- wlug - list.wlug.org.nz

Download Bomb Trick Returns in Chrome -- Also Affects Firefox, Opera, Vivaldi and Brave
by Peter Reutemann 03 Jul '18

03 Jul '18

'The release of Google Chrome 67 has reopened a "download bomb" bug that was exploited by tech support scammers last winter, and which had been fixed with the release of Chrome 65 in March 2018. Furthermore, the issue also appears to affect other browsers as well, such as Firefox, Vilvadi, Opera, and Brave, according to tests carried out by Bleeping Computer. The "download bomb" trick is a technique that involves initiating hundreds or thousands of downloads to freeze a browser on a specific page. Across the years, there have been multiple variations of download bombs, and they have often been used by tech support scammers to trap users on shady sites that tried to lure victims into calling a tech support number to have their browser unlocked. Over the winter, security researchers from Malwarebytes noticed a tech support scam campaign that employed a new "download bomb" technique to trap users on its shady sites.' -- source: https://news.slashdot.org/story/18/07/03/1416208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Study Finds That a Large Number of Popular Android Apps Secretly Cast the Screen To Third Parties, But They Don't Listen To Conversations
by Peter Reutemann 03 Jul '18

03 Jul '18

'It's the smartphone conspiracy theory that just won't go away: Many, many people are convinced that their phones are listening to their conversations to target them with ads. [...] Some computer science academics at Northeastern University had heard enough people talking about this technological myth that they decided to do a rigorous study to tackle it. For the last year, Elleen Pan, Jingjing Ren, Martina Lindorfer, Christo Wilson, and David Choffnes ran an experiment involving more than 17,000 of the most popular apps on Android to find out whether any of them were secretly using the phone's mic to capture audio. The apps included those belonging to Facebook, as well as over 8,000 apps that send information to Facebook. Sorry, conspiracy theorists: They found no evidence of an app unexpectedly activating the microphone or sending audio out when not prompted to do so. Like good scientists, they refuse to say that their study definitively proves that your phone isn't secretly listening to you, but they didn't find a single instance of it happening. Instead, they discovered a different disturbing practice: apps recording a phone's screen and sending that information out to third parties.' -- source: https://yro.slashdot.org/story/18/07/03/1822250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Allows Outside App Developers To Read People's Gmails, Says Report
by Peter Reutemann 03 Jul '18

03 Jul '18

'According to The Wall Street Journal, hundreds of app developers have access to millions of inboxes belonging to Gmail users (Warning: source paywalled; alternative source). The developers reportedly receive access to messages from Gmail users who signed up for things like price-comparison services or automated travel-itinerary planners. Some of these companies train software to scan the email, while others enable their workers to pore over private messages. INSIDER reports: It's not news that Google and many top email providers enable outside developers to access users' inboxes. In most cases, the people who signed up for the price-comparison deals or other programs agreed to provide access to their inboxes as part of the opt-in process. In Google's case, outside developers must pass a vetting process, and as part of that, Google ensures they have an acceptable privacy agreement, The Journal reported, citing a Google representative. What is unclear is how closely these outside developers adhere to their agreements and whether Google does anything to ensure they do, as well as whether Gmail users are fully aware that individual employees may be reading their emails, as opposed to an automated system, the report says. It's interesting to note that, judging from The Journal's story, very little indicates that Google is doing anything different from Microsoft or other top email providers. According to the newspaper, nothing in Microsoft or Yahoo's policy agreements explicitly allows people to read others' emails. ' -- source: https://yro.slashdot.org/story/18/07/02/2057256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Micro Focus Sells SUSE
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

<https://www.theregister.co.uk/2018/07/02/linux_makes_suse_sold_for_a_cool_2…>: Micro Focus CEO Chris Hsu subsequently decided that spending time with his family seemed more fun than piloting a juggernaut made of more offcuts than a cut-and-shut Ford Fiesta from Honest Bob's Motors. ... However, SUSE was a bright spot in the gloom, showing revenues of $164.4m and a solid, if unexciting, growth rate of 13.1 per cent in the six months to October 2017. ... For its part, SUSE is pretty happy with the deal. It will retain its CEO, Nils Brauckman, who seemed pleased to be free of Micro Focus ...

