- wlug - list.wlug.org.nz

Potentially disastrous Rowhammer bitflips can bypass ECC protections
by Peter Reutemann 22 Nov '18

22 Nov '18

'In early 2015, researchers unveiled Rowhammer, a cutting-edge hack that exploits unfixable physical weaknesses in the silicon of certain types of memory chips to transform data they stored. In the 42 months that have passed since then, an enhancement known as error-correcting code (or ECC) available in higher-end chips was believed to be an absolute defense against potentially disastrous bitflips that changed 0s to 1s and vice versa. Research published Wednesday has now shattered that assumption.' -- source: https://arstechnica.com/information-technology/2018/11/potentially-disastro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Have We Reached Peak Silicon Valley?
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121638…>: ... global smartphone sales saw their first year-on-year fall in history at the end of 2017. Apple seemed unaffected at the time, but its latest quarterly results now show falls in unit sales, as a result of which it will stop reporting them in future. >From beginnings that we might date to around the mid-1970s, PC sales (and development) went on an uninterrupted upward curve right through the 1990s, only starting to stutter around about the 2000s. The smartphone revolution, even if it includes the Symbian era and not just Android and Apple, has not lasted quite as long. So what new information-processing technology will ignite the mass market next? If any?

2 1

Germany Proposes Rules For Home Router Security
by Lawrence D'Oliveiro 21 Nov '18

21 Nov '18

The federal German body responsible for information security has published some recommendations for how consumers’ internet routers should behave by default, including limiting the initially-enabled services, requiring firewall functionality, and mandating the deletion of all personal data on a factory reset <https://www.theregister.co.uk/2018/11/20/germany_versus_openwrt_ccc/>. This looks like a welcome first step, even if some argue it doesn’t go far enough.

1 0

Microsoft Azure Outage Fixed, Office 365 Still Broken
by Lawrence D'Oliveiro 20 Nov '18

20 Nov '18

They fixed Azure by turning the multi-factor authentication servers off and on again <https://www.theregister.co.uk/2018/11/19/microsoft_azure_office_outage_late…>. Lawrence “You Couldn’t Make This Up” D’Oliveiro

2 1

Microsoft Disputing Its NZ Tax Payments
by Lawrence D'Oliveiro 19 Nov '18

19 Nov '18

The IRD is demanding that Microsoft NZ pay more tax <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121627…>. This is over the whole notorious business of “transfer pricing”, where sales by multinational corporations are recorded in jurisdictions where they attract less tax, rather than where the customers are located. Looks like there have already been some changes to this, though obviously the dispute would be over whether those changes are enough: From February 2018, the local unit's accounts were extended to include the distribution of computer software and hardware, having previously covered marketing. The change effectively means local product sales are being captured. Concomitant with this: The changes to Microsoft's revenue recognition also seem to route GST through the local unit, with GST payments of $8.1 million in the year ended June 30, compared to just $13,441 a year earlier. Man, that’s quite a jump. All of Microsoft’s NZ customers incurring just $13,441 in GST over an entire year ...

1 0

A little collection of cool unix terminal/console/curses tools
by Peter Reutemann 19 Nov '18

19 Nov '18

'Kristof Kovacs: Just a list of 20 (now 28) tools for the command line. Some are little-known, some are just too useful to miss, some are pure obscure -- I hope you find something useful that you weren't aware of yet! Use your operating system's package manager to install most of them. (Thanks for the tips, everybody!) ' -- source: https://kkovacs.eu/cool-but-obscure-unix-tools Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mark Shuttleworth Reveals Ubuntu 18.04 Will Get a 10-Year Support Lifespan
by Peter Reutemann 18 Nov '18

18 Nov '18

'At the OpenStack Summit in Berlin last week, Ubuntu Linux founder Mark Shuttleworth said in a keynote that Ubuntu 18.04 Long Term Support (LTS) support lifespan would be extended from five years to 10 years. "I'm delighted to announce that Ubuntu 18.04 will be supported for a full 10 years," said Shuttleworth, "In part because of the very long time horizons in some of industries like financial services and telecommunications but also from IoT where manufacturing lines for example are being deployed that will be in production for at least a decade." ZDNet reports: Ubuntu 18.04 released in April 2018. While the Ubuntu desktop gets most of the ink, most of Canonical's dollars comes from server and cloud customers. It's for these corporate users Canonical first extended Ubuntu 12.04 security support, then Ubuntu 14.04's support, and now, preemptively, Ubuntu 18.04. In an interview after the keynote, Shuttleworth said Ubuntu 16.04, which is scheduled to reach its end of life in April 2021, will also be given a longer support life span. When it comes to OpenStack, Shuttleworth promised again to support versions of OpenStack dating back to 2014's IceHouse. Shuttleworth said, "What matters isn't day two, what matters is day 1,500." He also doubled-down on Canonical's promise to easily enable OpenStack customers to migrate from one version of OpenStack to another. Generally speaking, upgrading from one version of OpenStack is like a root canal: Long and painful but necessary. With Canonical OpenStack, you can step up all the way from the oldest supported version to the newest one with no more than a second of downtime. ' -- source: https://news.slashdot.org/story/18/11/17/1748205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Uber Joins Linux Foundation Cementing Commitment To Open Source Tools
by Peter Reutemann 15 Nov '18

