- wlug - list.wlug.org.nz

Mozilla Launches VPN as Part of Resurrected Firefox Test Pilot Program
by Peter Reutemann 10 Sep '19

10 Sep '19

'Mozilla is resurrecting its recently expunged Test Pilot program with a renewed focus on privacy-focused tools and products. The Firefox developer today lifted the lid on the first product to emerge from the new Test Pilot, and it appears to be something akin to a virtual private network (VPN) in all but name. From a report: Firefox Private Network, as the new tool is called, is available in beta today for logged-in Firefox desktop users in the U.S. only, and is accessible through a browser extension. By way of a quick recap, Mozilla debuted Firefox Test Pilot a decade ago but then relaunched it back in 2016. Test Pilot went on to attain an average of 100,000 daily users, each looking to test Mozilla's latest developments -- including a price-tracking feature for online shoppers, content recommendations based on browsing activity, and more. Some of these became full-fledged features within Firefox and others did not, but back in January Mozilla announced it was killing its Test Pilot program altogether. This came as something of a surprise given Mozilla's own statements about the success of the program. At the time, Mozilla said it was "evolving" its approach to experimentation and suggested it was looking to ideate more widely across the company. Fast-forward nine months, and Firefox Test Pilot is back for a third time.' -- source: https://yro.slashdot.org/story/19/09/10/1514241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Weakness in Intel chips lets researchers steal encrypted SSH keystrokes
by Peter Reutemann 10 Sep '19

10 Sep '19

'In late 2011, Intel introduced a performance enhancement to its line of server processors that allowed network cards and other peripherals to connect directly to a CPU's last-level cache, rather than following the standard (and significantly longer) path through the server's main memory. By avoiding system memory, Intel's DDIO—short for Data-Direct I/O—increased input/output bandwidth and reduced latency and power consumption. Now, researchers are warning that, in certain scenarios, attackers can abuse DDIO to obtain keystrokes and possibly other types of sensitive data that flow through the memory of vulnerable servers. The most serious form of attack can take place in data centers and cloud environments that have both DDIO and remote direct memory access enabled to allow servers to exchange data. A server leased by a malicious hacker could abuse the vulnerability to attack other customers. To prove their point, the researchers devised an attack that allows a server to steal keystrokes typed into the protected SSH (or secure shell session) established between another server and an application server.' -- source: https://arstechnica.com/information-technology/2019/09/weakness-in-intel-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Thousands of Servers Infected With New Lilocked (Lilu) Ransomware
by Peter Reutemann 10 Sep '19

10 Sep '19

'Thousands of web servers have been infected and had their files encrypted by a new strain of ransomware named Lilocked (or Lilu). Infections have been happening since mid-July, and have intensified in the past two weeks, ZDNet has learned. Based on current evidence, the Lilocked ransomware appears to target Linux-based systems only. The way the Lilocked gang breaches servers and encrypts their content is currently unknown. A thread on a Russian-speaking forum puts forward the theory that crooks might be targeting systems running outdated Exim (email) software. It also mentions that the ransomware managed to get root access to servers by unknown means. Lilocked doesn't encrypt system files, but only a small subset of file extensions, such as HTML, SHTML, JS, CSS, PHP, INI, and various image file formats. This means infected servers continue to run normally. According to French security researcher Benkow, Lilocked has encrypted more than 6,700 servers, many of which have been indexed and cached in Google search results. However, the number of victims is suspected to be much much higher. Not all Linux systems run web servers, and there are many other infected systems that haven't been indexed in Google search results. Why it should scare you: - affects Linux servers - so far the vector of infection / vulnerability is unknown - you can craft a Google search to watch it spread! ' -- source: https://it.slashdot.org/story/19/09/09/2246218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Scraping Is Legal--For Now
by Lawrence D'Oliveiro 10 Sep '19

10 Sep '19

LinkedIn has been suing a company called hiQ for scraping information from public user profiles, and so far it has lost, twice <https://www.theregister.co.uk/2019/09/09/hiq_wins_linkedin_appeal/>. But of course LinkedIn, being owned by Microsoft, has much deeper legal pockets, and will simply continue a war of attrition until hiQ gives up.

