- wlug - list.wlug.org.nz

New Raspberry Pi - Model 3B+
by Ian Stewart 14 Mar '18

14 Mar '18

A new model of Raspberry Pi single board computer was appropriately released yesterday (...being the 14th day of the 3rd month of the year, or Pi Day 3.14) Its the latest revision of their third-generation single-board computers. This model 3B+ is an enhanced version of the 3B, which was released two years ago. Some details<https://www.raspberrypi.org/blog/raspberry-pi-3-model-bplus-sale-now-35/>, the technical data sheet<http://www.farnell.com/datasheets/2582162.pdf?_ga=2.61358060.1158065867.152…>, and a 7 minute youtube clip<https://www.youtube.com/watch?v=zQZxdiz2UAs> Raspberry Pi 3 Model B+ is now on sale for US$35, and features: A 1.4GHz 64-bit quad-core ARM Cortex-A53 CPU Dual-band 802.11ac wireless LAN and Bluetooth 4.2 Faster Ethernet (Gigabit Ethernet over USB 2.0) Power-over-Ethernet support (with separate PoE HAT) Improved PXE network and USB mass-storage booting Improved thermal management A Power-over-Ethernet (PoE<https://en.wikipedia.org/wiki/Power_over_Ethernet>) Hat is to be released shortly. The R-Pi will default to attempting to do a PXE boot over Ethernet. Thus the R-Pi may be positioned and operated at quite a long physical distance from what is its supply of power and from where it loads its operating system. The NZ on-line outlet of Element14<http://nz.element14.com/raspberry-pi/2773729/raspberry-pi-3-model-b/dp/2842…> have the R-Pi 3B+ available at NZ $51.52 + $7.73 GST = $59.25 What is a little strange is the R-Pi Zero-W, released over a year ago, is still not available in NZ from Element14. cheers, Ian.

2 2

GNOME 3.28 'Chongqing' Linux Is Here
by Peter Reutemann 14 Mar '18

14 Mar '18

'GNOME 3.28 is the latest version of GNOME 3, and is the result of 6 months' hard work by the GNOME community. It contains several major new features, as well as many smaller improvements and bug fixes. In total, the release incorporates 24105 changes, made by approximately 778 contributors. The Project explains, "GNOME 3.28 comes with more beautiful things! First, and most significantly, GNOME's default interface font (called Cantarell) has undergone a significant update. Character forms and spacing have been evolved, so that text is more readable and attractive. Several new weights have also been added -- light and extra bold -- which are being used to produce interfaces that are both modern and beautiful. Other beautiful things include GNOME's collection of background wallpapers, which has been updated to include a lovely set of photographs, and the selection of profile pictures, which has been completely updated with attractive new images to pick from." Unfortunately, you can't just click on a button and upgrade to GNOME 3.28 today. Actually, for the most part, you will need to wait for it to become available for your operating system. Sadly, this can take a while. Fedora users, for instance, will have to wait for a major OS upgrade for it to become available. ' -- source: https://linux.slashdot.org/story/18/03/14/1624227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0

Let’s Encrypt takes free “wildcard” certificates live
by Peter Reutemann 14 Mar '18

14 Mar '18

'In July of 2017, the nonprofit certificate authority Let's Encrypt promised to deliver something that would put secure websites and Web applications within reach of any Internet user: free "wildcard" certificates to enable secure HTTP connections for entire domains. Today, Let's Encrypt took that promised service live, in addition to a new version of the Automated Certificate Management Environment (ACME) protocol, an interface that can be used by a variety of client software packages to automate verification of certificate requests. ACME version 2 "has gone through the IETF standards process," said Josh Aas, executive director of the Internet Security Research Group (ISRG), the group behind Let's Encrypt, in a blog post on the release. ACME v2 is currently a draft Internet Engineering Task Force standard, so it may not yet be in its final form. But the current version is the result of significant feedback from the industry. And its use is required to obtain wildcard certificates. In addition to the ACME v2 requirement, requests for wildcard certificates require the modification of a Domain Name Service "TXT" record to verify control over the domain—a similar method to that used by Google and other service providers to prove domain ownership. But much of this can be automated by hosting providers that provide DNS services. A single Let's Encrypt account can request up to 300 wildcard certificates over a period of three hours, allowing a hosting provider to handle requests for customers who may not have shell access to their sites.' -- source: https://arstechnica.com/information-technology/2018/03/lets-encrypt-takes-f… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Rowan Schischka 13 Mar '18

13 Mar '18

>And yet here we are, watching prosecutorial discretion morph into >putting someone's head on a platter over recovery disks any one of us >could download hundreds of times from Microsoft's website without a >single murmur about "lost sales" from the tech giant. Just because something is available online without a fee does not mean it can be treated as public domain. The punishment may not appear to reasonably fit the crime, but this is what was laid out by lawmakers. I would hope a reasonable fine would be equivalent to what an OEM would profit from selling a disc. I worked in anti-piracy a few years back, I should have given a lecture on licensing while I was in Hamilton. Microsoft is very smart in taking money.