15 Nov '18

'At the 2018 Uber Open Summit, Uber announced it was joining the Linux Foundation as a Gold Member, making a firm commitment to using and contributing to open source tools. TechCrunch reports: Uber CTO Thuan Pham sees the Linux Foundation as a place for companies like his to nurture and develop open source projects. "Open source technology is the backbone of many of Uber's core services and as we continue to mature, these solutions will become ever more important," he said in a blog post announcing the partnership. "Uber has made significant investments in shared software development and community collaboration through open source over the years, including contributing the popular open source project Jaeger, a distributed tracing system, to the Linux Foundation's Cloud Native Computing Foundation in 2017," an Uber spokesperson told TechCrunch. As the report mentions, it took the ride-hailing service a long time for them to join the Linux Foundation. "Uber has been long known for making use of open source in its core tools working on over 320 open source projects and repositories from 1500 contributors involving over 70,000 commits, according to data provided by the company," reports TechCrunch.' -- source: https://linux.slashdot.org/story/18/11/15/226212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns
by Peter Reutemann 15 Nov '18

15 Nov '18

'Mozilla has released its second annual "Privacy Not Included" guide that rates 70 products to help give you an idea as to how secure or insecure they are. "We want to provide people information about how to make informed decisions when shopping for gifts that are connected to the internet," says Ashley Boyd, vice president of advocacy at Mozilla. "These products are becoming really popular. And in some cases, it's easy to forget that they're even connected to the internet." Wired reports: Among the important signifiers of a trustworthy stocking stuffer, according to Mozilla's rubric: the use of encryption, pushing automatic software security updates, strong password hygiene, a way to deal with vulnerabilities should they arise, and a privacy policy that doesn't take a PhD to parse. The most surprising result of Mozilla's testing may be how many products actually earned its seal of approval. Thirty-three of the 70 items in the "Privacy Not Included" guide passed muster; fans of the Nintendo Switch, Google Home, and Harry Potter Kano Coding Kit can sleep a little easier. On the other end of the scale, Mozilla highlighted seven products that may not hit the mark -- yes, including the sous vide wand, the Anova Precision Cooker. Also scoring low marks in Mozilla's accounting: the DJI Spark Selfie Drone (no encryption, does not require users to change the default password), the Parrot Bebop 2 drone (no encryption, complex privacy policy), and unsurprisingly, at least one baby monitor. The remaining 30 items on the list all exist somewhere in the murky middle, usually because Mozilla was unable to confirm at least one attribute. Which may be the real takeaway from the report: Typically, you have no reasonable way to find out if a given internet-connected device is secure. "If you can't tell, that says that there's a problem of communication between manufacturers and consumers," says Boyd. "We would love for makers of these products to be more clear and more transparent about what they're doing and not doing. That's a big place we think change is needed." ' -- source: https://tech.slashdot.org/story/18/11/15/0042210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A New Raspberry Pi 3 Model A+ Has Arrived With Bluetooth 4.2 and Dual-Band Wi-Fi For $25
by Peter Reutemann 15 Nov '18

15 Nov '18

'Raspberry Pi has introduced a new version of one of its most popular models just in time to stuff your stocking: the Model A+. And this time around, it's even more attractive. From a report: The Raspberry Pi 3 Model A+ costs $25, $5 more than the previous generation, but has a lot more going for it. Just like the top-of-the-line Model B+, the new Model A+ has a 1.4GHz 64-bit quad-core processor, and you'll also get dual-band Wi-Fi (2.4GHz + 5 GHz), a feature that was missing from the previous A+. And you'll have to use it, since the A+ doesn't have an Ethernet port. It does, however, have Bluetooth 4.2 on board. For $10 less than the $35 Model B+, you'll also only get a single USB port (versus four on the B+) as well as 512MB of RAM (versus 1GB on the B+). But otherwise, the devices are identical, with a full-size HDMI port, CSI camera port, DSI display port, stereo output and composite video port, and a micro SD port. The Raspberry Pi 3 Model A+ isn't the cheapest Pi model available -- the Zero costs $5 and the Zero W costs just $10 -- but it rounds out the options nicely. The new model is available now through Raspberry Pi retailers.' -- source: https://hardware.slashdot.org/story/18/11/15/1846205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0