- wlug - list.wlug.org.nz

Serious Apache server bug gives root to baddies in shared host environments
by Peter Reutemann 04 Apr '19

04 Apr '19

'The Apache HTTP Server, the Internet’s most widely used Web server, just fixed a serious vulnerability that makes it possible for untrusted users or software to gain unfettered control of the machine the software runs on. CVE-2019-0211, as the vulnerability is indexed, is a local privilege escalation, meaning it allows a person or software that already has limited access to the Web server to elevate privileges to root. From there, the attacker could do just about anything. The vulnerability makes it possible for unprivileged scripts to overwrite sensitive parts of a server’s memory, Charles Fol, the independent researcher who discovered the bug, wrote in a blog post. A malicious script could exploit the vulnerability to gain root. The vulnerability poses the most risk inside Web-hosting facilities that offer shared instances, in which a single physical machine serves content for more than one website. Typically, such servers prevent an administrator of one site from accessing other sites or from accessing sensitive settings of the machine itself.' -- source: https://arstechnica.com/information-technology/2019/04/serious-apache-serve… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Millions of Facebook Records Found on Amazon Cloud Servers
by Peter Reutemann 03 Apr '19

03 Apr '19

'Researchers at UpGuard, a cybersecurity firm, found troves of Facebook user information hiding in plain sight, inadvertently posted publicly on Amazon.com's cloud computing servers. From a report: The discovery shows that a year after the Cambridge Analytica scandal exposed how unsecure and widely disseminated Facebook users' information is online, companies that control that information at every step still haven't done enough to seal up private data, Bloomberg News reports. In one instance, Mexico City-based media company Cultura Colectiva openly stored 540 million records on Facebook users, including identification numbers, comments, reactions and account names. That database was closed on Wednesday after Bloomberg alerted Facebook to the problem and Facebook contacted Amazon. Facebook shares pared their gains after the Bloomberg News report. UpGuard adds: The data sets vary in when they were last updated, the data points present, and the number of unique individuals in each. What ties them together is that they both contain data about Facebook users, describing their interests, relationships, and interactions, that were available to third party developers. As Facebook faces scrutiny over its data stewardship practices, they have made efforts to reduce third party access. But as these exposures show, the data genie cannot be put back in the bottle. Data about Facebook users has been spread far beyond the bounds of what Facebook can control today. Combine that plenitude of personal data with storage technologies that are often misconfigured for public access, and the result is a long tail of data about Facebook users that continues to leak' -- source: https://yro.slashdot.org/story/19/04/03/182215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds on Social Media: 'It's a Disease. It Seems To Encourage Bad Behavior.'
by Peter Reutemann 03 Apr '19

03 Apr '19

'From a wide-ranging interview of Linus Torvalds with Linux Journal on the magazine's 25th anniversary: Linux Journal: If you had to fix one thing about the networked world, what would it be? Linus: Nothing technical. But, I absolutely detest modern "social media" -- Twitter, Facebook, Instagram. It's a disease. It seems to encourage bad behavior. I think part of it is something that email shares too, and that I've said before: "On the internet, nobody can hear you being subtle". When you're not talking to somebody face to face, and you miss all the normal social cues, it's easy to miss humor and sarcasm, but it's also very easy to overlook the reaction of the recipient, so you get things like flame wars, etc., that might not happen as easily with face-to-face interaction. But email still works. You still have to put in the effort to write it, and there's generally some actual content (technical or otherwise). The whole "liking" and "sharing" model is just garbage. There is no effort and no quality control. In fact, it's all geared to the reverse of quality control, with lowest common denominator targets, and click-bait, and things designed to generate an emotional response, often one of moral outrage. Add in anonymity, and it's just disgusting. When you don't even put your real name on your garbage (or the garbage you share or like), it really doesn't help. I'm actually one of those people who thinks that anonymity is overrated. Some people confuse privacy and anonymity and think they go hand in hand, and that protecting privacy means that you need to protect anonymity. I think that's wrong. Anonymity is important if you're a whistle-blower, but if you cannot prove your identity, your crazy rant on some social-media platform shouldn't be visible, and you shouldn't be able to share it or like it. Linux Journal: Is there any advice you'd like to give to young programmers/computer science students? Linus: I'm actually the worst person to ask. I knew I was interested in math and computers since an early age, and I was largely self-taught until university. And everything I did was fairly self-driven. So I don't understand the problems people face when they say "what should I do?" It's not where I came from at all.' -- source: https://tech.slashdot.org/story/19/04/03/1829244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How (Not) To Damage A Flash Storage Device
by Lawrence D'Oliveiro 02 Apr '19

02 Apr '19

Came across this article <http://wiki.laptop.org/go/How_to_Damage_a_FLASH_Storage_Device> on the OLPC wiki about some of the things to beware of when reformatting a flash device (USB stick or SD card -- what about SSDs?). Basically, if there is a mismatch between the blocking of data at the filesystem level and the device page size, then you could be increasing the number of hardware-level writes by a factor of 2 or more. This leads to a corresponding reduction in the life of the device.

