- wlug - list.wlug.org.nz

Chrome 86 Will Warn Users About Insecure Forms On HTTPS Pages
by Peter Reutemann 19 Aug '20

19 Aug '20

'While there's wide HTTPS adoption today, HTTP content on secure pages still persists. Google has been working to stamp that out, and Chrome is now turning its attention to and warning about insecure forms. "These 'mixed forms' (forms on HTTPS sites that do not submit on HTTPS) are a risk to users' security and privacy," says Google in a blog post. "Information submitted on these forms can be visible to eavesdroppers, allowing malicious parties to read or change sensitive form data." 9to5Google reports: The Google browser today removes the address bar's lock icon from sites with mixed forms. However, this proved to deliver an "unclear" experience that "did not effectively communicate the risks associated with submitting data in insecure forms." Starting in version 86, due to hit stable in October, Chrome will provide a more aggressive warning about insecure forms. Autofill will be disabled, but the built-in password manager will continue to offer "unique passwords." The company argues it's safer than reusing credentials. Next, the form will show red warning text underneath the field: "This form is not secure. Autofill has been turned off. The last measure will throw up a full-page warning communicating the potential risks. It gives users an option to cancel the action, but there will be a "Send anyway" button. ' -- source: https://tech.slashdot.org/story/20/08/18/0033257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel NTFS Driver
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

This article <https://www.theregister.com/2020/08/18/paragon_tries_to_contribute_ntfs/>, about the submission of a new Linux kernel driver for accessing Microsoft NTFS volumes (i.e. the kind of filesystems that are standard among Windows users), had me confused for a moment. It mentions limitations of the current kernel driver, like not being able to create or delete files or directories. I thought this kind of problem had been solved for Linux over a decade ago. And indeed it has, in the form of NTFS-3G, which is a userspace driver that connects via FUSE, and is available as a standard package for Debian and derivatives. I know this works, because just a few weeks ago, for example, I was at some friends’ place, and transferred several dozen gigabytes of files to an external hard drive of theirs from my Debian-Unstable-running laptop, without thinking twice about it, even though they are exclusively Windows users. I suppose a kernel driver offers higher performance, in principle, than one running in userspace. But I can’t imagine many Linux-based workloads that make heavy use of NTFS volumes.

2 1

meeting next Monday
by Peter Reutemann 19 Aug '20

19 Aug '20

Hi everyone We have a meeting coming up next Monday: "With VPNs being in the news frequently (and often for sad reasons like selling logs despite assurances that no such logs would exist), let's have a hands-on session with WireGuard (https://www.wireguard.com/) a VPN tunnel that is easier to use and configure than IPSec and faster than OpenVPN." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/266792032 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Microsoft: Improving The “Outage Experience”
by Lawrence D'Oliveiro 19 Aug '20

19 Aug '20

Seems that, when something goes wrong with Microsoft’s cloud service, customers expect to find out what has happened by visiting the Azure Status page. How silly of them <https://www.theregister.com/2020/08/18/dont_use_azure_status_page/>: The place to look, Kubba said, is in the Azure Portal under Service Health. The public Azure status page is "only used to communicate widespread outages" so likely to be ineffective in discovering what may be wrong. "Despite this, we constantly find that customers visit the Azure Status page to determine the health of services on Azure," complained Kubba – though we presume that if an outage blocks access to the portal, the Status page would then be the right place to look. In other cases, it is not much use since "more than 95 per cent of our incidents" do not appear there, according to Kubba. A further complication is that Azure DevOps (which is where Pipelines live) is not integrated into the Azure portal, and many Azure DevOps users only hang around the DevOps portal. Therefore, there is a separate Azure DevOps status page, making this a third site that needs to be bookmarked for tracking outages.

1 0

An Alexa Bug Could Have Exposed Your Voice History To Hackers
by Peter Reutemann 18 Aug '20

