- wlug - list.wlug.org.nz

Richard Stallman Says Linux Code Contributions Can't Be Rescinded
by Peter Reutemann 30 Sep '18

30 Sep '18

'Linux developers who contribute code to the kernel cannot rescind those contributions, according to the software programmer who devised the GNU General Public Licence version 2.0, the licence under which the kernel is released. Richard Stallman, the head of the Free Software Foundation and founder of the GNU Project, told iTWire in response to queries that contributors to a GPLv2-covered program could not ask for their code to be removed. "That's because they are bound by the GPLv2 themselves. I checked this with a lawyer," said Stallman, who started the free software movement in 1984. There have been claims made by many people, including journalists, that if any kernel developers are penalised under the new code of conduct for the kernel project -- which was put in place when Linux creator Linus Torvalds decided to take a break to fix his behavioural issues -- then they would ask for their code to be removed from the kernel... Stallman asked: "But what if they could? What would they achieve by doing so? They would cause harm to the whole free software community. The anonymous person who suggests that Linux contributors do this is urging them to [use a] set of nuclear weapons in pique over an internal matter of the development team for Linux. What a shame that would be." Slashdot reader dmoberhaus shared an article from Motherboard with more perspetives from Eric S. Raymond and LWN.net founder Jonathan Corbet, which also traces the origins of the suggestion. "[A]n anonymous user going by the handle 'unconditionedwitness' called for developers who end up getting banned through the Code of Conduct in the future to rescind their contributions to the Linux kernel 'in a bloc' to produce the greatest effect. "It is worth noting that the email address for unconditionedwitness pointed to redchan.it, a now defunct message board on 8chan that mostly hosted misogynistic memes, many of which were associated with gamergate."' -- source: https://news.slashdot.org/story/18/09/29/055210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Now Dominates Azure
by Peter Reutemann 28 Sep '18

28 Sep '18

'Three years ago, Mark Russinovich, CTO of Azure, Microsoft's cloud program, said, "One in four [Azure] instances are Linux." Then, in 2017, it was 40 percent Azure virtual machines (VM) were Linux. Today, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, said in an interview, "Slightly over half of Azure VMs are Linux. That's right. Microsoft's prize cloud, Linux, not Windows Server, is now the most popular operating system. Windows Server isn't going to be making a come back. Every month, Linux goes up," Guthrie said. And it's not just Azure users who are turning to Linux. "Native Azure services are often running on Linux," Guthrie added. "Microsoft is building more of these services. For example, Azure's Software Defined Network (SDN) is based on Linux." It's not just on Azure that Microsoft is embracing Linux. "Look at our simultaneous release of SQL Server on Linux. All of our projects now run on Linux," Guthrie said.' -- source: https://linux.slashdot.org/story/18/09/27/209211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Secretly Logs Users Into Chrome Whenever They Log Into a Google Site
by Peter Reutemann 27 Sep '18

27 Sep '18

'Catalin Cimpanu, writing for ZDNet: Starting with Chrome 69, whenever a Chrome user would access a Google-owned site, the browser would take that user's Google identity and log the user into the Chrome in-browser account system -- also known as Sync. This system, Sync, allows users to log in with their Google accounts inside Chrome and optionally upload and synchronize local browser data (history, passwords, bookmarks, and other) to Google's servers. Sync has been present in Chrome for years, but until now, the system worked independently from the logged-in state of Google accounts. This allowed users to surf the web while logged into a Google account but not upload any Chrome browsing data to Google's servers, data that may be tied to their accounts. Now, with the revelations of this new auto-login mechanism, a large number of users are angry that this sneaky modification would allow Google to link that person's traffic to a specific browser and device with a higher degree of accuracy. That criticism proved to be wrong, as Google engineers have clarified on Twitter that this auto-login operation does not start the process of synchronizing local data to Google's servers, which will require a user click. Furthermore, they also revealed that the reason why this mechanism was added was for privacy reasons in the first place. Chrome engineers said the auto-login mechanism was added in the browser because of shared computers/browsers. Well-respected cryptographer Matthew Green was disappointed by the move. In a post, he wrote: [...] In the rest of this post, I'm going to talk about why this matters. From my perspective, this comes down to basically four points: 1. Nobody on the Chrome development team can provide a clear rationale for why this change was necessary, and the explanations they've given don't make any sense. 2. This change has enormous implications for user privacy and trust, and Google seems unable to grapple with this. 3. The change makes a hash out of Google's own privacy policies for Chrome. 4. Google needs to stop treating customer trust like it's a renewable resource, because they're screwing up badly.' -- source: https://tech.slashdot.org/story/18/09/24/1351251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Password Managers Can Be Tricked Into Believing That Malicious Android Apps Are Legitimate
by Peter Reutemann 26 Sep '18

26 Sep '18

'A new academic study published today reveals that Android-based password managers have a hard time distinguishing between legitimate and fake applications, leading to easy phishing scenarios. From a report: The study looked at how password managers work on modern versions of the Android OS, and which of the OS features attackers can abuse to collect user credentials via phishing attacks carried out via fake, lookalike apps. What the research team found was that password managers, initially developed for desktop browsers, aren't as secure as their desktop versions. The problem comes from the fact that mobile password managers have a hard time associating a user's stored website credentials with a mobile application and then creating a link between that website and an official app. [...] Researchers say they tested the way five Android password managers create internal maps (connections) between a locally installed app and legitimate internet sites and found that four of the five were vulnerable to abuse. Android versions of password managers from Keeper, Dashlane, LastPass, and 1Password were found to be vulnerable and have prompted the user to auto-fill credentials on fake apps during tests. Researchers found that Google's Smart Lock app did not fall for this fake package name trick, and the reason was because it used a system named Digital Asset Links to authenticate and connect apps to a particular online service.' -- source: https://it.slashdot.org/story/18/09/26/1534203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vivaldi 2.0 Desktop Browser Featuring Expanded Customization, Sync Across Devices and Privacy Tools Released [Q&A With Founder]
by Peter Reutemann 26 Sep '18

