- wlug - list.wlug.org.nz

Amazon Plans To Release At Least 8 New Alexa-Powered Devices, Including A Microwave, Amplifier, and In-Car Gadget
by Peter Reutemann 18 Sep '18

18 Sep '18

'Amazon is planning to release at least 8 new voice-controlled hardware devices before the end of the year, according to CNBC. "The devices include, among others, a microwave oven, an amplifier, a receiver, a subwoofer, and an in-car gadget, people familiar with the matter said," reports CNBC. "All of the devices will be Alexa-enabled, meaning they can easily connect to the voice assistant. Some of the devices will also have Alexa built in." From the report: Amazon is expected to reveal some of these devices at an event later this month, according to an internal document describing the plans. The new devices reflect Amazon's ambition to make its Alexa voice technology ubiquitous by focusing on areas where people spend most of their time -- at home and in the car. Alexa was initially considered a geeky experiment at Amazon. Now it is now one of the most popular voice assistants, leading the growth of the burgeoning smart speaker market, which is expected to be worth $30 billion by 2024, according to Global Market Insights. ' -- source: https://tech.slashdot.org/story/18/09/17/2149214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Vulnerability in WebKit Crashes and Restarts iPhones and iPads
by Peter Reutemann 16 Sep '18

16 Sep '18

'Catalin Cimpanu, writing for ZDNet: A security researcher has discovered a vulnerability in the WebKit rendering engine used by Safari that crashes and restarts the iOS devices -- iPhones and iPads. The vulnerability can be exploited by loading an HTML page that uses specially crafted CSS code. The CSS code isn't very complex and tries to apply a CSS effect known as backdrop-filter to a series of nested page segments (DIVs). Backdrop-filter is a relative new CSS property and works by blurring or color shifting to the area behind an element. This is a heavy processing task, and some software engineers and web developers have speculated that the rendering of this effect takes a toll on iOS' graphics processing library, eventually leading to a crash of the mobile OS altogether. ' -- source: https://apple.slashdot.org/story/18/09/16/239226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Kernel Has Grown By 225, 000 Lines of Code This Year, With Contributions From About 3, 300 Developers
by Peter Reutemann 16 Sep '18

16 Sep '18

'Here's an analysis of the Linux kernel repository that attempts to find some fresh numbers on the current kernel development trends. He writes: The kernel repository is at 782,487 commits in total from around 19.009 different authors. The repository is made up of 61,725 files and from there around 25,584,633 lines -- keep in mind there is also documentation, Kconfig build files, various helpers/utilities, etc. So far this year there has been 49,647 commits that added 2,229,836 lines of code while dropping 2,004,759 lines of code. Or a net gain of just 225,077 lines. Keep in mind there was the removal of some old CPU architectures and other code removed in kernels this year so while a lot of new functionality was added, thanks to some cleaning, the kernel didn't bloat up as much as one might have otherwise expected. In 2017 there were 80,603 commits with 3,911,061 additions and 1,385,507 deletions. Given just over one quarter to go, on a commit and line count 2018 might come in lower than the two previous years. Linus Torvalds remains the most frequent committer at just over 3% while the other top contributions to the kernel this year are the usual suspects: David S. Miller, Arnd Bergmann, Colin Ian King, Chris Wilson, and Christoph Hellwig. So far in 2018 there were commits from 3,320 different email addresses. This is actually significantly lower than in previous years.' -- source: https://linux.slashdot.org/story/18/09/16/172217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Elive Emerges Alive After 8-Year Hibernation
by Peter Reutemann 11 Sep '18

11 Sep '18

'Designed to run on minimal hardware, Elive is very much a passion project of its leader, Samuel F Baggen. Based on Debian, the first version took a bow in 2005. The second stable version made an appearance in 2010 and it has been a long eight years for the third stable version to become available. The Register: Elive has an impressively low bar to entry, with hardware requirements for the distribution coming in at 256 MB RAM and a 500 MHz CPU, meaning that some very elderly silicon is theoretically going to be able to enjoy the highly polished Enlightenment desktop. "Theoretically" because after The Register took Elive 3.0.0 out for a spin on a relatively low-powered laptop, we'd frankly baulk at running it on anything much slower than a 533MHz Core 2 with at least 512 MB RAM. However, the Enlightenment UI is undeniably an attractive desktop, particularly if a macOS-alike dock is your thing, and runs at an impressive lick even on hardware that lacks graphics acceleration. At its core, Elive is based on the Debian 8 distribution (aka Jessie), using the 3.16 kernel and version 0.17.6 of the Enlightenment X11 Window Manager. It comes replete with a full set of applications, including the ubiquitous LibreOffice and Gimp, along with a variety of productivity and entertainment tools, some of which are Elive's own. Unlike the previous version of Elive, 3.0.0 removes the requirement of donating to the project in order to install the thing locally (although Baggen was quick to tell The Reg that cost-free alternatives existed, but often with annoying processes).' -- source: https://linux.slashdot.org/story/18/09/11/1121223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Exploit Vendor Drops Tor Browser Zero-Day on Twitter
by Peter Reutemann 11 Sep '18

11 Sep '18

'Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. The vulnerability is a bypass of the NoScript extension that's included by default with all Tor Browser distributions. Once bypassed, an attacker can run malicious code inside the Tor Browser, code that under certain circumstances would have been stopped by NoScript. "This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.' -- source: https://tech.slashdot.org/story/18/09/10/216238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Working On Google Translate Integration In Firefox
by Peter Reutemann 10 Sep '18

