- wlug - list.wlug.org.nz

Microsoft Joins Group Working To 'Cure' Open-Source Licensing Issues
by Peter Reutemann 19 Mar '18

19 Mar '18

'Microsoft is joining Red Hat, Facebook, Google and IBM in committing to extending right to "cure" open source licensing noncompliance before taking legal measures. From a report: On March 19, officials from Microsoft -- along with CA Technologies, Cisco, HPE, SAP and SUSE -- said they'd work with open together with the already-committed vendors to provide more "predictability" for users of open source software. "The large ecosystems of projects using the GPLv2 and LGPLv2.x licenses will benefit from adoption of this more balanced approach to termination derived from GPLv3," explained Red Hat in a press release announcing the new license-compliance partners. The companies which have agreed to adopt the "Common Cure Rights Commitment" said before they file or continue to prosecute those accused of violating covered licenses, they will allow for users to cure and reinstate their licenses.' -- source: https://news.slashdot.org/story/18/03/19/1720228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When China Hoards Its Hackers Everyone Loses
by Peter Reutemann 18 Mar '18

18 Mar '18

'For over a decade Pwn2Own -- happening this week -- has brought together security talent from across the globe in a friendly hacking competition that is a cornerstone of research and advancement on par with Black Hat and Def Con. China's hackers routinely win, sweeping the board -- notably, the Tencent and Keen teams. Pwn2Own is good-natured, and all in the name of researchers finding big bugs, nabbing great bounties and drawing attention to security holes and zero-days that need to be fixed. But this year, according to Pwn2Own manager Brian Gorenc, China is no longer allowing its researchers to compete. Prior to the start of Pwn2Own this week, Gorenc told press "There have been regulatory changes in some countries that no longer allow participation in global exploit contests, such as Pwn2Own and Capture the Flag competitions." One thing's for certain: yearly champions Tencent's Keen Labs and Qihoo 360's 360Vulcan team are nowhere to be found and Trend Micro, the conference organizer, has confirmed to Engadget that there are no Chinese competitors in this year's competition. [...] It's a worrying development in the direction of isolationism and away from the benefits of competition in the spirit of improving security for all. It comes at a time when relations between the US and China strain under the weight of Huawei security concerns, which are not at all new, but are certainly coming to a head as American companies sever business ties with the firm.' -- source: https://it.slashdot.org/story/18/03/18/2042207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says
by Peter Reutemann 18 Mar '18

18 Mar '18

'For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."' -- source: https://it.slashdot.org/story/18/03/18/1930240 cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Community Considers a Crowd-Sourced Promo Video
by Peter Reutemann 17 Mar '18

17 Mar '18

'Slashdot reader Beacon11 writes that "Alan Pope, a community advocate for Ubuntu, has requested comments and ideas regarding the creation of a crowd-sourced promo video that, in 30 seconds, conveys that Ubuntu is for everyone." Alan Pope writes: So for example you might see a woman on a train typing an article, a guy in an office creating a presentation, a kid on the sofa playing a game with a controller on their TV, someone watching a film, someone developing code, kids playing with robots, a farmer planning animal feeding. You get the idea... So I'd really like to do this as a shared community project, with video clips submitted by Ubuntu users from around the world, perhaps even taking in a landmark or two here and there. I'd expect the video to represent the diversity of users, and variety of activities people are able to do with Ubuntu. Though they're currently just discussing its feasibility, Alan writes that "I think if we work together we could make something amazing."' -- source: https://news.slashdot.org/story/18/03/17/0524228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Journal "Reader's Choice Awards"
by Peter Reutemann 17 Mar '18

17 Mar '18

'The newly-relaunched Linux Journal is conducting its annual "Reader's Choice Awards," and this month announced the winners for Best Text Editor, Best Laptop, and Best Domain Registrar. Vim was chosen as the best editor by 35% of respondents, handily beating GNU Emacs (19%) Sublime Text (10%) and Atom (8%). Readers' Choice winner Vim is an extremely powerful editor with a user interface based on Bill Joy's 40-plus-year-old vi, but with many improved-upon features including extensive customization with key mappings and plugins. Linux Journal reader David Harrison points out another great thing about Vim "is that it's basically everywhere. It's available on every major platform." For best laptop their readers picked Lenovo (32%), followed by Dell (25%) and System76 (11%). The ThinkPad began life at IBM, but in 2005, it was purchased by Lenovo along with the rest of IBM's PC business. Lenovo evolved the line, and today the company is well known as a geek favorite. Lenovo's ThinkPads are quiet, fast and arguably have one of the best keyboards (fighting words!). Linux Journal readers say Lenovo's Linux support is excellent, leaving many to ponder why the company doesn't ship laptops with Linux installed. In February readers also voted on the best web browser, choosing Firefox (57%) over Chrome (17%) and Chromium (7%). And they also voted on the best Linux distribution, ultimately selecting Debian (33%), open SUSE (12%), and Fedora (11%).' -- source: https://linux.slashdot.org/story/18/03/17/0438256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel: Our Next Chips Won’t Have Data Leak Flaws We Told You Totally Not To Worry About
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<http://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/>: In public statements and private briefings to reporters and analysts, it has shifted from claiming these bugs are overblown and not a problem, to admitting they are a problem but are easy to mitigate, to confessing they are not so easy to mitigate but at least there are no ill effects, to conceding there are some ill effects but it's nothing to worry about, to finally confirming: the issues are so embarrassing, we've redesigned our processors to address the design blunders.

