently sucked in that they couldn’t work in their own best long-term interest to get off the platform... We started to see real-life consequences, but they weren’t given much weight. Engagement always won, it always trumped.” If a company becomes large and powerful, and cannot be trusted to exercise that power responsibly, then it must be taken from them.

1 0