- wlug - list.wlug.org.nz

The secret behind “unkillable” Android backdoor called xHelper has been revealed
by Peter Reutemann 17 Apr '20

17 Apr '20

'In February, a researcher detailed a widely circulating Android backdoor that’s so pernicious that it survives factory resets, a trait that makes the malware impossible to remove without taking unusual measures. The analysis found that the unusual persistence was the result of rogue folders containing a trojan installer, neither of which was removed by a reset. The trojan dropper would then reinstall the backdoor in the event of a reset. Despite those insights, the researcher still didn’t know precisely how that happened. Now, a different researcher has filled in the missing pieces.' -- source: https://arstechnica.com/information-technology/2020/04/solved-how-android-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Remove Support For the FTP Protocol
by Peter Reutemann 16 Apr '20

16 Apr '20

'Mozilla has announced plans to remove support for the FTP protocol from Firefox. Going forward, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser. From a report: "We're doing this for security reasons," said Michal Novotny, a software engineer at the Mozilla Corporation, the company behind the Firefox browser. "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources," he said. "Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past." Novotny says Mozilla plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year.' -- source: https://news.slashdot.org/story/20/03/19/169246 There's always FileZilla... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

NASA Uses 3D Cardboard Glasses
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

Here’s a fun one: normally, the drivers of the Curiosity Mars rover have active-shutter 3D glasses for viewing images of the Martian terrain on their office machines. But these don’t work on the hardware that these staffers are currently using from home. So they are falling back to those cheap cardboard red-and-blue glasses that they would give out, included in the price of the ticket, at cinemas <https://www.theregister.co.uk/2020/04/15/nasa_cardboard_3d_glasses_for_curi…>.

1 0

Jailbreaking Medical Equipment
by Lawrence D'Oliveiro 16 Apr '20

16 Apr '20

A security researcher has been taking a look at a piece of “CPAP” (“Continuous Positive Airway Pressure”) equipment <https://arstechnica.com/information-technology/2020/04/firmware-jailbreak-l…>, normally used to treat sleep apnoea, just to see whether it can be adapted to function as a “BIPAP” (“Bi-Level Positive Airway Pressure”) device, i.e. a full-on ventilator. The manufacturer says no, but the researcher says yes, the device already has the essential functionality available in its firmware, just needing a patch to enable it.

1 0

A story with a happy ending
by Ian Stewart 15 Apr '20

15 Apr '20

Seven years ago, in March 2013, I discovered a bug in the BASIC programming language that is included with LibreOffice suite of applications. I found that if BASIC was requested to return a 1 to 4 x nibbles Hex string, it would return positive integers OK but it would have an error when attempting to return a negative integer. For examples: Cint(&H0) returned 0 OK Cint(&H7FFF) returned 32767 OK Cint(&HFFFF) should have returned -1, but returned an "overflow error" Cint(&H8000) should have returned -32768, but returned an "overflow error". On the 14th March 2013, I opened a case for this issue on Bugzilla and it was logged as Bug 62326 https://bugs.documentfoundation.org/show_bug.cgi?id=62326 === The most recent comment posted on this bug was two weeks ago: Comment 39 Commit Notification 2020-03-30 06:59:05 UTC Andreas Heinisch committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/ffbcbbc8dcc946d4d91cc08a937c2067be5… Cleanup for tdf#130476, tdf#62323 and tdf#62326 It will be available in 7.0.0. === Version 7.0 of LibreOffice is scheduled for release in August 2020. === So.... Good things come to those who wait! cheers, Ian.

3 2

RIP John Conway
by Lawrence D'Oliveiro 15 Apr '20

15 Apr '20

One of the higher-profile victims† of Covid-19 has been mathematician John Conway, best known to most people for the invention of the cellular-automata game he called “Life”. This article <https://arstechnica.com/science/2020/04/john-conway-inventor-of-the-game-of…> has some details, including a link to a YouTube video showing a quite amazing configuration of 6 “engines” that generate an endless stream of “Corderships” that go sailing off in one direction. †Another victim I personally feel sad about is Tim Brooke-Taylor. But while I enjoyed his humour (for example in “The Goodies” and “At Last, The 1948 Show” on TV, and “I’m Sorry, I’ll Read That Again” on radio), I can’t think of anything appropriate to this group to say about him...

