- wlug - list.wlug.org.nz

Should Huawei Just Abandon Android?
by Peter Reutemann 03 Feb '20

03 Feb '20

'Due to a U.S. government ban on sales to Huawei, Google revoked its license for popular apps last spring (including Gmail and the Play Store). But this week Huawei executive Fred Wangfei suggested that even if that ban is lifted, Huawei would continue developing its own app ecosystem instead to avoid the possibility of future political complications. The vice president of risk management and partner relations at Huawei later called those remarks "incorrect," while elsewhere Huawei issued a slightly different statement -- that "An open Android ecosystem is still our first choice, but if we are not able to continue to use it, we have the ability to develop our own." But BGR was already noting that Huawei "is ready to invest $3 billion this year to incentivize more than 4,000 developers to improve its Huawei Mobile Services system. Another billion is reserved for marketing purposes." And Android Authority suggests Huawei should stick to its original statement. "Maybe it's time for Huawei to go all-in on Harmony OS and do what it can to bring a viable alternative to Android and iOS..." If there's any company today that has the financial resources and raw talent necessary to bring in a viable third choice for smartphone operating systems, it's Huawei... Sure, it would be a long-term investment and there would inevitably be short-term losses as the company tries to find its footing and develop Harmony OS to have its own identity. But it would prevent something like the Huawei ban from happening to the company again as well as further the company's ambitions as not only a smartphone manufacturer but as a technology creator.... Huawei would have major difficulties in encouraging wide adoption of Harmony OS for one major reason: it's Huawei. The Huawei ban exists because the United States government doesn't trust Huawei and there are numerous (as yet unproven) accusations against the company related to espionage, IP theft, fraud, and even violations of international treaties... Huawei is already in a bad situation. It's going to need to dig itself out of the hole it's in regardless, so why not use this opportunity to turn lemons into lemonade and develop Harmony OS as a viable third option on the way? Maybe the industry needs a shake-up... Maybe a new operating system is just the kind of fire OEMs need to turn the market around. Maybe a real, potent threat that the billions of people who use Android and iOS just might jump ship to something else would scare companies into taking some real risks. As I said earlier, there aren't too many companies out there right now that could do this, but Huawei could. ' -- source: https://tech.slashdot.org/story/20/02/01/0152225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Pulls WireGuard VPN into Linux 5.6 Kernel Source Tree
by Peter Reutemann 02 Feb '20

02 Feb '20

'"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar: While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities. While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android. Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration. Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.' -- source: https://it.slashdot.org/story/20/02/01/1846256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD Mail Server Bug Allowed Remotely Executing Shell Commands As Root
by Peter Reutemann 02 Feb '20

02 Feb '20

'This week a remotely-exploitable vulnerability (granting root privileges) was discovered in OpenSMTPD (OpenBSD's implementation of server-side SMTP). ZDNet notes that the library's "portable" version "has also been incorporated into other OSes, such as FreeBSD, NetBSD, and some Linux distros, such as Debian, Fedora, Alpine Linux, and more." To exploit this issue, an attacker must craft and send malformed SMTP messages to a vulnerable server... OpenSMTPD developers have confirmed the vulnerability and released a patch earlier Wednesday -- OpenSMTPD version 6.6.2p1... The good news is that the bug was introduced in the OpenSMTPD code in May 2018 and that many distros may still use older library versions, not affected by this issue. For example, only in-dev Debian releases are affected by this issue, but not Debian stable branches, which ship with older OpenSMTPD versions. Technical details and proof of concept exploit code are available in the Qualys CVE-2020-7247 security advisory. Hackaday has a more detailed description of the vulnerability, while the Register looks at the buggy C code. Interestingly, Qualys researchers exploited this vulnerability using a technique from the Morris Worm of 1988.' -- source: https://it.slashdot.org/story/20/02/01/2254237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Moves To Monetize Thunderbird, Transfers Project To New Subsidiary
by Peter Reutemann 31 Jan '20

31 Jan '20

'The Mozilla Foundation announced today that it was moving its Thunderbird email client to a new subsidiary named the MZLA Technologies Corporation. From a report: Mozilla said that Thunderbird will continue to remain free and open source, but by moving the project away from its foundation into a corporate entity they will be able to monetize the product and pay for its development easier than before. Currently, Thunderbird is primarily being kept alive through charitable donations from the product's userbase. "Moving to MZLA Technologies Corporation will not only allow the Thunderbird project more flexibility and agility, but will also allow us to explore offering our users products and services that were not possible under the Mozilla Foundation," said Philipp Kewisch, Mozilla Product Manager. "The move will allow the project to collect revenue through partnerships and non-charitable donations, which in turn can be used to cover the costs of new products and services," Kewisch added.' -- source: https://tech.slashdot.org/story/20/01/29/1430253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

64-Bit Times On 32-Bit Linux
by Lawrence D'Oliveiro 31 Jan '20

31 Jan '20

Some more patches have gone into the Linux kernel <https://www.theregister.co.uk/2020/01/30/linux_5_6_2038/> to allow 32-bit builds to deal with times past the year-2038 barrier. Basically the fix involves offering a 64-bit alternative to the original time_t type, without the whole app having to go 64-bit. One point I noticed is that certain filesystems (e.g. ext2, presumably ext3 as well) store on-disk fields with 32-bit timestamps, so if you’re using one of these, you’ll have to reformat the disks as well. And that would apply even if you’re already using a 64-bit OS.