18 Aug '20

'Findings published on Thursday by the security firm Check Point reveal that Alexa's Web services had bugs that a hacker could have exploited to grab a target's entire voice history, meaning their recorded audio interactions with Alexa. Amazon has patched the flaws, but the vulnerability could have also yielded profile information, including home address, as well as all of the "skills," or apps, the user had added for Alexa. An attacker could have even deleted an existing skill and installed a malicious one to grab more data after the initial attack. [...] For an attacker to exploit the vulnerabilities, they would need first to trick targets into clicking a malicious link, a common attack scenario. Underlying flaws in certain Amazon and Alexa subdomains, though, meant that an attacker could have crafted a genuine and normal-looking Amazon link to lure victims into exposed parts of Amazon's infrastructure. By strategically directing users to track.amazon.com -- a vulnerable page not related to Alexa, but used for tracking Amazon packages -- the attacker could have injected code that allowed them to pivot to Alexa infrastructure, sending a special request along with the target's cookies from the package-tracking page to skillsstore.amazon.com/app/secure/your-skills-page. At this point, the platform would mistake the attacker for the legitimate user, and the hacker could then access the victim's full audio history, list of installed skills, and other account details. The attacker could also uninstall a skill the user had set up and, if the hacker had planted a malicious skill in the Alexa Skills Store, could even install that interloping application on the victim's Alexa account. Both Check Point and Amazon note that all skills in Amazon's store are screened and monitored for potentially harmful behavior, so it's not a foregone conclusion that an attacker could have planted a malicious skill there in the first place. Check Point also suggests that a hacker might be able to access banking data history through the attack, but Amazon disputes this, saying that information is redacted in Alexa's responses. "The security of our devices is a top priority, and we appreciate the work of independent researchers like Check Point who bring potential issues to us," an Amazon spokesperson told WIRED in a statement. "We fixed this issue soon after it was brought to our attention, and we continue to further strengthen our systems. We are not aware of any cases of this vulnerability being used against our customers or of any customer information being exposed."' -- source: https://yro.slashdot.org/story/20/08/17/2129202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Text Editor Notepad++ Banned In China After 'Stand With Hong Kong' Update
by Peter Reutemann 18 Aug '20

18 Aug '20

'The website of Notepad++ is banned in China as of Monday, "obviously due to" its release of editions named "Free Uyghur" and "Stand with Hong Kong," the source code and text editor announced on Twitter. TechCrunch reports: First released in 2003 by France-based developer Don Ho, free-to-use Notepad++ operates on Windows and supports some 90 languages. In his release notices for the two editions, Ho openly voiced his concerns over "human rights" conditions, respectively in the Xinjiang autonomous region and Hong Kong. Tests by TechCrunch found that the Notepad++ ban only applies to its Download page -- which showcases the special editions and thus politically sensitive language -- when one tries to reach it from Chinese browsers developed by Tencent (QQ Browser and WeChat's built-in browser), Alibaba (UC Browser), 360 and Sogou. These services flag the page as containing content "prohibited" by local regulators. Notepad++'s home page, on the other hand, remains unblocked through these local browsers. One can still access the full site from Chrome and DuckDuckGo in China. The ban began as early as August 12 when a user notified Ho of the ban, the developer told TechCrunch. He has never been contacted by any Chinese government authority and does not plan to take measures to cope with the website restriction.' -- source: https://yro.slashdot.org/story/20/08/17/2028235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Reviewer Calls Linux-based PinePhone 'the Most Interesting Smartphone I've Tried in Years'
by Peter Reutemann 17 Aug '20

17 Aug '20

'A review at the Android Police site calls Pine64's new Linux-based PinePhone "the most interesting smartphone I've tried in years," with 17 different operating systems available (including Fedora, Ubuntu Touch, SailfishOS, openSUSE, and Arch Linux ARM): There's a replaceable battery, which is compatible with batteries designed for older Samsung Galaxy J7 phones. It's good to know that even if PinePhone vanished overnight, you could still purchase new batteries for around $10-15... There's a microSD card slot above the SIM tray, which supports cards up to 2TB in size. While it can be used as extra storage, just like the SD slots in Android phones and tablets, it can also function as a bootable drive. If you write an operating system image to the SD card and put it in the PinePhone, the phone will boot from the SD card. This means you can move between operating systems on the PinePhone by simply swapping microSD cards, which is amazing for trying out new Linux distributions without wiping data. How great would it be if Android phones could do that? Finally, the inside of the PinePhone has six hardware killswitches that can be manipulated with a screwdriver. You can use them to turn off the modem, Wi-Fi/Bluetooth, microphone, rear camera, front camera, and headphone jack. No need to put a sticker over the selfie camera if you're worried about malicious software — just flip the switch and never worry about it again.... For a $150 phone produced in limited batches by a company with no previous experience in the smartphone industry, I'm impressed it's built as well as it is... I look forward to seeing what the community around the PinePhone can accomplish. A Pine64 blog post this weekend touts "a boat-load of cool and innovative things" being attempted by the PinePhone community, including users working on things like a fingerprint scanner or a thermal camera, plus a community that's 3D-printing their own custom PinePhone cases. And Pine64 has now identified three candidates for a future keyboard option (each of which can be configured as either a slide-out or clamshell keyboard): I feel like we have finally gotten into a good production rhythm; it was only last month we announced the postmarketOS Community Edition of the PinePhone, and this month I am here to tell you that the factory will deliver the phones to us at the end of this month... I don't know about you, but I think that this is a rather good production pace. At the time of writing, and based on current sale rates, the postmarketOS production-run will sell out in a matter of days... While I have no further announcements at this time, what I will say is that we have no intention of slowing down the pace now until February 2021 (when Chinese New Year begins)...' -- source: https://mobile.slashdot.org/story/20/08/17/0115227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can Firefox Be Saved?
by Peter Reutemann 17 Aug '20

