- wlug - list.wlug.org.nz

Fighting Ransomware
by Lawrence D'Oliveiro 15 Jan '18

15 Jan '18

No More Ransom <https://www.schneier.com/blog/archives/2018/01/fighting_ransom.html> is a joint project between Europol, the Dutch police, Kaspersky and McAfee to offer a central repository of bypasses for ransomware. Mainly good against older strains, but it should still help prevent lightening a few pocketbooks ...

1 0

20 Years Later, Has Open Source Changed the World?
by Peter Reutemann 15 Jan '18

15 Jan '18

'"Most code remains closed and proprietary, even though open source now dominates enterprise platforms," notes Matt Asay, former COO at Canonical (and an emeritus board member of the Open Source Initiative). "How can that be?" he asks, in an essay noting it's been almost 20 years since the launch of the Open Source Initiative, arguing that so far open source "hasn't changed the world as promised." [T]he reason most software remains locked up within the four walls of enterprise firewalls is that it's too costly with too small of an ROI to justify open-sourcing it. At least, that's the perception. Such a perception is impossible to break without walking the open source path, which companies are unwilling to walk without upfront proof. See the problem? This chicken-and-egg conundrum is starting to resolve itself, thanks to the forward-looking efforts of Google, Facebook, Amazon, and other web giants that are demonstrating the value of open-sourcing code. Although it's unlikely that a State Farm or Chevron will ever participate in the same way as a Microsoft, we are starting to see companies like Bloomberg and Capital One get involved in open source in ways they never would have considered back when the term "open source" was coined in 1997, much less in 2007. It's a start. Let's also not forget that although we have seen companies use more open source code over the past 20 years, the biggest win for open source since its inception is how it has changed the narrative of how innovation happens in software. We're starting to believe, and for good reason, that the best, most innovative software is open source. The article strikes a hopeful note. "We're now comfortable with the idea that software can, and maybe should, be open source without the world ending. The actual opening of that source, however, is something to tackle in the next 20 years.' -- source: https://news.slashdot.org/story/18/01/14/1627207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Meltdown and Spectre Patches Bricking Ubuntu 16.04 Computers
by Peter Reutemann 10 Jan '18

10 Jan '18

'Ubuntu Xenial 16.04 users who updated to receive the Meltdown and Spectre patches are reporting they are unable to boot their systems and have been forced to roll back to an earlier Linux kernel image. The issues were reported by a large number of users on the Ubuntu forums and Ubuntu's Launchpad bug tracker. Only Ubuntu users running the Xenial 16.04 series appear to be affected. All users who reported issues said they were unable to boot after upgrading to Ubuntu 16.04 with kernel image 4.4.0-108. Canonical, the company behind Ubuntu OS, deployed Linux kernel image 4.4.0-108 as part of a security update for Ubuntu Xenial 16.04 users, yesterday, on January 9. According to Ubuntu Security Notice USN-3522-1 and an Ubuntu Wiki page, this was the update that delivered the Meltdown and Spectre patches.' -- source: https://news.slashdot.org/story/18/01/10/1634215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Germany Ban On Online Hate Speech Triggers Debate
by Lawrence D'Oliveiro 10 Jan '18

10 Jan '18

A new law has come into effect in Germany whereby companies like Facebook and Twitter face multi-million-euro fines if they don’t block their users from expressing “hate speech” <http://www.aljazeera.com/news/2018/01/germany-ban-online-hate-speech-trigge…>. Trouble is, this law seems to be a bit of a blunt axe: on the one hand it led to the temporary suspension of the Twitter account of the deputy leader of the far-right AfD party, Beatrix von Storch. But also caught up in the net was the account of the satirical “Titanic” magazine, after it parodied a phrase used by von Storch. Then again, if you are seen to clamp down too hard on particular points of view, that gives political ammunition to those who claim they are being censored...

1 0

Re-Assembling Shredded Stasi Records
by Lawrence D'Oliveiro 09 Jan '18

09 Jan '18

During the last days of the German Democratic Republic (a.k.a. East Germany), the Stasi secret police tried to destroy the more incriminating records they had been keeping on their own citizens. They were only partially successful. And even then, there has been an ongoing project to reassemble those torn-up pieces of paper, by scanning them and doing pattern-recognition to match up the image pieces. Seems the easiest ones are fairly manageable, but now they are getting to smaller fragments, which are proving more of a challenge. <https://www.techdirt.com/articles/20180105/07120838936/stasis-tiny-torn-up-…>

1 0

Another Fork Takes Over The Original Project
by Lawrence D'Oliveiro 08 Jan '18

08 Jan '18

Open-source software projects can fork for various reasons. Sometimes a bunch of developers want to go in a different direction. Other times the original project appears to be languishing, but those in charge are reluctant to give up control. Sometimes the forks peter out, other times they coexist happily (or unhappily) with the original project, occasionally they even absorb the original project. This <http://www.theregister.co.uk/2018/01/08/lede_and_openwrt_merge/> seems to be one of the latter cases: the LEDE fork of OpenWRT is merging back in, but the merger will be “governed under the rules of the LEDE project”.