1 0

GetTogether.community - alternative to meetup.com
by Peter Reutemann 30 Jan '20

30 Jan '20

Hi everyone Based on our discussions at the AGM on Monday night... Next year, I'll be advertising our meetings also on GetTogether, a free/open-source alternative to meetup.com. If you've been using meetup.com, please consider helping me test-drive GetTogether by creating an account and joining the WLUG team/group. WLUG is accessible here on GetTogether: https://gettogether.community/waikato-linux-users-group/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

autoremove
by john 29 Jan '20

29 Jan '20

Hi all, At our last meeting Tom was concerned about Linux bloating with surplus files. I have always found this to seldom be the case due to : a. The new download removes the older files or: b. The command autoremove clears the unused kernels and other not required files. eg. john(a)polomint:~$ sudo apt autoremove Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be REMOVED: linux-headers-4.15.0-72 linux-headers-4.15.0-72-generic linux-image-4.15.0-72-generic linux-modules-4.15.0-72-generic linux-modules-extra-4.15.0-72-generic 0 upgraded, 0 newly installed, 5 to remove and 4 not upgraded. After this operation, 332 MB disk space will be freed. Do you want to continue? [Y/n] Cheers John..

1 0

Intel Is Patching Its 'Zombieload' CPU Security Flaw For the Third Time
by Peter Reutemann 28 Jan '20

28 Jan '20

'For the third time in less than a year, Intel has disclosed a new set of vulnerabilities related to the speculative functionality of its processors. On Monday, the company said it will issue a software update "in the coming weeks" that will fix two more microarchitectural data sampling (MDS) or Zombieload flaws. This latest update comes after the company released two separate patches in May and November of last year. Compared to the MDS flaws Intel addressed in those two previous patches, these latest ones have a couple of limitations. To start, one of the vulnerabilities, L1DES, doesn't work on Intel's more recent chips. Moreover, a hacker can't execute the attack using a web browser. Intel also says it's "not aware" of anyone taking advantage of the flaws outside of the lab. In response to complaints of the company's piecemeal approach, Intel said that it has taken significant steps to reduce the danger the flaws represent to its processors. "Since May 2019, starting with Microarchitectural Data Sampling (MDS), and then in November with TAA, we and our system software partners have released mitigations that have cumulatively and substantially reduced the overall attack surface for these types of issues," a spokesperson for the company said. "We continue to conduct research in this area -- internally, and in conjunction with the external research community.' -- source: https://it.slashdot.org/story/20/01/27/2126231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

European Processor Initiative
by Lawrence D'Oliveiro 28 Jan '20

28 Jan '20

Here’s a report <https://www.nextplatform.com/2020/01/27/european-processor-initiative-readi…> on a Europe-wide effort to produce a processor chip for an “exascale” supercomputer. It will have an ARM CPU core, with a RISC-V-based accelerator and a few other special-purpose units on the side. I was intrigued to see mention of an “AI-inspired bfloat16 format”. Floating-point numbers commonly come in 32-bit and 64-bit sizes. There is also a “half-precision” 16-bit format, with reduced precision and dynamic range, commonly used in computer graphics, for example. This new format keeps the full dynamic range of 32-bit floats, at the expense of even further reduced precision. Apparently this works better for various machine-learning algorithms.

1 0

ProtonVPN Open Sources All Its Code
by Peter Reutemann 28 Jan '20

28 Jan '20

'ProtonVPN open sourced its code this week, ZDNet reports: On Tuesday, the virtual private network (VPN) provider, also known for the ProtonMail secure email service, said that the code backing ProtonVPN applications on every system -- Microsoft Windows, Apple macOS, Android, and iOS -- is now publicly available for review in what Switzerland-based ProtonVPN calls "natural" progression. "There is a lack of transparency and accountability regarding who operates VPN services, their security qualifications, and whether they fully conform to privacy laws like GDPR," the company says. "Making all of our applications open source is, therefore, a natural next step." Each application has also undergone a security audit by SEC Consult, which ProtonVPN says builds upon a previous partnership with Mozilla... The source code for each app is now available on GitHub (Windows, macOS, Android, iOS). "As a community-supported organization, we have a responsibility to be as transparent, accountable, and accessible as possible," ProtonVPN says. "Going open source helps us to do that and serve you better at the same time." They're also publishing the results of an independent security audit for each app. "As former CERN scientists, publication and peer review are a core part of our ethos..." the company wrote in a blog post. They also point out that Switzerland has some of the world's strongest privacy laws -- and that ProtonVPN observes a strict no-logs policy. But how do they feel about their competition? "Studies have found that over one-third of Android VPNs actually contain malware, many VPNs suffered from major security lapses, and many free VPN services that claimed to protect privacy are secretly selling user data to third parties."' -- source: https://yro.slashdot.org/story/20/01/27/0352244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0