10 Sep '18

' Back in 2014, Mozilla partnered with Bing to translate webpages via Firefox in a similar fashion to Chrome's implementation of Google Translate. The company also added support for Yandex Translate in Firefox 41 in mid-2015, but it went all dark soon after and very few updates were issued. Now, Mozilla is finally starting to add support for Google Translate to the translation engine built into Firefox. gHacks reports: While the feature is not fully functional yet, it is an indicator that Mozilla has not forgotten the translate feature completely. Users who enable the translate functionality in Firefox on about:config will notice that Google is the selected translation engine. Google Translate cannot be used currently in Firefox; the browser throws an error message when you hit the translate button in the UI. Bing and Yandex don't seem to work either at this point in time even though Firefox seems to try and translate the page. The "there has been an error translating this page" error is thrown eventually as well. Google Translate requires API access keys and that is usually only available if companies or users pay for the key. It is unclear if Mozilla plans to make a deal with Google or if users will be required to use their own API keys for the functionality. The latter would surely be very limiting. ' -- source: https://tech.slashdot.org/story/18/09/10/0238218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Worries Arise About Security of New WebAuthn Protocol
by Peter Reutemann 10 Sep '18

10 Sep '18

'"A team of security researchers has raised the alarm about some cryptography-related issues with the newly released WebAuthn passwordless authentication protocol," reports ZDNet. "The new WebAuthn protocol will allow users of a device -- such as a computer or a smartphone -- to authenticate on a website using a USB security key, a biometric solution, or his computer or smartphone's password." But researchers say that because WebAuthn uses weak algorithms for the operations of registering a new device, they can pull off some attacks against it. "If converted into a practical exploit, the ECDAA attacks discussed in the article would allow attackers to steal the key from a [server's] TPM, which would allow attackers to effectively clone the user's hardware security token remotely," Arciszewski, one of the researchers, told ZDNet. "The scenarios that follow depend on how much trust was placed into the hardware security token," he added. "At minimum, I imagine it would enable 2FA bypasses and re-enable phishing attacks. However, if companies elected to use hardware security tokens to obviate passwords, it would allow direct user impersonation by attackers." Attacks aren't practical, and experts say the root cause relies in badly written documentation that may fool some implementers into supporting the old algorithms instead of newer and more solid ones. The FIDO Alliance was notified and has started work on updating its docs so it won't look like it's recommending ECDAA or RSASSA-PKCS1-v1_5. "PKCS1v1.5 is bad. The exploits are almost old enough to legally drink alcohol in the United States," Arciszewski said.' -- source: https://it.slashdot.org/story/18/09/10/0227233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Popular VPNs Contained Code Execution Security Flaws, Despite Patches
by Peter Reutemann 10 Sep '18

10 Sep '18

'Researchers have uncovered vulnerabilities in popular virtual private network (VPN) software, ProtonVPN and NordVPN, which can lead to the execution of arbitrary code by attackers. From a report: Last week, Cisco Talos security researchers said the security flaws, CVE-2018-3952 and CVE-2018-4010, permit code execution by attackers on Microsoft Windows machines. The vulnerabilities are similar to a Windows privilege escalation security flaw uncovered by VerSprite, which is tracked as CVE-2018-10169. Security patches were applied in April by both clients to resolve the original security hole, but according to Talos, "despite the fix, it is still possible to execute code as an administrator on the system." The initial vulnerability was caused by similar design issues in both clients. The interface for both NordVPN and ProtonVPN execute binaries with the permission of a logged-in user, and this includes the selection of a VPN configuration option, such as a desired VPN server location. This information is sent to a service when "connect" is clicked by way of an OpenVPN configuration file. However, VerSprite was able to create a crafted OpenVPN file which could be sent to the service, loaded, and executed.' -- source: https://yro.slashdot.org/story/18/09/10/118217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Nearly Half of American Households Will Own a Smart Speaker by 2019, Study Says
by Peter Reutemann 10 Sep '18

10 Sep '18

'Almost half of American households will have a smart speaker by next year, according to a new study from Adobe. From a report: The study, released Monday, finds that 32% of the country already owns a smart speaker and another 16% plan on getting one this holiday season. And just as importantly, people are using those speakers. "Technology trends come and go, but we think voice is here to stay," said Colin Morris, director of product management for Adobe Analytics, in a statement. "Consumers continue to embrace voice as a means to engage their devices and the Internet. It's a trend that has fundamentally changed the face of computing." A notable indicator of the growing popularity of the speakers is how comfortable people are talking to the device in front of others. And that number is on the rise: 72% of smart speaker owners say they use voice assistants in front of others. (Only 29% of people without a smart speaker are comfortable with doing so.)' -- source: https://tech.slashdot.org/story/18/09/10/1833235 I thought, that this would be of interest, due to our Alexa topic last month. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

9 Useful Examples of Touch Command in Linux
by Peter Reutemann 10 Sep '18

10 Sep '18

'Touch command in Linux is used for changing file timestamps however one of the most common usages of touch command includes creating a new empty file. With the touch command, you can change access, modify and change time of files and folders in Linux. You can update the timestamps or modify them to a date in the past.' -- source: https://linuxhandbook.com/touch-command/ To be honest, I only ever use it to create an empty file... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1