- wlug - list.wlug.org.nz

Net Neutrality Repeal --- What It Means For NZ
by Rowan Schischka 16 Dec '17

16 Dec '17

>Doesn?t mean we shouldn?t have network neutrality here, though. It just >means the abuses have not been quite as flagrant to date. The article is about ghost problems. In America, with or without net neutrality, providers abuse their market position. Every argument to keep the net neutrality rules comes back to poor competition in telco providers, which previous regulations did not address. The article correctly states that we will not see problems here because of Chrous' position but they incorrectly state we do not have links between media and ISP; Vodafone currently offers package deals https:// www.vodafone.co.nz/pass/ The internet is still working and there is no barrier to stop you or me to start a competing business. If a company like Duco or the rugby union did a deal with an ISP, I would want a deal that gives me uninterrupted live sports streaming, but it wont happen if the government thinks they need to regulate this.

2 1

Net Neutrality Repeal --- What It Means For NZ
by Lawrence D'Oliveiro 15 Dec '17

15 Dec '17

<http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11960493>: "Since so many of the services we use online have been developed in America, what is bad for the internet there is bad for us all." But fortunately, Carter added, New Zealand didn't have the market problems that made network neutrality such a pressing issue in the US. Doesn’t mean we shouldn’t have network neutrality here, though. It just means the abuses have not been quite as flagrant to date.

1 0

Avast Launches Open-Source Decompiler For Machine Code
by Peter Reutemann 14 Dec '17

14 Dec '17

'To help with the reverse engineering of malware, Avast has released an open-source version of its machine-code decompiler, RetDec, that has been under development for over seven years. RetDec supports a variety of architectures aside from those used on traditional desktops including ARM, PIC32, PowerPC and MIPS. As Internet of Things devices proliferate throughout our homes and inside private businesses, being able to effectively analyze the code running on all of these new devices becomes a necessity to ensure security. In addition to the open-source version found on GitHub, RetDec is also being provided as a web service. Simply upload a supported executable or machine code and get a reasonably rebuilt version of the source code. It is not possible to retrieve the exact original code of any executable compiled to machine code but obtaining a working or almost working copy of equivalent code can greatly expedite the reverse engineering of software. For any curious developers out there, a REST API is also provided to allow third-party applications to use the decompilation service. A plugin for IDA disassembler is also available for those experienced with decompiling software.' -- source: https://news.slashdot.org/story/17/12/14/006237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

AT&T Versus Carterfone Revisited
by Lawrence D'Oliveiro 14 Dec '17

14 Dec '17

Or, it takes a certain amount of Government regulation to maintain a free market <https://arstechnica.com/tech-policy/2017/12/carterfone-40-years/>. I like the closing remarks: We do not begrudge the CEOs of these great corporations their legal positions. But they are, as Andrew Carnegie would put it, stewards of the system, not its owners. They are not there to tell us to Go Away. They are there to keep the system running while we discover it, use it, develop it, innovate it, game it, finesse it, and reinvent it to our heart's content. The great enterprise of telecommunications is no better than our right to participate in it as individuals.

1 0

AMD Is Open-Sourcing Their Official Vulkan Linux Driver
by Peter Reutemann 13 Dec '17

13 Dec '17

'While many of you have likely heard of the "RADV" open-source Vulkan driver, it's been a community-written driver up to this point in the absence of AMD's official, cross-platform Vulkan driver being open-source. That's now changed with AMD now open-sourcing their official Vulkan driver. The code drop is imminent and they are encouraging the use of it for quick support of new AMD hardware, access to the Radeon GPU Profiler, easy integration of AMD Vulkan extensions, and enabling third-party extensions. For now at least it does provide better Vulkan performance than RADV but the RADV developers have indicated they plan to continue development of their Mesa-based Vulkan driver.' -- source: https://news.slashdot.org/story/17/12/13/016211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

1998 attack that messes with sites’ secret crypto keys is back in a big way
by Peter Reutemann 12 Dec '17

