- wlug - list.wlug.org.nz

Slack Resets Passwords For 1% of Its Users Because of 2015 Hack
by Peter Reutemann 18 Jul '19

18 Jul '19

'Slack published more details about a password reset operation that ZDNet reported earlier today. According to a statement the company published on its website, the password reset operation is related to the company's 2015 security breach. In March 2015, Slack said hackers gained access to some Slack infrastructure, including databases storing user credentials. Hackers stole hashed passwords, but they also planted code on the company's site to capture plaintext passwords that users entered when logging in. At the time, Slack reset passwords for users who it believed were impacted, and also added support for two-factor authentication for all accounts. But as ZDNet reported earlier today, the company recently received a batch of Slack users credentials, which prompted the company to start an investigation into its source and prepare a password reset procedure. "We immediately confirmed that a portion of the email addresses and password combinations were valid, reset those passwords, and explained our actions to the affected users," Slack said. In a message on its website, Slack said this batch of credentials came via its bug bounty program. The company said it initially believed the data came from users who had their PCs infected with malware, or users who reused passwords across different services.' -- source: https://tech.slashdot.org/story/19/07/18/1610221 Yep, been one of them... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Explore Using Rust
by Peter Reutemann 18 Jul '19

18 Jul '19

'Microsoft plans to explore using the Rust programming language as an alternative to C, C++, and others, as a way to improve the security posture of its and everyone else's apps. From a report: The announcement was made yesterday by Gavin Thomas, Principal Security Engineering Manager for the Microsoft Security Response Center (MSRC). "You're probably used to thinking about the Microsoft Security Response Center as a group that responds to incidents and vulnerabilities," Thomas said. "We are a response organization, but we also have a proactive role, and in a new blog series we will highlight Microsoft's exploration of safer system programming languages, starting with Rust." The end game is to find a way to move developers from the aging C and C++ programming language to so-called "memory-safe languages." Memory-safe languages, such as Rust, are designed from the ground up with protections against memory corruption vulnerabilities, such as buffer overflows, race conditions, memory leaks, use-after free and memory pointer-related bug' -- source: https://developers.slashdot.org/story/19/07/17/1630241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Warn When Saved Logins are Found in Data Breaches
by Peter Reutemann 18 Jul '19

18 Jul '19

'Starting in Firefox 70, Mozilla aims to have the browser report when any of your saved logins were found in data breaches. This will be done through their partnership with the Have I Been Pwned data breach site. From a report: Mozilla is slowly integrating their independent Firefox Monitor service and the new Firefox Lockwise password manager directly into Firefox. Mozilla is also considering premium services based around these features in the future. As part of this integration, Firefox will scan the saved login names and passwords and see if they were exposed in a data breach listed on Have I been Pwned. If one is found, Firefox will alert the user and prompt them to change their password. This new feature will only work, though, for data breaches that exposed passwords and when the password was saved prior to an associated data breach.' -- source: https://news.slashdot.org/story/19/07/17/1933231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Join us at the Red Hat & Ingram Micro Partner Day!
by Roger Hardy 17 Jul '19

17 Jul '19

Below was the source of that. In my experience, this is usually more sales than technical, but can be interesting all the same. Sorry for the spam..... What’s new with Red Hat?To make sure our emails get to your inbox, add imnz_ms(a)ingrammicro.co.nz to your address book.Email not displaying correctly? View it in your browser.Dear Rodger, You’re invited to join Ingram Micro and Red Hat as we bring you the very first Red Hat Partner Day. We’ll be presenting updates and insights on the newest technologies and architectures in hybrid multi-cloud solutions to help you: Learn how Red Hat's latest technologies can help you and your customers break down the barriers to true hybrid and multi-cloud environments.Understand how to use automation and intelligent management of cloud technologies to reduce security risks and exposures.Find out what’s new and happening at Red Hat.LOCATIONSAucklandRydges Hotel Hobson Room Tuesday, 23 July 2019 8:30 am - 11:40 am WellingtonThe Intercontinental Wellington Room Thursday, 25 July 2019 8:30 am - 11:40 amAGENDA8:30 - 9:30Breakfast9:30 - 9:35Welcome9:30 - 10:15Red Hat Enterprise Linux 8 with Insights and Ansible Automation10:15 - 10:55Red Hat OpenShift Container Platform 4: Enterprise Kubernetes & the Future of Open Hybrid Cloud10:55 - 11:10Industry Trends11:10 - 11:40Panel Discussion on Strategic portfolio Hybrid Cloud Register Now For more information, please contact: helen.chan(a)ingrammicro.com.Ingram Micro (N.Z.) Ltd 78 Apollo Drive, Rosedale, Auckland 0632nz.ingrammicro.com Follow on Twitter Follow on Linkedin Like on Facebook Copyright © 2019, All rights reserved. Our mailing address is: Ingram Micro New Zealand 78 Apollo Drive Rosedale Auckland, 0632 New Zealand Standard terms and conditions apply View our privacy policy Update preferences Unsubscribe