2 1

Researchers Find Critical Vulnerabilities in AMD's Ryzen and EPYC Processors, But They Gave the Chipmaker Only 24 Hours Before Making the Findings Public
by Peter Reutemann 13 Mar '18

13 Mar '18

'Alfred Ng, reporting for CNET: Researchers have discovered critical security flaws in AMD chips that could allow attackers to access sensitive data from highly guarded processors across millions of devices. Particularly worrisome is the fact that the vulnerabilities lie in the so-called secure part of the processors -- typically where your device stores sensitive data like passwords and encryption keys. It's also where your processor makes sure nothing malicious is running when you start your computer. CTS-Labs, a security company based in Israel, announced Tuesday that its researchers had found 13 critical security vulnerabilities that would let attackers access data stored on AMD's Ryzen and EPYC processors, as well as install malware on them. Ryzen chips power desktop and laptop computers, while EPYC processors are found in servers. The researchers gave AMD less than 24 hours to look at the vulnerabilities and respond before publishing the report. Standard vulnerability disclosure calls for 90 days' notice so that companies have time to address flaws properly. An AMD spokesperson said, "At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings," an AMD spokesman said. Zack Whittaker, a security reporter at CBS, said: Here's the catch: AMD had less than a day to look at the research. No wonder why its response is so vague.' -- source: https://it.slashdot.org/story/18/03/13/1558221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 59, 'By Far the Biggest Update Since Firefox 1.0', Arrives With Faster Page Loads and Improved Private Browsing
by Peter Reutemann 13 Mar '18

13 Mar '18

'Mozilla today launched Firefox 59 for Windows, Mac, Linux, and Android. The release builds on Firefox Quantum, which the company calls "by far the biggest update since Firefox 1.0 in 2004." Version 59 brings faster page load times, private browsing mode that strips path information, and Android Assist. In related news, Mozilla is giving Amazon Fire TV owners a new design later this week that lets them save their preferred websites by pinning them to the Firefox home screen. Enterprise users also have something to look forward to: On Wednesday, Firefox Quantum for Enterprise is entering the beta phase. Firefox 59 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.' -- source: https://tech.slashdot.org/story/18/03/13/1623251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN
by Peter Reutemann 13 Mar '18

13 Mar '18

'A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.' -- source: https://yro.slashdot.org/story/18/03/13/1836218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
by Peter Reutemann 12 Mar '18

12 Mar '18

'Stating with Firefox 60 -- expected to be released in May 2018 -- websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information. >From a report: Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs. But at the start of the month, Mozilla engineers decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default. This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors. The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.' -- source: https://news.slashdot.org/story/18/03/12/1641205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Helps Get A Computer Recycler Sentenced To 15 Months In Prison For Offering Unapproved Recovery Disks
by Lawrence D'Oliveiro 12 Mar '18

12 Mar '18

<https://www.techdirt.com/articles/20180223/17294539295/microsoft-helps-get-…>: Someone dedicates his life to keeping landfills free of harmful material and the government wants to send him to prison. And it's all based on Microsoft's assertion it would have sold as many recovery disks as Lundgren created if only Lundgren hadn't created them. Ignored is the fact they never were distributed. Also ignored is the dubiousness of "lost sales" assertions, which are always 100% conjecture and always presented as a simplistic equation: "1 Piracy = 1 Lost Sale." But in this case, no sales were lost because no sales were replaced with bootleg boot disks. And "sales" must be a legal term of art. Microsoft allows anyone to download a recovery disk for free. But in court, these are suddenly worth money because infringement. To ensure someone gets tossed in jail for breaking the chain of planned obsolescence, Microsoft (and prosecutors) want the court to believe the existence of recovery disks that do nothing unless a person already has a licensed copy of Windows has somehow made the company $700,000 poorer. Given the limitations of burned recovery disks, it's impossible to see where infringement even comes into play. And yet here we are, watching prosecutorial discretion morph into putting someone's head on a platter over recovery disks any one of us could download hundreds of times from Microsoft's website without a single murmur about "lost sales" from the tech giant.

1 0