- wlug - list.wlug.org.nz

U.S. Government: Update Chrome 80 Now, Multiple Security Concerns Confirmed
by Peter Reutemann 05 Apr '20

05 Apr '20

'Part of America's Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) "has advised users to update Google Chrome as new high-rated security vulnerabilities have been found," reports Forbes: In an April 1 posting, CISA confirmed that Google Chrome version 80.0.3987.162 "addresses vulnerabilities that an attacker could exploit to take control of an affected system," be that Windows, Mac or Linux. It went on to state that it "encourages" users and administrators to apply the update. It's not just CISA that is warning about the need to update Google Chrome. The Center for Internet Security (CIS) is a non-profit entity that works to safeguard both private and public organizations against cyber threats. In a multi-state information sharing and analysis center (MS-ISAC) advisory, it has also warned of multiple vulnerabilities in Google Chrome. The most severe of these could allow an attacker to achieve arbitrary code execution within the context of the browser... All it would take for an attacker to exploit the vulnerabilities is to get the user to visit, by way of a phishing attack or even redirection from a compromised site, a maliciously crafted web page. Beside three high-rated vulnerabilities, Forbes reports that "a further five security vulnerabilities were discovered by the Google internal security team using a combination of internal audits and fuzzing."' -- source: https://it.slashdot.org/story/20/04/04/2020211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Cheap 3D Printer Review
by Lawrence D'Oliveiro 05 Apr '20

05 Apr '20

Here’s a review <https://www.youtube.com/watch?v=M3SMUpNH_6I> of a sub-USD100 3D printer from China. Has some good discussion of quality issues in 3D printing generally, and how this relates to the printer versus the filament you use. And I learned about the “3DBenchy” benchmark reference model. Judging from the gear they have access to, LTT seems to have quite a high budget for a YouTube channel. Also some useful notes from knowledgeable users among the comments ... if you can be bothered to dig for them ...

1 0

Yet Another Processor Architecture
by Lawrence D'Oliveiro 05 Apr '20

05 Apr '20

Here’s a report <https://www.nextplatform.com/2020/04/02/tachyum-starts-from-scratch-to-etch…> on a startup creating another new, proprietary processor architecture. Proprietary or not, the standard thing to do to get software running on things like this seems to be to port the GNU toolchain. Kernel? OS? No mention of that at this stage. I don’t claim to understand all the details, but it seems to be taking ideas from lots of sources, including Intel’s Itanium (which failed to become a successor to x86). One thing I was surprised to learn is that, as the wires connecting the transistors on a chip get thinner, this also makes them slower. So you don’t get all the gain you were expecting from making them shorter and bringing things closer together. One thing is clear: the Great Wheel Of Reincarnation <https://www.deviantart.com/default-cube/art/Computer-Graphics-And-The-Wheel…> (which in this case would apply to computing generally, not just graphics) has yet to stop spinning ...

1 0

Vint Cerf 'No Longer Contagious' With Covid-19
by Peter Reutemann 05 Apr '20

05 Apr '20

'Good news — VA Public Health has certified my wife and me as no longer contagious with COVID19," tweeted 76-year-old Vint Cerf, one of the creators of the modern internet. He added one word. "Recovering!" It seemed especially appropriate that Cerf shared his news online — and that it drew positive responses from grateful people around the world, including several who use the internet in their daily lives. Cerf's tweet immediately drew positive responses from the Internet Society, as well as the chief operating officer of the Cloud Native Computing Foundation, YouTube's director of public policy, and a senior director of communications and public affairs at Google. There were also congratulatory posts from a Georgetown professor of technology and law, from Associated Press reporter Frank Bajak, and the executive director of the Global Privacy and Security by Design Centre. Cerf followed up his news with a re-tweet of Google's "Community Mobility Reports" charting our aggregate movement trends over time, and a tweet of a University of Pittsburgh press release about progress on a COVID-19 vaccine candidate. Earlier in the week Cerf also re-tweeted a humorous compilation of clips from the TV show M*A*S*H that illustrated safe practices while social distancing.' -- source: https://news.slashdot.org/story/20/04/04/0615234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Will Google Allow An Independent Peek At Its Crown Jewels?
by Lawrence D'Oliveiro 04 Apr '20

04 Apr '20

An advertising company called Foundem is suing Google <https://www.theregister.co.uk/2020/04/03/google_foundem_high_court_seo_expe…> over a drastic demotion in its search rankings and consequent damage to its business, claiming this was an anticompetitive act. Google denies this, and as part of its defence has filed documents with the court giving confidential details of how its search-ranking algorithms work. But of course the lawyers and judge don’t have the background to understand these documents. So the plaintiff wants an independent SEO expert to be able to go over them and make sense of them to the lawyers. Google is vehemently opposed to this. So now the judge has given the company a stark choice: either allow the expert access to those documents, or withdraw them from the evidence (and thereby, by Google’s own admission as to the “vital” nature of these documents for its defence, likely lose the case). Which way do you think Google will decide?

