- wlug - list.wlug.org.nz

AMD promises firmware fixes for security processor bugs
by Peter Reutemann 20 Mar '18

20 Mar '18

'AMD has responded to the reports last week of a range of security flaws affecting its Platform Security Processor (PSP) and chipset. The company acknowledges the bugs and says that, in coming weeks, it will have new firmware available to resolve the PSP bugs. These firmware fixes will also mitigate the chipset bugs.' -- source: https://arstechnica.com/gadgets/2018/03/amd-promises-firmware-fixes-for-sec… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IBM Unveils the 'World's Smallest Computer'
by Peter Reutemann 19 Mar '18

19 Mar '18

'On the first day of IBM Think 2018, the company's flagship conference, IBM has unveiled what it claims is the world's smallest computer. It's smaller than a grain of salt and features the computer power of the x86 chip from 1990. Mashable first spotted this gem: The computer will cost less than ten cents to manufacture, and will also pack "several hundred thousand transistors," according to the company. These will allow it to "monitor, analyze, communicate, and even act on data." It works with blockchain. Specifically, this computer will be a data source for blockchain applications. It's intended to help track the shipment of goods and detect theft, fraud, and non-compliance. It can also do basic AI tasks, such as sorting the data it's given. According to IBM, this is only the beginning. "Within the next five years, cryptographic anchors -- such as ink dots or tiny computers smaller than a grain of salt -- will be embedded in everyday objects and devices," says IBM head of research Arvind Krishna. If he's correct, we'll see way more of these tiny systems in objects and devices in the years to come. It's not clear yet when this thing will be released -- IBM researchers are currently testing its first prototype. ' -- source: https://hardware.slashdot.org/story/18/03/19/210245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 19 'Tara' Cinnamon Will Be Faster
by Peter Reutemann 19 Mar '18

19 Mar '18

'Mint developers say they feel the app-launching time on the Linux distro seemed slow when using the Cinnamon desktop environment. So, they are working on fixing it. BetaNews reports: Windows build time was four times slower with Cinnamon compared to Metacity, while recovery time was nearly four times slower too. So yes, app-launching on Cinnamon -- as of today -- is slow comparatively. The big benefit to pinpointing a problem, however, is that it is the first step in solving it. And so, Linux Mint 19 Cinnamon will be faster as a result. "We developed a little script and a method to measure how long it took to flood the desktop environment with the creation of 200 windows. We could then measure the time reported by the script to build these 200 windows, and the time it actually took the desktop environment to recover from it and have these windows placed/mapped correctly and ready to be interacted with. Both measures were significantly higher in Cinnamon than in other desktops," says The Linux Mint Team.' -- source: https://linux.slashdot.org/story/18/03/19/1648259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Joins Group Working To 'Cure' Open-Source Licensing Issues
by Peter Reutemann 19 Mar '18

19 Mar '18

'Microsoft is joining Red Hat, Facebook, Google and IBM in committing to extending right to "cure" open source licensing noncompliance before taking legal measures. From a report: On March 19, officials from Microsoft -- along with CA Technologies, Cisco, HPE, SAP and SUSE -- said they'd work with open together with the already-committed vendors to provide more "predictability" for users of open source software. "The large ecosystems of projects using the GPLv2 and LGPLv2.x licenses will benefit from adoption of this more balanced approach to termination derived from GPLv3," explained Red Hat in a press release announcing the new license-compliance partners. The companies which have agreed to adopt the "Common Cure Rights Commitment" said before they file or continue to prosecute those accused of violating covered licenses, they will allow for users to cure and reinstate their licenses.' -- source: https://news.slashdot.org/story/18/03/19/1720228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When China Hoards Its Hackers Everyone Loses
by Peter Reutemann 18 Mar '18