12 Dec '17

'A surprisingly big number of top-name websites—Facebook and PayPal among them—recently tested positive for a critical, 19-year-old vulnerability that allowed attackers to decrypt encrypted data and sign communications using the sites' secret encryption key. The vulnerability in the transport layer security protocol for Web encryption was disclosed in 1998 when researcher Daniel Bleichenbacher found it in the TLS predecessor known as secure sockets layer. A flaw in the algorithm that handles RSA encryption keys responded to certain types of errors in a way that divulged potentially sensitive information. With enough specially formed queries, attackers could exploit the weakness in a way that allowed them to decrypt ciphertext even when they didn't have the secret decryption key. SSL architects responded by designing workarounds that suppressed the error messages rather than removing or rewriting the faulty RSA algorithm. Researchers call the class of crypto vulnerability an Oracle because it provides only "yes" or "no" answers that, over time, can reveal detailed information about the contents of encrypted data. The information allows hackers to carry out what's known as an "adaptive chosen-ciphertext attack."' -- source: https://arstechnica.com/information-technology/2017/12/a-worrying-number-of… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Service Providers Be Liable For Content?
by Lawrence D'Oliveiro 11 Dec '17

11 Dec '17

It is commonly accepted that ISPs should not generally be held liable for things done by their customers--or indeed, anybody else’s customers over their pipes. This is currently the case in Australia, for example. But should protections be extended to what we might describe as “secondary” service providers--such as social media sites like Facebook, and of course Google? Seems like Australia agrees the answer should be mostly “yes”, but not for those specific companies. Not sure how they are going to decide who is eligible for such legal protections and who is not. <https://www.techdirt.com/articles/20171207/09383538762/mpaa-wins-australia-…>

1 0

Intel's ME May Be Massively Infringing on Minix3's Free Software License
by Peter Reutemann 10 Dec '17

10 Dec '17

'Almost all Free Software licenses (BSD, MIT, GPL...) require some sort of legal notice (legal attribution) given to the recipient of the software, both when the software is distributed in source and in binary forms. The legal notice usually contains the copyright holder's name and the license text. This means that it's not possible to hide and keep secret the existence of Free Software that you have stuck into your product that you distribute. If you do so, then you are not complying with the Free Software license and you are committing a copyright infringement! This is exactly what Intel seems to have done with the Intel ME. The Minix3 operating system license requires a legal notice, but so far it seems like Intel has not given the necessary legal notices. (Probably because they want to keep the inside of the ME secret.) Thus not only is Minix3 the most installed OS on our recent x86 CPUs -- but it might also the most pirated OS on our recent x86 CPUs!' -- source: https://slashdot.org/story/17/12/09/0610203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

The FCC Still Doesn’t Know How the Internet
by Peter Reutemann 10 Dec '17

10 Dec '17

'The EFF describes the FCC's official plan to kill net neutrality as "riddled with technical errors and factual inaccuracies," including, for example, a false distinction between "Internet access service" and "a distinct transmission service" which the EFF calls "utterly ridiculous and completely ungrounded from reality." "Besides not understanding how Internet access works, the FCC also has a troublingly limited knowledge of how the Domain Name System (DNS) works -- even though hundreds of engineers tried to explain it to them this past summer... As the FCC would have it, an Internet user actively expects their ISP to provide DNS to them." And in addition, "Like DNS, it treats caching as if it were some specialized service rather than an implementation detail and general-purpose computing technique." "There are at least two possible explanations for all of these misunderstandings and technical errors. One is that, as we've suggested, the FCC doesn't understand how the Internet works. The second is that it doesn't care, because its real goal is simply to cobble together some technical justification for its plan to kill net neutrality. A linchpin of that plan is to reclassify broadband as an 'information service,' (rather than a 'telecommunications service,' or common carrier) and the FCC needs to offer some basis for it. So, we fear, it's making one up, and hoping no one will notice." "We noticed," their editorial ends, urging Americans "to tell your lawmakers: Don't let the FCC sell the Internet out."' -- source: https://yro.slashdot.org/story/17/12/09/0545230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Updated Debian Linux 9.3 and 8.10 Released
by Peter Reutemann 10 Dec '17

10 Dec '17

'The Debian project is pleased to announce the third update of its stable distribution Debian 9 (codename stretch). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available. The Debian project also announces the tenth update of its oldstable distribution Debian 8 (codename jessie). Please note that the point release does not constitute a new version of Debian 9 or 8 but only updates some of the packages included. There is no need to throw away old jessie or stretch DVD/CD media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror. This stable update adds a few important corrections to packages. New installation images will be available soon at the mirrors. Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release. One can use the apt command or apt-get command to apply updates. A step-by-step update guide is posted here.' -- source: https://linux.slashdot.org/story/17/12/09/1958254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0