1 0

Can You Install Linux On a 1993 PC?
by Peter Reutemann 07 Jan '18

07 Jan '18

'The oldest x86 CPU that the Linux kernel supports today is theoretically the 486. However is this theory actually true in practice? I decided to put this theory to the test in my project. His site describes installing Gentoo Linux on an "ancient" IBM PS/1 Consultant 2133 19C (released in 1993), with 64MB SIMM-72 RAM. (Though to speed things up, he compiled that minimal version of Gentoo on a modern Thinkpad T430 released in 2012.) "Due to the age of the PC, the BIOS only supports booting from the floppy drive or internal HDD," so there was also some disk partitioning and kernel configuration. ("Must disable 64-bit kernel for obvious reasons!") A half-hour video shows that it takes almost 11 minutes just to boot up -- and five and a half minutes to shut down. "Despite the many roadblocks I faced, I was impressed by the level of support Linux has for ancient hardware like this." And there's one more added bonus. "Given the age of the 486 (1989 technology), it does not support branch prediction... Ironically this makes it safe from the Meltdown and Spectre attacks."' -- source: https://linux.slashdot.org/story/18/01/07/228222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Can We Replace Intel x86 With an Open Source Chip?
by Peter Reutemann 07 Jan '18

07 Jan '18

'Perhaps the Meltdown and Spectre bugs are the impetus for making long-overdue changes to the core DNA of the semiconductor industry and how chip architectures are designed... Linux (and other related FOSS tech that forms the overall stack) is now a mainstream operating system that forms the basis of public cloud infrastructure and the foundational software technology in mobile and Internet of Things (IoT)... We need to develop a modern equivalent of an OpenSPARC that any processor foundry can build upon without licensing of IP, in order to drive down the costs of building microprocessors at immense scale for the cloud, for mobile and the IoT. It makes the $200 smartphone as well as hyperscale datacenter lifecycle management that much more viable and cost-effective. Just as Linux and open source transformed how we view operating systems and application software, we need the equivalent for microprocessors in order to move out of the private datacenter rife with these legacy issues and into the green field of the cloud... The fact that we have these software technologies that now enable us to easily abstract from the chip hardware enables us to correct and improve the chips through community efforts as needs arise... We need to stop thinking about microprocessor systems' architectures as these licensed things that are developed in secrecy by mega-companies like Intel or AMD or even ARM... The reality is that we now need to create something new, free from any legacy entities and baggage that has been driving the industry and dragging it down the past 40 years. Just as was done with Linux. The bigger question is which chip should take its place. "I don't see ARM donating its IP to this effort, and I think OpenSPARC may not be it either. Perhaps IBM OpenPOWER? It would certainly be a nice gesture of Big Blue to open their specification up further without any additional licensing, and it would help to maintain and establish the company's relevancy in the cloud going forward. "RISC-V, which is being developed by UC Berkeley, is completely Open Source."' -- source: https://news.slashdot.org/story/18/01/06/0424200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

After Intel ME, Researchers Find Security Bug In AMD's SPS Secret Chip-on-Chip
by Peter Reutemann 07 Jan '18

07 Jan '18

'AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor. This component, formerly known as AMD PSP (Platform Security Processor), is a chip-on-chip security system, similar to Intel's much-hated Management Engine (ME). Just like Intel ME, the AMD Secure Processor is an integrated coprocessor that sits next to the real AMD64 x86 CPU cores and runs a separate operating system tasked with handling various security-related operations. The security bug is a buffer overflow that allows code execution inside the AMD SPS TPM, the component that stores critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores. Intel fixed a similar flaw last year in the Intel ME.' -- source: https://hardware.slashdot.org/story/18/01/07/2015226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Data Centres: No Cheaper NVidia Gaming Graphics Cards For You
by Lawrence D'Oliveiro 05 Jan '18

05 Jan '18

Another entry in the “If I Buy It, Do I Own It?” files: NVidia’s EULA for the proprietary drivers for its GeForce and Titan gaming graphics cards has been amended to forbid their use in data centres: <http://www.theregister.co.uk/2018/01/03/nvidia_server_gpus/>. Such users will have to shell out for more expensive cards. For their own good, of course...

3 2