18 Mar '18

'For over a decade Pwn2Own -- happening this week -- has brought together security talent from across the globe in a friendly hacking competition that is a cornerstone of research and advancement on par with Black Hat and Def Con. China's hackers routinely win, sweeping the board -- notably, the Tencent and Keen teams. Pwn2Own is good-natured, and all in the name of researchers finding big bugs, nabbing great bounties and drawing attention to security holes and zero-days that need to be fixed. But this year, according to Pwn2Own manager Brian Gorenc, China is no longer allowing its researchers to compete. Prior to the start of Pwn2Own this week, Gorenc told press "There have been regulatory changes in some countries that no longer allow participation in global exploit contests, such as Pwn2Own and Capture the Flag competitions." One thing's for certain: yearly champions Tencent's Keen Labs and Qihoo 360's 360Vulcan team are nowhere to be found and Trend Micro, the conference organizer, has confirmed to Engadget that there are no Chinese competitors in this year's competition. [...] It's a worrying development in the direction of isolationism and away from the benefits of competition in the spirit of improving security for all. It comes at a time when relations between the US and China strain under the weight of Huawei security concerns, which are not at all new, but are certainly coming to a head as American companies sever business ties with the firm.' -- source: https://it.slashdot.org/story/18/03/18/2042207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says
by Peter Reutemann 18 Mar '18

18 Mar '18

'For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."' -- source: https://it.slashdot.org/story/18/03/18/1930240 cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Community Considers a Crowd-Sourced Promo Video
by Peter Reutemann 17 Mar '18

17 Mar '18

'Slashdot reader Beacon11 writes that "Alan Pope, a community advocate for Ubuntu, has requested comments and ideas regarding the creation of a crowd-sourced promo video that, in 30 seconds, conveys that Ubuntu is for everyone." Alan Pope writes: So for example you might see a woman on a train typing an article, a guy in an office creating a presentation, a kid on the sofa playing a game with a controller on their TV, someone watching a film, someone developing code, kids playing with robots, a farmer planning animal feeding. You get the idea... So I'd really like to do this as a shared community project, with video clips submitted by Ubuntu users from around the world, perhaps even taking in a landmark or two here and there. I'd expect the video to represent the diversity of users, and variety of activities people are able to do with Ubuntu. Though they're currently just discussing its feasibility, Alan writes that "I think if we work together we could make something amazing."' -- source: https://news.slashdot.org/story/18/03/17/0524228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal "Reader's Choice Awards"
by Peter Reutemann 17 Mar '18

17 Mar '18

'The newly-relaunched Linux Journal is conducting its annual "Reader's Choice Awards," and this month announced the winners for Best Text Editor, Best Laptop, and Best Domain Registrar. Vim was chosen as the best editor by 35% of respondents, handily beating GNU Emacs (19%) Sublime Text (10%) and Atom (8%). Readers' Choice winner Vim is an extremely powerful editor with a user interface based on Bill Joy's 40-plus-year-old vi, but with many improved-upon features including extensive customization with key mappings and plugins. Linux Journal reader David Harrison points out another great thing about Vim "is that it's basically everywhere. It's available on every major platform." For best laptop their readers picked Lenovo (32%), followed by Dell (25%) and System76 (11%). The ThinkPad began life at IBM, but in 2005, it was purchased by Lenovo along with the rest of IBM's PC business. Lenovo evolved the line, and today the company is well known as a geek favorite. Lenovo's ThinkPads are quiet, fast and arguably have one of the best keyboards (fighting words!). Linux Journal readers say Lenovo's Linux support is excellent, leaving many to ponder why the company doesn't ship laptops with Linux installed. In February readers also voted on the best web browser, choosing Firefox (57%) over Chrome (17%) and Chromium (7%). And they also voted on the best Linux distribution, ultimately selecting Debian (33%), open SUSE (12%), and Fedora (11%).' -- source: https://linux.slashdot.org/story/18/03/17/0438256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel: Our Next Chips Won’t Have Data Leak Flaws We Told You Totally Not To Worry About
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<http://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/>: In public statements and private briefings to reporters and analysts, it has shifted from claiming these bugs are overblown and not a problem, to admitting they are a problem but are easy to mitigate, to confessing they are not so easy to mitigate but at least there are no ill effects, to conceding there are some ill effects but it's nothing to worry about, to finally confirming: the issues are so embarrassing, we've redesigned our processors to address the design blunders.

1 0

How A Norwegian Comment Section Turned Chaos Into Order—With A Simple Quiz
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turn…>: "It was a basic idea," NRKbeta developer Ståle Grut told a South By Southwest crowd on Tuesday. "Readers had to prove they read a story before they were able to comment on it."

1 0