1 0

Metric-Compatible Fonts
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

I was idly doing some web searches the other day (as you do), and stumbled across this page <https://wiki.archlinux.org/index.php/Metric-compatible_fonts> at the ever-dependable Arch Wiki. My specific question was, what had happened to the “URW Palladio” font? Up until recently, this was the one that Fontconfig would offer up when I used the old “Palatino” name from Adobe PostScript days. (I used to like the way the curve of the “P” didn’t quite join up with the stem, but left a little gap with a pointy bit on the end. Ahem...) Turns out it’s still there, just under another name; it’s now called “P052” for some unfathomable reason. Anyway, that page gives a bunch of handy alternatives if you are looking for Free alternatives to proprietary fonts that preserve the metrics (widths, spacing etc), so substituting them won’t stuff up the formatting of a document.

1 0

'Why You Should Not Use Google Cloud'
by Peter Reutemann 02 Jul '18

02 Jul '18

'A user on Medium named "Punch a Server" says you should not use Google Cloud due to the "'no-warnings-given, abrupt way' they pull the plug on your entire system if they (or the machines) believe something is wrong." The user has a project running in production on Google Cloud (GCP) that is used to monitor hundreds of wind turbines and scores of solar plants scattered across 8 countries. When their project goes down, money is lost. An anonymous Slashdot reader shares the report: Early today morning (June 28, 2018) I receive an alert from Uptime Robot telling me my entire site is down. I receive a barrage of emails from Google saying there is some "potential suspicious activity" and all my systems have been turned off. EVERYTHING IS OFF. THE MACHINE HAS PULLED THE PLUG WITH NO WARNING. The site is down, app engine, databases are unreachable, multiple Firebases say I've been downgraded and therefore exceeded limits. Customer service chat is off. There's no phone to call. I have an email asking me to fill in a form and upload a picture of the credit card and a government issued photo id of the card holder. Great, let's wake up the CFO who happens to be the card holder. What if the card holder is on leave and is unreachable for three days? We would have lost everything -- years of work -- millions of dollars in lost revenue. I fill in the form with the details and thankfully within 20 minutes all the services started coming alive. The first time this happened, we were down for a few hours. In all we lost everything for about an hour. An automated email arrives apologizing for "inconvenience" caused. Unfortunately The Machine has no understanding of the "quantum of inconvenience" caused.' -- source: https://news.slashdot.org/story/18/07/01/0354200 The cloud is convenient, as you don't have to look after your own hardware and it allows you to add more processing power as needed. But this is a good example of why your own hardware might not be a bad idea... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

PB Tech Used Trade Me Data For Spam
by Lawrence D'Oliveiro 02 Jul '18

02 Jul '18

From <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120816…>: PB Tech has signed an enforceable undertaking with the [Department of Internal Affairs] after it was found to have collected Trade Me customer details during trades and then sent them unsolicited messages. This was in breach of the Unsolicited Electronic Messages Act.

1 0

Massive New 'Salesforce Tower' Light Sculpture: AI, Ubuntu, Fog, and a MacBook
by Peter Reutemann 30 Jun '18

30 Jun '18

'The new tallest building on the San Francisco skyline -- and the tallest building in America west of the Mississippi -- includes a nine-story electronic sculpture that's been called the tallest piece of public art on Earth. It uses 11,000 LED bulbs reflected off the tower-topping aluminum panels -- each pixel created by a set of red, green, blue and white lights controlled by 8-bit PIC microcontrollers. "On a clear night, the show is visible for 30 miles," reports IEEE Spectrum. Slashdot reader Tekla Perry shares their article about "the technology involved in the light show at the top of Salesforce Tower. Electrical engineer and artist Jim Campbell explains it all -- and how the window-washer problem stumped him for nearly a year." "[O]n the 62nd floor, a central PC-based computer runs Ubuntu Linux, sending instructions to a communications control system that splits the data and sends it at 11 Mbit to the 32 enclosures using a custom communications protocol... We will capture images throughout the day, sending them to Amazon's cloud, and run some algorithms designed to identify visual interesting-ness. For example, at its simplest, when we look at the sky, if it's all blue, it's boring, if it's all white, it's boring, if it has white and blue it is likely to be interesting. We'll chose the best half hour of the day at each camera, based on movement and color, to display...." And finally, when the main display shuts down late at night, another system designed by Campbell will kick in. In this static display, a set of 36 white LEDs will create a three-dimensional constellation of lights that will look like stars. "It's quieter, it has a random aspect to it," he says. "Since construction started, the tower has emerged as an icon of the new San Francisco -- techie, ambitious, perhaps a little grandiose," writes the New Yorker, capturing the moment when Campbell finally unveiled his four-year project -- while fighting stomach flu and a chest cold, on a night which turned out to be prohibitively foggy. The executive vice-president of Boston Properties told him cheerily, "Jim! Look on the brighter side. We've got every night for the rest of our lives." "There was a long silence from the people on the terrace. The fog was thick. At last, someone exclaimed, 'Woo-hoo!,' and a volley of cheers followed." Although the colors they were seeing came from the celebratory fireworks and not from Jim's light sculpture. Are there any San Francisco-area Slashdotters who want to weigh in on the Salesforce Tower?' -- source: https://tech.slashdot.org/story/18/06/30/2031224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

