- wlug - list.wlug.org.nz

Facebook is Pushing Its Data-tracking Onavo VPN Within Its Main Mobile App
by Peter Reutemann 14 Feb '18

14 Feb '18

'Onavo Protect, the VPN client from the data-security app maker acquired by Facebook back in 2013, has now popped up in the Facebook app itself, under the banner "Protect" in the navigation menu. Clicking through on "Protect" will redirect Facebook users to the "Onavo Protect -- VPN Security" app's listing on the App Store. We're currently seeing this option on iOS only, which may indicate it's more of a test than a full rollout here in the U.S. Marketing Onavo within Facebook itself could lead to a boost in users for the VPN app, which promises to warn users of malicious websites and keep information secure as you browse. But Facebook didn't buy Onavo for its security protections. Instead, Onavo's VPN allow Facebook to monitor user activity across apps, giving Facebook a big advantage in terms of spotting new trends across the larger mobile ecosystem. For example, Facebook gets an early heads up about apps that are becoming breakout hits; it can tell which are seeing slowing user growth; it sees which apps' new features appear to be resonating with their users, and much more. Further reading: Do Not, I Repeat, Do Not Download Onavo, Facebook's Vampiric VPN Service (Gizmodo).' -- source: https://tech.slashdot.org/story/18/02/13/2026211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Camera Makers Still Showing Zero Interest In Protecting Users With Built-In Encryption
by Lawrence D'Oliveiro 13 Feb '18

13 Feb '18

From <https://www.techdirt.com/articles/20180204/07404639150/camera-makers-still-…>: The Freedom of the Press Foundation sent a letter to major camera manufacturers in December 2016, letting them know filmmakers and journalists would appreciate a little assistance keeping their data out of governments' hands. ... We've covered many cases where police officers have seized phones/cameras and deleted footage captured by bystanders. ... Unfortunately, it doesn't look like camera manufacturers are considering offering encryption. The issue still doesn't even appear to be on their radar, more than a year after the Freedom of the Press Foundation's letter -- signed by 150 photographers and filmmakers -- indicated plenty of customers wanted better protection for their cameras. ... If a government can search something, it will. Encryption may not thwart all searches, but it will at least impede the most questionable ones.

1 0

meeting next month
by Peter Reutemann 13 Feb '18

13 Feb '18

Hi everyone At the last meeting, Ian suggested to have cryptocurrencies (https://en.wikipedia.org/wiki/Cryptocurrency) as topic for our meeting next month. One aspect is the increasing amount of power that is consumed in order to mine "coins". The other interesting aspect introduced by, but not limit to, cryptocurrencies is the concept of the blockchain (https://en.wikipedia.org/wiki/Blockchain) an open, distributed ledger of transactions. Is there interest? Any volunteers to talk about something regarding this topic (history, current status, etc)? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

That mega-vulnerability Cisco dropped is now under exploit
by Peter Reutemann 12 Feb '18

12 Feb '18

'Hackers are actively trying to exploit a high-severity vulnerability in widely used Cisco networking software that can give complete control over protected networks and access to all traffic passing over them, the company has warned. When Cisco officials disclosed the bug last week in a range of Adaptive Security Appliance products, they said they had no evidence anyone was actively exploiting it. Earlier this week, the officials updated their advisory to indicate that was no longer the case.' -- source: https://arstechnica.com/information-technology/2018/02/that-mega-vulnerabil… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VideoLAN VLC releases version 3.0 with HDR and 360-degree video
by Peter Reutemann 12 Feb '18

12 Feb '18

'The popular cross-platform, open-source video player VLC has received a significant update in 3.0, the first in what will be called the Vetinari branch. It adds support for HDR, including both 10-bit and 12-bit color and 360-degree video. This release version now also fully supports Chromecast streaming, a feature we first played with back in 2016. While VLC is open source, this part of it isn't; Tom's Hardware reports that VideoLAN explained it "used Google’s official closed-source SDK to build out the feature, which prevents it from releasing the source." [*] Other major added features include 3D audio support, audio passthrough for HD audio codecs, and support for browsing NAS drives. As always, a bunch of new codecs are supported too.' [*] 'Please note that Chromecast support in VLC 3.0 is fully open-source for all platforms! That’s the reason why it took us so long to ship as we completely reverse-engineered the entire thing. The closed-source component by Google can’t be used for legal reasons in VLC, isn’t compatible with Macs, Linux and Windows and supports a very limited set of codecs only. With our code, you can play basically anything VLC can decode on your Chromecast (as we transcode on-the-fly if needed).' -- source: https://arstechnica.com/gadgets/2018/02/videolan-vlc-releases-version-3-0-w… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

'Razer Doesn't Care About Linux'
by Peter Reutemann 12 Feb '18

12 Feb '18

'Razer is a vendor that makes high-end gaming hardware, including laptops, keyboards and mice. I opened a ticket with Razor a few days ago asking them if they wanted to support the LVFS project by uploading firmware and sharing the firmware update protocol used. I offered to upstream any example code they could share under a free license, or to write the code from scratch given enough specifications to do so. This is something I've done for other vendors, and doesn't take long as most vendor firmware updaters all do the same kind of thing; there are only so many ways to send a few kb of data to USB devices. The fwupd project provides high-level code for accessing USB devices, so yet-another-update-protocol is no big deal. I explained all about the LVFS, and the benefits it provided to a userbase that is normally happy to vote using their wallet to get hardware that's supported on the OS of their choice. I just received this note on the ticket, which was escalated appropriately: "I have discussed your offer with the dedicated team and we are thankful for your enthusiasm and for your good idea. I am afraid I have also to let you know that at this moment in time our support for software is only focused on Windows and Mac." The post, written by Richard -- who has long been a maintainer of GNOME Software, PackageKit, GNOME Packagekit, points out that Razer executive Min-Liang Tan last year invited Linux enthusiasts to suggest ideas to help the company make the best notebook that supports Linux.' -- source: https://linux.slashdot.org/story/18/02/12/0722235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How the First Open Source Software and Hardware Satellite UPSat Was Built
by Peter Reutemann 11 Feb '18