1 0

Phone-tracking of self-isolationists
by tom butz 04 Apr '20

04 Apr '20

When we had to track teenagers' nightclubbing whereabouts (they're adults now), we did the following: 1) made sure we'd written down their mobile phone-numbers (obviously) 2) remembered their names/addresses (obviously) 3) told them to leave their mobiles switched ON all the time (they'd have done that anyway to keep up with Social Media) 4) Sent them a text every hour on the hour and they'd have to reply 'OK'. We'd reimburse them the money for the texts (nice little earner if you're on a plan...). Side-effect: it boosted their self-esteem (wow, getting messages all the time - she must be popular). Was that asking too much? Fast forward to our current lockdown and the way to handle self-quarantine: 1) as above 2) as above 3) as above 4) get info from cellphone-towers to check which one they're logged in. If, for example, someone is in self-quarantine at an Auckland campground and all of a sudden's logged into the Gisborne cell-tower, that would be an indication that they're elsewhere - or that the phone had been stolen. Note that in the case of traffic accidents police already get the info from cell-towers, so they can determine if the driver - according to their phone - was in the area, logged on and texting. Piece of cake for them, according to TVNZ. BTW, there is no need for name-matching: the rental-car companies do that anyway, so the user's name could stay anonymous - until police very kindly ask/beg cap in hand for it to be released. Tom Butz.

1 0

Twitter Discloses Firefox Bug That Cached Private Files Sent or Received via DMs
by Peter Reutemann 03 Apr '20

03 Apr '20

'Social networking giant Twitter today disclosed a bug on its platform that impacted users who accessed their platform using Firefox browsers. >From a report: According to Twitter, its platform stored private files inside the Firefox browser's cache -- a folder where websites store information and files temporarily. Twitter said that once users left their platform or logged off, the files would remain in the browser cache, allowing anyone to retrieve it. The company is now warning users who share workstations or used a public computer that some of their private files may still be present in the Firefox cache. Malware present on a system could also scrape and steal this data, if ever configured to do so.' -- source: https://news.slashdot.org/story/20/04/02/2048216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Internet is Now Rife With Places Where You Can Organize Zoom-bombing Raids
by Peter Reutemann 03 Apr '20

03 Apr '20

'The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid. From a report: ZDNet began tracking the tactic since mid-March when the term was first coined following a TechCrunch article. Ever since then, Zoom-bombing incidents have increased, as articles in major news outlets like the New York Times and the BBC have made the practice a favorite pastime for all the teenagers stuck in their homes during the current coronavirus (COVID-19) quarantines. From a niche prank that started on a derelict Discord channel, Zoom-bombing has now spread to enormous proportions -- being so rampant these days that the FBI sent a nationwide alert last week, urging companies, schools, and universities to take steps to secure their Zoom channels. But as Zoom-bombing became more popular, more pranksters wanted to join on the fun, and more users wanted their friends' Zoom meetings disrupted. And as the old saying goes; where there's a demand, there's always a supply. Over the course of the past week, the number of places on the public internet where you can request a zoom raid from a gang of bored teenagers has exploded.' -- source: https://yro.slashdot.org/story/20/04/02/1937229 How to secure Zoom: https://www.netsafe.org.nz/get-into-zoom/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

National Tells PM To Stop Using Zoom At Cabinet Meetings
by Lawrence D'Oliveiro 02 Apr '20

02 Apr '20

Security concerns are being raised about the Zoom videoconferencing service, which Jacinda Ardern and her cabinet have been using in their online meetings <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12321784>.

2 1

Linux Mint 20 is 64-bit Only, Based on Ubuntu 20.04, and Named 'Ulyana'
by Peter Reutemann 01 Apr '20

01 Apr '20

'Today, we learn some new details about the upcoming Linux Mint 20. While most of the newly revealed information is positive, there is one thing that is sure to upset many Linux Mint users. First things first, Linux Mint 20 will be based on the upcoming Ubuntu 20.04. This shouldn't come as a surprise, as Mint only uses Long Term Support versions of Ubuntu, and 20.04 will be an LTS. We also now know the name of Linux Mint 20. The Mint team always uses female names, and this time they chose "Ulyana." This is apparently a Russian name meaning "youthful." So far, all of the news is positive, so what exactly will upset some users? The Linux Mint developers are finally dropping 32-bit support and will only produce 64-bit ISOs.' -- source: https://linux.slashdot.org/story/20/03/31/1842216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2