17 Aug '20

'"Even with another infusion of cash from Google, you have to wonder just how long Firefox will survive as a viable, mainstream web browser," argues ZDNet contributing editor Steven J. Vaughan-Nichols: I've been using Mozilla's Firefox browser since it was still in beta. In 2004, for a while, it was my favorite web browser. Not because it was open-source, but because it was so much better and more secure than Internet Explorer. That was then. This is now. Firefox is in real danger of dying off... Mozilla and Firefox still produced important work. You need to look no further than the JavaScript, Rust, and WebAssembly languages. They were also champions of security and privacy. Projects such as embracing DNS-over-HTTPS (DoH) and overall security improvements were great, but users didn't care. With the arrival of Google's Chrome browser, users turned from Firefox to Chrome as their favorite browser... Firefox is on its way to irrelevance. Making matters even worse, Mozilla's just had its second round of layoffs... As technology writer Matthew MacDonald put it, "Mozilla "." Firefox's security and development teams have also been hard hit. This is bad. In January. Mitchell Baker, Mozilla Corporation CEO and Mozilla Foundation chairperson, said it let people go because of declining interest in Firefox, and thus reduced earnings, and that Mozilla was looking for more revenue from "sources outside of search" but "this did not happen." It still isn't happening. According to Mozilla's latest annual report, the majority of its revenue is still generated from global browser search partnerships. This includes the deal negotiated with Google in 2017... Baker assured onlookers that Mozilla would "ship new products faster and develop new revenue streams." These include its bookmarking app Pocket; its virtual rooms Hubs; and its $4.99-a-month Firefox VPN. Excuse me if I don't buy any of these new revenue sources.... Firefox will live on in one way or the other. It's open source after all. But Firefox as an important browser, or Mozilla as a significant open-source developer hub? No. I can't see it. Those days are done. Firefox is officially on my endangered species list. Technology writer Matthew MacDonald ended his Medium essay on a more hopeful note. "If you have the skills and time, the best possible support is to join the Mozilla community and contribute to their code base."' -- source: https://news.slashdot.org/story/20/08/15/1955237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Happy Birthday to Debian, CPAN, and Mutt
by Peter Reutemann 17 Aug '20

17 Aug '20

'27 years ago today, in 1993, Debian first appeared in the world. August 16th has since been recognized as "DebianDay," celebrated shortly before the annual Debian Conference — with lots of ways to get involved, according to Debian.org: Today is also an opportunity for you to start or resume your contributions to Debian. For example, you can scratch your creative itch and suggest a wallpaper to be part of the artwork for the next release, have a look at the DebConf20 schedule and register to participate online (August 23rd to 29th, 2020), or put a Debian live image in a DVD or USB and give it to some person near you, who still didn't discover Debian. Our favorite operating system is the result of all the work we do together. Thanks to everybody who has contributed in these 27 years, and happy birthday Debian! And the same day is also the 25th anniversary of CPAN, the Comprehensive Perl Archive Network: On the 16th August 1995, Andreas König uploaded Symdump 1.20 to CPAN. There were other things already on CPAN, but this was the first true upload, to be followed by more than 6,500 people who have released over 35,000 distributions in 230k releases. So it seems appropriate that 16th August be designated CPAN Day, to celebrate CPAN, and all the authors who've made it what it is. That blog post urges readers to celebrate the anniversary "by doing something related to CPAN: release something, blog about your favourite module, or email its author thanking her or him." Finally, Slashdot reader JobSnijders reminds us that Mutt is also enjoying a birthday: The email client that aims to suck a little bit less celebrates its 25th anniversary!' -- source: https://linux.slashdot.org/story/20/08/16/1652249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Qualcomm Shook Down The Cell Phone Industry For Almost 20 Years
by Lawrence D'Oliveiro 15 Aug '20

15 Aug '20

A pretty sobering read <https://arstechnica.com/tech-policy/2019/05/how-qualcomm-shook-down-the-cel…>: Qualcomm's first weapon against competitors: patent licensing terms requiring customers to pay a royalty on every phone sold—not just phones that contained Qualcomm's wireless chips. Sound familiar? Judge Koh draws a direct parallel to licensing behavior that got Microsoft in legal trouble in the 1990s. Microsoft would offer PC makers a discount if they agreed to pay Microsoft a licensing fee for every PC sold—whether or not the PC shipped with a copy of MS-DOS. This effectively meant that a PC maker had to pay twice if it shipped a PC running a non-Microsoft operating system. There’s a lot more--the article reads like a catalogue of gangster-like tactics. All of which is perfectly all right under the US interpretation of “Free Enterprise”, of course ... Also, reading the details of how Qualcomm managed to sabotage Intel’s efforts to develop 5G chips, it seems to me that Qualcomm is directly responsible for the situation today where US companies are lagging behind Chinese ones like Huawei in 5G capability.

1 1