26 Sep '18

'Vivaldi announced Wednesday it has released a major update to its namesake desktop web browser, remaining as one of the rare companies that is still attempting to fight Google's monopoly in the space. Major features in Vivaldi 2.0 include: - Syncing browsers across computers:Version 2.0 allows users to sync data, including bookmarks, passwords, autofill information, and history. Vivaldi uses its own servers to store the data, which is all encrypted end-to-end. - Panels: These are expandable, multi-tasking dashboards that can be opened in the sidebar. - Tab management: Additional features are included that allow for better searching through tabs, stacking them, and even renaming them. - History: Offers new ways to track your usage, including generating statistics and a visual history feature. Vivaldi was founded by Jon von Tetzchner, who also co-founded Opera and served as its chief executive for a number of years. Jon has been vocal about what many find unfair tactics employed by Google and Microsoft to aggressively expand the user bases of their respective browsers.' -- source: https://tech.slashdot.org/story/18/09/26/0713254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora 29 Beta Now Available For Download With Improved Raspberry Pi Support
by Peter Reutemann 25 Sep '18

25 Sep '18

'The Fedora Project announced Tuesday the beta availability of Fedora 29 -- the latest version of the free and open-source Fedora OS. From a report: It features updated packages, improved support for Raspberry Pi, and more. "Highlighting Fedora 29 Beta is the addition of modularity across all Fedora editions. First delivered in Fedora 28 Server, modularity enables multiple versions of the same software (like Node.js) to be selected on a per-system basis, with parallel installation done through containers. This can provide some users the ability to use tried-and-true versions of software while enabling other users to work with just-released innovation without impacting the overall stability of the Fedora operating system," says Matthew Miller, Fedora Project Leader. Miller further says, "The importance of ARM to IoT has not been lost on Fedora, and Fedora 29 Beta aims to make the Fedora operating system a home for both ARM and IoT. These features start with enhanced ZRAM support for swap on ARMv7 and aarch64, which can improve the performance and reliability of Fedora 29 Beta on ARM Single Board Computers, like the Raspberry Pi. These devices are used by 'makers' and in developmental IoT solutions."' -- source: https://linux.slashdot.org/story/18/09/25/1939240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Monitor Will Inform You of Data Breaches
by Peter Reutemann 25 Sep '18

25 Sep '18

'Earlier this year, Mozilla announced Firefox Monitor, a service that will inform you if your online accounts were hacked in a recent data breach. It's now available to general public. A report adds: For the new security-focused tool, Mozilla partnered with Troy Hunt, the renowned security expert behind Have I Been Pwned? (HIBP), which is a database of data breaches that allows anyone to discover whether one of their online accounts has been compromised. The first iteration of Firefox Monitor is, for all intents and purposes, a clone of HIBP. After you enter your email address and hit the scan button, you're told which online services have leaked your personal details (if any). You can also sign up to be notified of any future data breaches involving one or more of your email addresses.' -- source: https://tech.slashdot.org/story/18/09/25/1928234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Buys and Shuts Down Intelligent Email App Astro
by Peter Reutemann 25 Sep '18

25 Sep '18

Since we discussed matrix.org at last night's meeting, this might be of interest: 'Slack has acquired email app company Astro to incorporate it into Slack channels. As a result, Astro is shutting down its Mac, iOS, Android, Alexa and Slack apps. They're no longer taking new users and existing ones will lose access on October 10th. Engadget reports: The company said that with over 50 million channels created to date, they're increasingly becoming the platform through which teams collaborate. "But we all know that email is still a very important tool in business communication," said Slack. "We've taken some steps to make it possible to integrate email into Slack, but now we're in a position to make that interoperability much simpler and much, much more powerful." Last year, Astro launched its Astrobot Slack app, which let users manage their emails and check their Office 365 or Google calendars from within Slack. It also allowed them to do one search to pull up results from both Slack and email. "As we explored with Slack how to bring together messaging, email and calendar, it became evident that we would have the biggest impact on workplace communications and realize our original vision by joining Slack," the company said. ' -- source: https://tech.slashdot.org/story/18/09/24/2051256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky TV Wants ISPs To Block Pirate Sites
by Lawrence D'Oliveiro 25 Sep '18

25 Sep '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121313…>: Sky says ISPs should introduce blocking, because other countries do it. But it doesn’t mention how effective such blocks actually are(n’t). Also, it appears 5% of NZers have discovered the usefulness of Kodi boxes. The article nicely points out one problem with trying to block some of these “pirate” sites: Sky has also taken at least a dozen cases against individuals who accessed illegal Facebook streams of Joseph Parker fights - although it only sought token costs, not damages. However, while Sky's action over illegal Parker fight streaming has been successful, it also illustrates the complications of Sky's website blocking request. It is unlikely any ISP would want to block Facebook.

1 0

topic(s) for this month's meeting?
by Peter Reutemann 23 Sep '18

23 Sep '18

Hi everyone In all that Alexa excitement at the last meeting, I completely forgot to figure out topic/speaker for this month's meeting. Anybody keen on presenting or an interesting topic to discuss? Is actually anybody running the latest 4.19 kernel and noticed significant performance drops (thanks to specter/meltdown)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 4