1 0

Mozilla Will Run Two Experiments This Month With Firefox To Explore Ways To Fight Push Notification Permission Spam
by Peter Reutemann 02 Apr '19

02 Apr '19

'Mozilla said this week that it intends to run two experiments over the course of this month to determine the most adequate way of dealing with push notification spam, a growing problem that is slowly deteriorating the web experience for everyone. From a report: The experiments will run in Firefox Nightly (v68) and Firefox Beta (v67). The Firefox Nightly experiment will run from April 1 to April 29. During this time, Mozilla said Firefox Nightly would only allow websites to show a push notification permission only after the user has clicked or pressed a key while on a website. All attempts to show a push notification permission request before a click or key press will be blocked by default. [...] In the last two weeks of the experiment, Firefox will show an icon in the URL bar, but with no visible popup on the page. Users can click this icon and accept any push notification permission requests if they wish so.' -- source: https://news.slashdot.org/story/19/04/02/1941232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Introducing Google Tulip
by Ian Stewart 02 Apr '19

02 Apr '19

For those of you with two minutes to spare, here<https://www.youtube.com/watch?v=nsPQvZm_rgM> is a video clip introducing the Google Tulip product which was released on 1st April 2019.

2 1

Linux Mint 19.2 'Tina' is On the Way, But the Developers Seem Defeated and Depressed
by Peter Reutemann 02 Apr '19

02 Apr '19

'Brian Fagioli, reporting for BetaNews: Today should be happy times for the Linux Mint community, as we finally learn some new details about the upcoming version 19.2! It will be based on Ubuntu 18.04 and once again feature three desktop environments -- Xfce, Mate, and Cinnamon. We even found out the code name for Linux Mint 19.2 -- "Tina." And yet, it is hard to celebrate. Why? Because the developers seem to be depressed and defeated. They even appear to be a bit disenchanted with Free Software development overall. Clement Lefebvre, leader of the Linux Mint project, shared a very lengthy blog post today, and it really made me sad. He wrote, "For a team to work, developers need to feel like heroes. They want the same things as users, they are users, they were 'only' users to start with. At some stage they decide to get involved and they start investing time, efforts and emotions into improving our project. What they're looking for the most is support and happiness. They need feedback and information to understand bugs or feature requests and when they're done implementing something, they need to feel like heroes, they literally do, that's part of the reason they're here really." Upon publication of the article, Jason Hicks, Muffin maintainer and member of the Linux Mint team, corroborated the claims made by others.' -- source: https://linux.slashdot.org/story/19/04/02/1359246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SUSE Will Soon Be the Largest Independent Linux Company
by Peter Reutemann 02 Apr '19

02 Apr '19

'At SUSECon in Nashville, Tennessee, European Linux power SUSE CEO Nils Brauckmann said his company would soon be the largest independent Linux company. "That's because, of course, IBM is acquiring Red Hat," reports ZDNet. "But, simultaneously, SUSE has continued to grow for seven-straight years." From the report: Brauckmann said, "We believe that makes our status as a truly independent open source company more important than ever. Our genuinely open-source solutions, flexible business practices, lack of enforced vendor lock-in, and exceptional service are more critical to customer and partner organizations, and our independence coincides with our single-minded focus on delivering what is best for them." Practically speaking, SUSE has been growing by focusing on delivering high-quality Linux and open-source programs and services to enterprise customers. Looking ahead Brauckmann said, "SUSE is better positioned to bring more innovation to customers and partners faster through both organic growth and acquisitions, keeping us on track to provide them with the open solutions that keep them ahead with their own customers in their own markets. We continue to adapt so our customers and partners can succeed." Last year SUSE's revenue grew by 15 percent in fiscal year 2018, and the business is about to surpass the $400 million revenue mark for the first time. SUSE, which sees not quite half of its business in Europe, is also seeing revenue growth around the world. North America, for example, now accounts for almost 40 percent of SUSE's revenues. The company is also expanding. SUSE added more than 300 employees in the last 12 months. For the most part this has been in engineering followed by sales and services. SUSE staff is now approaching 1,750 globally and its plans on continuing to hire aggressively. ' -- source: https://news.slashdot.org/story/19/04/01/222245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Sway – Tiling Window Manager Specially Crafted for Wayland
by Peter Reutemann 01 Apr '19

01 Apr '19

'Tiling window managers are popular lightweight alternatives to full desktop environments, especially among power users. Recently, a newer window manager reached its 1.0 release. This window manager, named Sway, is designed solely for systems that can use Wayland).' -- source: https://itsfoss.com/sway-window-manager/ Funny that, only came across Sway at the last meeting. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Devuan.org Now Points To 'Pwned' Page With Gopher URLs
by Peter Reutemann 31 Mar '19

31 Mar '19

'"DEVUAN.ORG HAS BEEN PWNED" reads a new message at the home page for Devuan (a fork of Debian without systemd) -- which re-redirects to a new page named pwned.html, reports Slashdot reader DevNull127: In all capital letters, its carefully-indented message (complete with an ascii-art logo) now informs visitors that "the web sucks -- JavaScript sucks -- browsers suck." Posting the URLs to several gopher sites, it adds that "Gopher is the way -- gopher is the future." "Kiss port 80 goodbye. Join the revolution on port 70." The attackers identify themselves as "Green Hat Hackers," a term generally understood to mean ambitious newbie hackers who want to improve their skills. "Stop the madness," continues their message, which appeared just hours before the first day of April. "Get yourself a gopher client."' -- source: https://idle.slashdot.org/story/19/03/31/212227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0