1 0

How A Norwegian Comment Section Turned Chaos Into Order—With A Simple Quiz
by Lawrence D'Oliveiro 16 Mar '18

16 Mar '18

<https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turn…>: "It was a basic idea," NRKbeta developer Ståle Grut told a South By Southwest crowd on Tuesday. "Readers had to prove they read a story before they were able to comment on it."

1 0

New Raspberry Pi - Model 3B+
by Ian Stewart 14 Mar '18

14 Mar '18

A new model of Raspberry Pi single board computer was appropriately released yesterday (...being the 14th day of the 3rd month of the year, or Pi Day 3.14) Its the latest revision of their third-generation single-board computers. This model 3B+ is an enhanced version of the 3B, which was released two years ago. Some details<https://www.raspberrypi.org/blog/raspberry-pi-3-model-bplus-sale-now-35/>, the technical data sheet<http://www.farnell.com/datasheets/2582162.pdf?_ga=2.61358060.1158065867.152…>, and a 7 minute youtube clip<https://www.youtube.com/watch?v=zQZxdiz2UAs> Raspberry Pi 3 Model B+ is now on sale for US$35, and features: A 1.4GHz 64-bit quad-core ARM Cortex-A53 CPU Dual-band 802.11ac wireless LAN and Bluetooth 4.2 Faster Ethernet (Gigabit Ethernet over USB 2.0) Power-over-Ethernet support (with separate PoE HAT) Improved PXE network and USB mass-storage booting Improved thermal management A Power-over-Ethernet (PoE<https://en.wikipedia.org/wiki/Power_over_Ethernet>) Hat is to be released shortly. The R-Pi will default to attempting to do a PXE boot over Ethernet. Thus the R-Pi may be positioned and operated at quite a long physical distance from what is its supply of power and from where it loads its operating system. The NZ on-line outlet of Element14<http://nz.element14.com/raspberry-pi/2773729/raspberry-pi-3-model-b/dp/2842…> have the R-Pi 3B+ available at NZ $51.52 + $7.73 GST = $59.25 What is a little strange is the R-Pi Zero-W, released over a year ago, is still not available in NZ from Element14. cheers, Ian.

2 2

GNOME 3.28 'Chongqing' Linux Is Here
by Peter Reutemann 14 Mar '18

14 Mar '18

'GNOME 3.28 is the latest version of GNOME 3, and is the result of 6 months' hard work by the GNOME community. It contains several major new features, as well as many smaller improvements and bug fixes. In total, the release incorporates 24105 changes, made by approximately 778 contributors. The Project explains, "GNOME 3.28 comes with more beautiful things! First, and most significantly, GNOME's default interface font (called Cantarell) has undergone a significant update. Character forms and spacing have been evolved, so that text is more readable and attractive. Several new weights have also been added -- light and extra bold -- which are being used to produce interfaces that are both modern and beautiful. Other beautiful things include GNOME's collection of background wallpapers, which has been updated to include a lovely set of photographs, and the selection of profile pictures, which has been completely updated with attractive new images to pick from." Unfortunately, you can't just click on a button and upgrade to GNOME 3.28 today. Actually, for the most part, you will need to wait for it to become available for your operating system. Sadly, this can take a while. Fedora users, for instance, will have to wait for a major OS upgrade for it to become available. ' -- source: https://linux.slashdot.org/story/18/03/14/1624227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Seems OK With Overt Cryptocurrency-Mining App
by Lawrence D'Oliveiro 14 Mar '18

14 Mar '18

<https://arstechnica.com/information-technology/2018/03/theres-a-currency-mi…>: In recent days, Calendar 2 developer Qbix endowed it with code that mines the digital coin known as Monero. The xmr-stack miner isn't supposed to run unless users specifically approve it in a dialog that says the mining will be in exchange for turning on a set of premium features. If users approve the arrangement, the miner will then run. Users can bypass this default action by selecting an option to keep the premium features turned off or to pay a fee to turn on the premium features. But there were one or two bugs that kept things from working smoothly. However, in an update to the article, it seems the developer has had second thoughts, and is removing the miner function from the app.

1 0