2 1

Samsung's S-Voice Is Shutting Down On June 1st
by Peter Reutemann 14 Apr '20

14 Apr '20

'Samsung is reportedly shutting off the servers for its S-Voice voice assistant on June 1, 2020, "at which point Samsung's original voice assistant will stop attempting to respond to your voice queries," reports Ars Technica. From the report: S-Voice arose in the early days of voice assistants, when Android OEMs were scrambling to photocopy Apple's Siri voice assistant, which launched in 2011. Samsung licensed the same underlying technology for S-Voice that Apple originally used for Siri -- Nuance Communication's voice recognition -- and set about building its Siri sibling. S-Voice was Samsung's chosen voice assistant for its smartphones until it rebooted its voice efforts with the launch of "Bixby" in 2017. Samsung's Bixby project initially grew out of an acquisition of Viv Labs, a voice-assistant company founded by members of the original Siri team (see a pattern here?). The Galaxy S8 and every device after it launched with Bixby and not S-Voice, so this shutdown should only effect older devices. SamMobile hunted down a list of applicable devices, saying "The affected models that have the S Voice icon on the app screen include the Galaxy A3, A5, A7, A8, A9, Galaxy Note FE, Galaxy Note 2, 3, 4, 5, Galaxy S3, 4, S5, S6, S6 edge in addition to the Galaxy Note Pro 12.2, Galaxy W, Galaxy Tab 4, Galaxy Tab 4 8.0/10.1, Galaxy Tab S8.4 and S10.5. ' -- source: https://mobile.slashdot.org/story/20/04/13/2336220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Steak-umm Became The Tweeting Voice Of Reason In A Pandemic
by Lawrence D'Oliveiro 14 Apr '20

14 Apr '20

No, I had never heard of this US-based product before, either. But whoever is in charge of its Twitter account has decided to use their power for good, not for evil <https://www.techdirt.com/articles/20200410/17213944276/how-steak-umm-became…>. Consider comments like this: it can be difficult to know what to believe in a time when institutional trust is diminished and the gatekeepers of information have been dismantled, but it's more crucial now than ever before to follow a range of credentialed sources for both breaking news and data collection or this: you can maintain independent, critical thinking toward institutions without dipping into fringe conspiracies that get jumpstarted by individual anecdotes being virally spread as data. it's not easy, but it's necessary to keep any semblance of responsible online information flow or this: we're a frozen meat brand posting ads inevitably made to misdirect people and generate sales, so this is peak irony, but hey we live in a society so please make informed decisions to the best of your ability and don't let anecdotes dictate your worldview ok and this: people think it's bizarre, ironic, and funny when a frozen meat company points out the importance of critical thinking, but chances are the same message would never "go viral" if it was from a person. our society values entertainment over truth and that's a huge problem

1 0

Not actually Linux distro review deux: GhostBSD
by Peter Reutemann 14 Apr '20

14 Apr '20

'When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly. I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review. GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States. The history of desktop-oriented BSD distros is a turbulent one. For several years, Kris Moore's PC-BSD was the go-to for "I want BSD, but I also want a ready-to-go desktop." Eventually, ixSystems—home of the FreeNAS storage distro, and the company Moore is vice president of engineering for—came to rely heavily on the server-side features developed into PC-BSD. The need at ixSystems for the foundation of PC-BSD without the associated desktop led to a rename and a fork. PC-BSD's underpinnings became TrueOS, and the desktop-friendly distribution—now based on TrueOS—became Project Trident. This state of affairs didn't last long. A year later, Project Trident declared unhappiness with TrueOS and BSD in general—mostly due to hardware support, or lack thereof. In January 2020, Trident rebased itself on Void Linux, which its developers found to be "the most BSD-like" of the potential Linux upstream distros they examined. Project Trident's departure for more Linux-y waters left several potential contenders for a desktop-focused BSD distribution. These include FuryBSD, MidnightBSD, DesktopBSD, and GhostBSD itself. I've tested PC-BSD fairly extensively in the past but have no history with any of the current desktop BSD choices. I chose GhostBSD for a first look, solely due to its prominence in Google search results for "desktop BSD distro."' -- source: https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-de… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux on Laptops: ASUS Zephyrus G14 with Ryzen 9 4900HS
by Peter Reutemann 14 Apr '20

14 Apr '20

'The Zephyrus G14 is a dual-GPU gaming laptop, and Linux tends not to fare well with that setup. But it's the only Ryzen 4000 equipped laptop I have available—so it was obviously going to get Linux on it, whether it liked it or not. Since brand-new hardware generally calls for brand-new distro versions, I grabbed a fresh copy of the Ubuntu Focal Fossa beta and gave it a whirl. I have the sad duty of reporting that the results were mediocre at best.' -- source: https://arstechnica.com/gadgets/2020/04/linux-on-laptops-asus-zephyrus-g14-… >From my recent experience of setting up a GPU machine, the Nouveau driver was unusable to get a working desktop. I ended up having to use the Ubuntu server edition instead with a text-based setup, which required me to have ethernet plugged in for internet. The strangest thing on this machine is docker: after rebooting the machine, I have to restart docker before I can do anything with it... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0