1 0

Guidemaster: How to buy a Chromebook, plus our best picks
by Peter Reutemann 10 Sep '19

10 Sep '19

'Chromebooks dominated the affordable laptop scene in 2018. The same wasn't true just a few years ago, when most were unclear what to do with Google's browser-based operating system. But now, after Chromebooks have successfully infiltrated the education market, users both young and old are familiar with Chrome OS. Chrome OS runs exclusively on Chromebooks, the name for the laptops, two-in-ones, and now tablets that run Google's operating system. If you've used the Chrome Web browser before, you know how to use Chrome OS—the browser is the portal to nearly everything you can do on Chrome OS. Google created an operating system that's simple to use, efficient, and low maintenance in the sense that it doesn't take a ton of power to run a Chromebook well. All of those factors, plus the recent introduction of Android apps into the ecosystem, have made Chromebooks popular with younger users, teachers, and anyone who works and plays primarily within the confines of the Chrome Web browser. As people gravitate to Chromebooks, OEMs have been producing more and more of them. There is a plethora of Chromebooks available now, some at dirt cheap prices and others at premium prices, making it hard to know which you should buy. Luckily, Ars has tested some of the most popular Chromebooks, and we can offer some insight as to which ones are worth your money.' -- source: https://arstechnica.com/gadgets/2019/09/guidemaster-how-to-buy-a-chromebook… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome OS Bug Started Mistakenly Sending 'Final Update' Notifications
by Peter Reutemann 09 Sep '19

09 Sep '19

'Like it or not, Chromebooks do have something of an expiration date when you purchase them, namely that one day they'll stop receiving updates. Thankfully, that date is typically over five years after the Chromebook's original release. For some, however, Chrome OS has been wrongly indicating this week that their Chromebook has received its "final update" many years too early. Just like the Chrome browser on desktop and Android, Chrome OS has four different update "channels" -- Stable, Beta, Dev, and Canary. Each one of these after Stable trades a level of stability for more rapid updates, with Canary receiving highly unstable updates almost every day. People who are bold enough to put their Chromebook on Dev or Canary have been facing an interesting new issue for the past few days. Upon restarting their device, Chrome OS immediately displays a notification warning that "this is the last automatic software and security update for this Chromebook." Of course, if you're seeing this message this week, there's a decent chance that this is not actually the case. Instead, these final update warnings are caused by a bug in the most recent versions of Chrome OS. ' -- source: https://tech.slashdot.org/story/19/09/09/0113215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Feature-rich Vivaldi Browser Arrives on Android
by Peter Reutemann 09 Sep '19

09 Sep '19

'Almost three years after launching its desktop version, cross-platform browser Vivaldi has finally released its mobile app today. From a report: The brainchild of Opera's co-founder Jon von Tetzchner published an Android beta version today that brings swipe gesture for navigation, built-in note-taking functionality, and privacy controls including a no-tracking option. While the browser is in beta, I've been using it for a few days, and I haven't faced any major hiccups. Here are some of the features I enjoyed in the new mobile version: Easy bookmark management, easy navigation, plenty of option for tab management, and dark mode, screen capture, notes, and no-tracking features.' -- source: https://tech.slashdot.org/story/19/09/09/1610214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Manjaro Linux Tries Forming A Company To Fund Full-Time Development
by Peter Reutemann 09 Sep '19