It’s Not A Bug, It’s A Feature!
by Lawrence D'Oliveiro 30 Jun '18

30 Jun '18

The IndexByDate.txt files available on the various Bitsavers directories (e.g. <http://bitsavers.trailing-edge.com/pdf/>) list the various items available in order of date. But if you want them ordered by name, so items in the same directory come together, the logical thing to do is use the sort(1) <https://linux.die.net/man/1/sort> command on this file. You specify the sort key by a “field definition”. The man page says that, by default, each field starts at a non-whitespace character after whitespace. The file has a very regular format: splitting by whitespace, you get the date, the time, and then the pathname. So a command like sort -k3 IndexByDate.txt should work. Except I was seeing a sequence like this: 2006-08-17 22:17:12 ge/MarkI_Timesharing/IPC-202646_FORTRAN_Aug66.pdf 2012-08-29 02:26:21 generalAutomation/18_30/88A00026A-A_GA1830_Industrial_Supervisory_System_Reference_Manual_May69.pdf ... 2018-05-16 00:33:35 georgiaTech/GTL_Programmers_Reference_Manual_for_the_Burroughs_B_5500_Aug1974.pdf 2006-08-27 11:36:57 ge/PAC-4000/GET-3201B_PAC-4000_SysMan_Mar66.pdf As you can see, the “ge” section is interrupted by “generalAutomation” and others, and then resumes after them. What was going on? It took me a while to realize that the sorting is done by locale, and the locale setting is set to ignore the slashes. Thus, the above sequence is effectively “gem” followed by “gen”, then “geo” and “gep”. What I wanted was a straight ASCII sort on the full pathname, without regard to any locale settings. But there is no hint in the man page as to how to specify this. Then I realized: the locale is controlled by environment variables. If you want the “non-localized” locale, then specify the locale called “C”, thus: LC_ALL=C sort -k3 IndexByDate.txt and this gives the order I want.

1 0

Linux Mint 19 'Tara' Released
by Peter Reutemann 30 Jun '18

30 Jun '18

'Linux Mint, the maker of popular Linux distro, announced on Friday the general availability of a new version of their operating system. Called Linux Mint 19 "Tara", the new version offers a range of new features, improvements, and a promise that it would stick around for a while. Writing for BetaNews, Brian Fagioli: The most significant aspect of Linux Mint 19 is the new Ubuntu 18.04 LTS base. Tara will receive updates until 2023 -- very impressive. The kernel is at 4.15, and all three desktop environments are being updated too. Mate is now at version 1.2, Cinnamon gets bumped up to 3.8, and Xfce is updated to 4.12. In Linux Mint 19, the star of the show is Timeshift, said, Clement Lefebvre, Linux Mint Project Leader. Although it was introduced in Linux Mint 18.3 and backported to all Linux Mint releases, it is now at the center of Linux Mint's update strategy and communication, he added. Thanks to Timeshift you can go back in time and restore your computer to the last functional system snapshot. If anything breaks, you can go back to the previous snapshot and it's as if the problem never happened.' -- source: https://linux.slashdot.org/story/18/06/29/2041255 Cheers, Petre -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2