- wlug - list.wlug.org.nz

E-Life In NZ
by Lawrence D'Oliveiro 25 Aug '18

25 Aug '18

The Herald website <https://www.nzherald.co.nz/> seems to be having trouble matching some of its headlines with subheads today. From the front page: * Man Hospitalised After Stuffing 15 Hard-Boiled Eggs Up His Bottom How many of these 'only-in-Auckland' dates have you been on? * Lizzie Marvelly: Haters, Trolls And Their Vile Words Kim Kardashian West is 'really proud' of her weight loss. Here's how she did it. * Why Restaurants Hate You The little Prince is getting a well-rounded education at his $38,000 a year school. * Six Reasons Why Superwoman Sucks Italian chef advises home cooks to reach for the most expensive varieties. * Ex-Playboy Model Found Strangled In Her Home Kyle MacDonald on whether or not the term applies to our Prime Minister. Interestingly, all of these are from the “Lifestyle” section.

1 0

“The following packages have been kept back:”
by Peter Reutemann 23 Aug '18

23 Aug '18

Every now and then, I get the message from "apt-get upgrade", that: “The following packages have been kept back:” The following answer on "ask ubuntu" explains this nicely and also several solutions to install these packages after all: https://askubuntu.com/questions/601/the-following-packages-have-been-kept-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel's Reworked Microcode Security Fix License No Longer Prohibits Benchmarking
by Peter Reutemann 23 Aug '18

23 Aug '18

'Intel has backtracked on the license for its latest microcode update that mitigates security vulnerabilities in its processors -- after the previous wording outlawed public benchmarking of the chips. The reason for Intel's insistence on a vow of silence is that -- even with the new microcode in place -- turning off hyper-threading is necessary to protect virtual machines from attack via Foreshadow -- and that move comes with a potential performance hit. Predictably, Intel's contractual omerta had the opposite effect and drew attention to the problem. "Performance is so bad on the latest Spectre patch that Intel had to prohibit publishing benchmarks," said Lucas Holt, MidnightBSD project lead, via Twitter. In response to the outcry, Intel subsequently said it would rewrite the licensing terms. And now the fix is in. Via Twitter, Imad Sousou, corporate VP and general manager of Intel Open Source Technology Center, on Thursday said: "We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here. As an active member of the open source community, we continue to welcome all feedback and thank the community." The reworked license no longer prohibits benchmarking. Long-time Slashdot reader and open-source pioneer, Bruce Perens, first brought Intel's microcode update to our attention. In a phone interview with The Register, Perens said he approved of the change. "This is a relatively innocuous license for proprietary software and it can be distributed in the non-free section of Debian, which is where is used to be, and it should be distributable by other Linux distributions," he said. "You can't expect every lawyer to understand CPUs. Sometimes they have to have a deep conversation with their technical people."' -- source: https://it.slashdot.org/story/18/08/23/2041206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Publishes Microcode Security Patches With No Benchmarks Or Profiling Allowed
by Peter Reutemann 23 Aug '18

23 Aug '18

'The Register reports that Debian is rejecting a new Intel microcode update because of a new license term prohibiting the use of the CPU for benchmarks and profiling. There is a new license term applied to the new microcode: "You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results."' -- source: https://linux.slashdot.org/story/18/08/22/2213233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostscript Leaks Like A Sieve
by Lawrence D'Oliveiro 23 Aug '18

23 Aug '18

Tools like ImageMagick commonly accept graphics in PostScript format, which they render through Ghostscript. Trouble is, there are holes in Ghostscript that can be exploited by malicious parties. In short, you should not be accepting PostScript data from untrusted parties. The fact that PostScript is a full programming language just makes it harder -- in terms of vulnerability exposure, it’s similar to JavaScript, except that I think a lot more effort has gone into securing the latter. <https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/>

1 0

Mozilla to Remove Legacy Firefox Add-Ons From Add-On Portal in Early October
by Peter Reutemann 22 Aug '18

22 Aug '18

'Mozilla announced today plans to remove all Firefox legacy add-ons from the official Mozilla add-ons portal in early October. From a report: The move comes after Mozilla updated the Firefox core to use a new add-ons system based on the Chrome-compatible WebExtensions API. This new add-ons API replaced Firefox's old XUL-based add-ons API in November 2017, with the release of Firefox 57. All Firefox legacy add-ons stopped working in Firefox 57, but Mozilla continued to support them in the Firefox Extended Support Release (ESR) 52 branch. Support for Firefox ESR 52 will end on September 5, in two weeks, meaning there won't be any official Firefox version that supports legacy add-ons anymore.' -- source: https://tech.slashdot.org/story/18/08/21/196225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting on Monday
by Peter Reutemann 21 Aug '18

21 Aug '18

Hi everyone We have a meeting coming up on Monday: "Linux is Alexa's best mate" Brendon Ranum, owner of a voice driven highly automated accommodation business in Cambridge, discusses Alexa integration from a Linux User perspective. Brendon will bring along his collection of every Amazon Echo ever made (10 models), and talk about adding voice control in front of home automation, the pitfalls, and how a spare Raspberry Pi can be used to solve some of them. He will also demo creating and using Echo Skills, compare differences in features of the Echo's in different countries, and share how guests attitudes have changed over the last year using Alexa. Usually found leading large scale IT change & innovation overseas, Brendon never lost his passion for electrical and electronic engineering and love of shiny things. Come along and learn why someone would put 20 of these in a house! -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737178/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Online Exam Requires Microsoft Office 365, Laptops, No Chargers Allowed
by Lawrence D'Oliveiro 20 Aug '18

20 Aug '18

Some students are Botany Downs Secondary College are upset at their school’s requirements for them to set the NCEA Level 1 science exam <https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12110032>. Their problem is with the ban on chargers, because the school says they cannot provide outlets for 450 students. So laptops have to have a 5-hour battery life to make it through the exam. Which leaves out older machines with batteries in less-than-tiptop condition. Would there be a problem allowing them spare batteries? (And temporary use of an outlet while switching over, to avoid the need to power down?) Come to think of it, do they know they can buy spare batteries?

1 0

Slides Worth Viewing
by Lawrence D'Oliveiro 15 Aug '18

15 Aug '18

Followed this link <https://twitter.com/thepacketrat/status/1029728686734565382> which doesn’t seem to relate to the article that included it, but which has some gems on IoT security worth repeating: Assumptions of Technological Manifest Destiny: 1. Technology is value-neutral and thus will automatically help everyone 2. Technology should be deployed as quickly as possible 3. History is uninteresting and unhelpful The Value of Scepticism In three words: Think before deploying. In two words: Think first. In one word: Don’t. Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? A: Because Keynote Speakers Make Bad Life Decisions And Are Poor Role Models.

1 0

Standardizing The Legalities Of Reporting Security Bugs
by Lawrence D'Oliveiro 03 Aug '18

03 Aug '18

Security researchers often find themselves in for a rough ride (legally speaking) when they try to report holes that they have found. This new effort <https://arstechnica.com/information-technology/2018/08/new-open-source-effo…> tries to put together a clear framework so everybody knows exactly where they stand. Of course, the next step is to get various organizations to adopt it.

1 0