09 Sep '19

'Forbes.com shares some big Linux news: Since 2011, Arch Linux-based Manjaro has focused on being a simple-to-use, accessible Linux desktop distribution with a friendly community... But as of today, Manjaro Linux is no longer just a Linux distribution -- it's officially transforming into a company with ambitious plans for its future. Say hello to Manjaro GmbH & Co. KG. The announcement happened just hours ago, via Manjaro developer Philip Müller. It's not the catchiest name, but the advantages to this move seem beneficial to the both the Manjaro project and the community using it. Müller says that for quite some time he's been researching "ways to secure the project in its current form and how to allow for activities which can't be undertaken as a 'hobby project.'" Crucially, he and the team wanted to reach new heights and be able to invest considerably more time into the project, without compromising the way its currently operating. To that end, the Manjaro team is announcing the formation of an established company, Manjaro GmbH & Co. KG, "to enable full-time employment of maintainers and exploration of future commercial opportunities." They'll also be taking on Blue Systems -- a German IT company specializing in Free and Libre software -- as an advisor. Additionally, the team will transfer the ownership of all donations -- and the allocation of donations -- to fiscal hosts CommunityBridge and OpenCollective, which will both secure donations and make their use transparent... At this stage is look like there's a distinction between what will change in the immediate future, and what the company will strive for. The biggest immediate change -- one that Manjaro supporters may applaud -- is that developers Philip Müller and Bernhard Landauer can now commit to the distribution in a full-time capacity, with an eye toward taking on even more employees down the road. "One of our main goals is to improve our infrastructure and continuously work on the essentials and requirements of our distro as a professional endeavor," writes Müller. "Our hope is to soon be able to include additional contributors on a paid basis."' -- source: https://linux.slashdot.org/story/19/09/08/2342247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Purism Finally Starts Shipping Its Privacy-Focused 'Librem 5' Smartphone
by Peter Reutemann 09 Sep '19

09 Sep '19

'"It's here! Purism announces shipment of the Librem 5," writes long-time Slashdot reader Ocean Consulting: Librem 5 is a landmark mobile device with a dedicated platform, runs PureOS Linux, and is the first mobile phone to seek hardware certification from the Free Software Foundation. Initially a crowd sourced funding campaign, the phone embraces principles of free software and user privacy. IP native communication is supported via Matrix. Privacy features include hardware kill switches for camera, microphone, cellular, wifi, Bluetooth and GPS. "The Librem 5 phone is built from the ground up to respect the privacy, security, and freedoms of society," reads the site's official announcement. "It is a revolutionary approach to solving the issues that people face today around data exploitation -- putting people in control of their own digital lives." They're adopting an "iterative" shipping schedule -- publishing a detailed schedule defining specific batches and their features with corresponding shipping dates. "Each iteration improves upon the prior in a rapid rolling release throughout the entire first version of the phone... As slots in a particular early batch free up, we will open it up for others in a later batch to join in, according to the date of the order."' -- source: https://mobile.slashdot.org/story/19/09/08/2228201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Google's Chrome Has My Dead Grandpa's Data and He Never Used the Internet'
by Peter Reutemann 08 Sep '19

08 Sep '19

'Forbes article by Joe Toscano, a former experience design consultant for Google who in 2017 "decided to step away from my role consulting with Google, due to ethical concerns." This summer he got a big surprise when he looked in Chrome's "addresses" panel at chrome://settings/addresses It turns out Google has info connecting me to my grandma (on my dad's side) who's alive and well but has never had the internet, and my grandpa (on my mom's side), who recently passed away in March 2019 and also never had the internet. This was disturbing for several reasons, the biggest of which being that neither of them had ever logged onto the internet in their lives. Neither even had the internet in their homes their entire lives! Beyond that, Google knew their exact addresses and their middle initials. I couldn't even have told you those things about my grandparents... [T]he data wasn't manually entered by me or anyone using my account, but yet the data is associated with my account? How did that happen? The only thing I can think of is that at one point in history my grandpa gave his information to someone or some company in real life and his information was sold to Google at one point or another... But then that led me to another question: How did his data get associated with my Google account...? Other questions I have: What other information does Google have about me/my family/others that I don't know about...? He's now asking readers if they have any idea how Google connected him to his dead grandpa -- and whether Google is somehow creating an ancestry database. Toscano also discovered Chrome has been creating a list of "Never Saved" passwords at chrome://settings/passwords?search=credentials even though "At no point did I tell Google to create and store a list of websites I had logged into that they didn't get access to but would like access to at some point in the future. Maybe in the Terms of Service/Privacy Policy I agreed to this, but who knows? Not the majority of us, and it's just creepy." And in an update Toscano writes that he hopes the article will "provoke thought" about "why we willingly allow this to happen": Why is it okay that the internet is designed to be a surveillance machine? Why isn't it designed to be private by design? Is this how we want to carry on? Just because something is legal doesn't mean it's right. What would you like to see done? How would you like to see things changed?' -- source: https://yro.slashdot.org/story/19/09/07/168245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0