1 0

Red Hat Tech Talk: Hybrid Cloud New Zealand
by Peter Reutemann 17 Jul '19

17 Jul '19

Just saw the following (free, I believe) event come through on the NZOSS mailing list and thought people on here might be interested as well: Red Hat Tech Talk: Hybrid Cloud New Zealand At this afternoon event, meet our experts, hear what's new at Red Hat and get the latest insights on: - How to deliver innovative apps through containers - Security, compliance and governance for apps and workloads that run on a mix of public and private clouds - Automation and management capabilities for genuine portability of workloads into public cloud - How Red Hat Enterprise Linux 8 and Red Hat OpenShift 4 are transformational for hybrid clouds Select from two cities: Auckland - 23 July Wellington - 25 July Event registration: https://events.redhat.com/profile/form/index.cfm?PKformID=0x69788abcd# Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Giving Greylisting A Try
by Lawrence D'Oliveiro 15 Jul '19

15 Jul '19

I have decided to try installing sqlgrey on my VPS to see if that cuts down on the volume of spam. The basic idea is more than a decade old, and I can’t find much in the way of newer testimonials as to how wonderful it continues to be. On the other hand, I can’t see anyone saying it is now a terrible idea that should have a stake put through its heart and buried in an unmarked grave at midnight and forgotten. (Actually I’m posting this message just to see how legitimate mail makes it through the greylist obstacle course; it’s only been running less than an hour, and has already blocked 10 spam messages so far.)

2 7

meeting next Monday
by Peter Reutemann 15 Jul '19

15 Jul '19

Hi everyone We have a WLUG meeting next Monday: "Ben Radburnd will showcase GalliumOS (https://galliumos.org/) on his Chromebook." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884291/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What Does Ubuntu's Post-Unity Future Look Like?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Following Canonical's pivot away from its internally-developed Unity user interface and Mir display server, Ubuntu has enjoyed two relatively low-drama years, as the Linux Desktop market homogenized during its transition back to a customized GNOME desktop. In a review of the most recent release, TechRepublic's Jack Wallen declared that "Ubuntu 19.04 should seriously impress anyone looking for a fast and reliable Linux desktop platform." Largely, it's been a slow-and-steady pace for Ubuntu since the pivot from Unity to GNOME, though the distribution made headlines for plans to end support for 32-bit support. This prompted Valve, operators of games marketplace Steam, to re-think its approach toward Ubuntu, which it previously characterized as "as the best-supported path for desktop users." TechRepublic's James Sanders interviewed Will Cooke, director of engineering for Ubuntu Desktop at Canonical, about the distribution's long-term plans for legacy 32-bit support, shipping a desktop in a post-Unity-era Ubuntu, and why Linux should be the first choice for users migrating from Windows 7 prior to the end of support. >From the interview: When we did the switch to GNOME Shell from Unity, we did a survey [asking] people straightforward questions like, "What sort of features do you want to see continue in Ubuntu Desktop?" The answer came through very, very clearly that people liked having the launcher on the left, and they wanted to keep that feature there. They liked having desktop icons and they wanted to keep that feature there. We've made decisions based on data from our user base, from our community. They have provided that feedback and we've done what the majority of people want. Sometimes that doesn't go with the ideals of GNOME design, but we're comfortable with delivering what we see as value on top of GNOME. That's delivering a product which gives people consistency between the old days of Unity 7, and the new days of GNOME Shell. That transition was as easy as possible, everybody had a chance to have a say in it, and the answers were pretty clear. ' -- source: https://linux.slashdot.org/story/19/07/13/0425257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

What's New in Linux 5.2?
by Peter Reutemann 14 Jul '19

14 Jul '19

'Linux 5.2 has been released. This release includes Sound Open Firmware, a project that brings open source firmware to DSP audio devices; open firmware for many Intel products is also included. This release also improves the Pressure Stall Information resource monitoring to make it usable by Android; the mount API has been redesigned with new syscalls; the BFQ I/O scheduler has gained some performance improvements; a new CLONE_PIDFD flag lets clone(2) return pidfs usable by pidfd_send_signal(2); Ext4 has gained support for case-insensitive name lookups; there is also a new device mapper target that simulates a device that has failing sectors and/or read failures; open source drivers for the ARM Mali t4xx and newer 6xx/7xx have been added. Many other new drivers, features and changes can be found in the changelog. But there's more besides supporting "a handful of extra ARM-powered single-board computers," according to CRN: The biggest feature in 5.2 is probably support for Intel's forthcoming Comet Lake architecture, which will power the tenth generation of its Core desktop and mobile CPUs due. The new silicon is due to ship late in 2019 and appear in products early the next year. Linux 5.2 also includes many tweaks that improve its performance on laptops.' -- source: https://linux.slashdot.org/story/19/07/13/0436246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Two New Security Flaws
by Peter Reutemann 14 Jul '19

14 Jul '19

'This week Intel announced two new patches, according to Tom's Hardware: The flaw in the processor diagnostic tool (CVE-2019-11133) is rated 8.2 out 10 on the CVSS 3.0 scale, making it a high-severity vulnerability. The flaw [found by security researcher Jesse Michael from Eclypsium] "may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access," according to Intel's latest security advisory. Versions of the tool that are older than 4.1.2.24 are affected. The second vulnerability, found by Intel's internal team, is a medium-severity vulnerability in Intel's SSD DC S4500/S4600 series sold to data center customers. The flaw found in the SSD firmware versions older than SCV10150 obtained a 5.3 score on the CVSS 3.0 scale, so it was labeled medium-severity. The bug may allow an unprivileged user to enable privilege escalation via physical access. As one of the flaws was uncovered by Intel itself and for the other the Eclypsium research coordinated with Intel for its disclosure, Intel was able to have ready the patches in time for the public announcement. ' -- source: https://slashdot.org/story/19/07/13/2027223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0