11 Feb '18

'UPSat is the first open source -- both hardware and software -- satellite to have ever been launched in orbit. Pierros Papadeas, the Director of Operations for Libre Space Foundation, which helped build the UPSat, talked about the project at FOSDEM, a non-commercial, volunteer-organized European event focused on free and open-source software development. You can watch the talk here; and read an interview of him with folks at FOSDEM ahead of the talk here. Two excerpts from the interview: Q: What challenges did you encounter while designing, building, testing and eventually launching UPSat in orbit? PP: The challenges where numerous, starting with the financial ones. Lack of appropriate funding led us to invest heavily in the project (through Libre Space Foundation funds) to ensure its successful completion. Countless volunteer participation was also key to the success. On the technical side, with minimal documentation and knowledge sharing around space projects we had to re-invent the wheel and discover many procedures and practices in a really short time-frame (6 months - unheard for a space mission). Lack of tools and equipment made our building process a creative exploration as we had to figure out ways to achieve specific tasks resorting to purpose-built projects in our local lab (hackerspace.gr). Testing and verification facilities where also a challenge mainly as we had to undergo much more extensive tests than other missions, having none of our components already "flight proven". Again creativity and countless hours of negotiations and documentation got us to the final delivery point. Launching UPSat in orbit was secured once the delivery happened, but as any typical space mission it came with long delays and timeline push-backs. Q: What do you hope to accomplish by giving this talk? What do you expect? Through this talk we would like to raise awareness for open source initiatives in space, and inspire open source technologists (engineers, programmers, analysts, makers) to engage in an open source project. We would also love to gather feedback and ideas on next steps and provide contribution opportunities for interested parties.' -- source: https://news.slashdot.org/story/18/02/11/2139203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EFF Founder John Perry Barlow Has Died At Age 70
by Peter Reutemann 08 Feb '18

08 Feb '18

'The Electronic Frontier Foundation reports that its founder, John Perry Barlow, has passed away quietly in his sleep this morning. He was 70 years old. From the report: It is no exaggeration to say that major parts of the Internet we all know and love today exist and thrive because of Barlow's vision and leadership. He always saw the Internet as a fundamental place of freedom, where voices long silenced can find an audience and people can connect with others regardless of physical distance. Barlow was sometimes held up as a straw man for a kind of naive techno-utopianism that believed that the Internet could solve all of humanity's problems without causing any more. As someone who spent the past 27 years working with him at EFF, I can say that nothing could be further from the truth. Barlow knew that new technology could create and empower evil as much as it could create and empower good. He made a conscious decision to focus on the latter: "I knew it's also true that a good way to invent the future is to predict it. So I predicted Utopia, hoping to give Liberty a running start before the laws of Moore and Metcalfe delivered up what Ed Snowden now correctly calls 'turn-key totalitarianism.'" Barlow's lasting legacy is that he devoted his life to making the Internet into "a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth... a world where anyone, anywhere may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity."' -- source: https://politics.slashdot.org/story/18/02/07/234213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Insurance Companies Recommending Computer Gear?
by Lawrence D'Oliveiro 07 Feb '18

07 Feb '18

A couple of big insurance outfits have made deals with Apple and Cisco to charge lower cybersecurity premiums to customers buying their gear <http://www.theregister.co.uk/2018/02/06/cisco_apple_allianz_aon_cyber_insur…>. I’m in favour (up to a point) of charging according to assessed risk, but basing it on specific brand names leaves them open to accusations of conflict of interest. Better it be done according to adherence to published nonproprietary standards, such as PCI-DSS, for example.

1 0

New IoT botnet offers DDoSes of once-unimaginable sizes for $20
by Peter Reutemann 02 Feb '18

02 Feb '18

'Organizers of a new botnet made up of infected home and small office routers are brazenly selling denial-of-service attacks of once unimaginable volumes for just $20 per target. Calling itself Los Calvos de San Calvicie, the group is advertising several services on this site. Among the services are distributed denial-of-service attacks of 290 to 300 gigabits per second for $20 each. While a third the size of some of the biggest recorded attacks, 290Gbps is still enough to bring most sites down unless they seek DDoS mitigation services, which in many cases cost considerable amounts of money. Just five years ago, 300Gbps was considered enough volume to shut down the Internet's core infrastructure. Los Calvos de San Calvicie members have been spotted assembling a botnet in recent days that very possibly has the firepower required to deliver the potent attacks promised. According to Pascal Geenens, a researcher at security firm Radware, the group is building the botnet by exploiting two vulnerabilities: one in RealTek routers running out-of-date firmware and the other in the Huawei HG532 router, where a patch released in December has yet to be installed by many users. Both vulnerabilities are also exploited by a different Internet-of-things botnet known as Satori.' -- source: https://arstechnica.com/information-technology/2018/02/for-sale-ddoses-guar… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0