- wlug - list.wlug.org.nz

Samsung To Let Proper Linux Distros Run on Galaxy Smartphones
by Peter Reutemann 19 Oct '17

19 Oct '17

'Samsung has announced it will soon become possible to run actual proper Linux on its Note8, Galaxy S8 and S8+ smartphones -- and even Linux desktops. Yeah, yeah, we know Android is built on Linux, but you know what we mean. Samsung said it's working on an app called "Linux on Galaxy" that will let users "run their preferred Linux distribution on their smartphones utilizing the same Linux kernel that powers the Android OS." "Whenever they need to use a function that is not available on the smartphone OS, users can simply switch to the app and run any program they need to in a Linux OS environment," Samsung says. The app also allows multiple OSes to run on a device. Linux desktops will become available if users plug their phones into the DeX Station, the device that lets a Galaxy 8 run a Samsung-created desktop-like environment when connected to the DeX and an external monitor.' -- source: https://linux.slashdot.org/story/17/10/19/0524234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

EU: No Encryption Backdoors But, Let's Help Each Other Crack That Crypto
by Peter Reutemann 19 Oct '17

19 Oct '17

'The European Commission has proposed that member states help each other break into encrypted devices by sharing expertise around the bloc. From a report: In an attempt to tackle the rise of citizens using encryption and its effects on solving crimes, the commission decided to sidestep the well-worn, and well-ridiculed, path of demanding decryption backdoors in the stuff we all use. Instead, the plans set out in its antiterrorism measures on Wednesday take a more collegiate approach -- by offering member states more support when they actually get their hands on an encrypted device. "The commission's position is very clear -- we are not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon," security commissioner Julian King told a press briefing. "We're trying to move beyond a sometimes sterile debate between backdoors or no backdoors, and address some of the concrete law enforcement challenges. For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."' -- source: https://yro.slashdot.org/story/17/10/19/1440200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Engineers Explore Ways To Stop In-Browser Cryptocurrency Miners in Chrome
by Peter Reutemann 19 Oct '17

19 Oct '17

'Google Chrome engineers are considering adding a special browser permission that will thwart the rising trend of in-browser cryptocurrency miners. Discussions on the topic of in-browser miners have been going on the Chromium project's bug tracker since mid-September when Coinhive, the first such service, launched. "Here's my current thinking," Ojan Vafai, a Chrome engineering working on the Chromium project, wrote in one of the recent bug reports. "If a site is using more than XX% CPU for more than YY seconds, then we put the page into 'battery saver mode' where we aggressively throttle tasks and show a toast [notification popup] allowing the user to opt-out of battery saver mode. When a battery saver mode tab is backgrounded, we stop running tasks entirely. I think we'll want measurement to figure out what values to use for XX and YY, but we can start with really egregious things like 100% and 60 seconds. I'm effectively suggesting we add a permission here, but it would have unusual triggering conditions [...]. It only triggers when the page is doing a likely bad thing." An earlier suggestion had Google create a blacklist and block the mining code at the browser level. That suggestion was shut down as being too impractical and something better left to extensions.' -- source: https://tech.slashdot.org/story/17/10/19/1618222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Targeted Fuzzing Is Improving Linux Security, Linus Torvalds Says
by Peter Reutemann 19 Oct '17

19 Oct '17

'On the sidelines of announcing the fifth release candidate for the Linux kernel version 4.14, Linus Torvalds said fuzzing, which involves stress testing a system by generating random code to induce errors, is helping the community find and fix a range of security vulnerabilities. He wrote: The other thing perhaps worth mentioning is how much random fuzzing people are doing, and it's finding things. We've always done fuzzing (who remembers the old "crashme" program that just generated random code and jumped to it? We used to do that quite actively very early on), but people have been doing some nice targeted fuzzing of driver subsystems etc, and there's been various fixes (not just this last week either) coming out of those efforts. Very nice to see.' -- source: https://linux.slashdot.org/story/17/10/19/171206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

IoT Cybersecurity: What’s Plan B?
by Lawrence D'Oliveiro 19 Oct '17

19 Oct '17

Whither the Internet Of Things? Markets, as we've repeatedly learned over the past century, are terrible mechanisms for improving the safety of products and services. It was true for automobile, food, restaurant, airplane, fire, and financial-instrument safety. The reasons are complicated, but basically, sellers don't compete on safety features because buyers can't efficiently differentiate products based on safety considerations. The race-to-the-bottom mechanism that markets use to minimize prices also minimizes quality. Without government intervention, the IoT remains dangerously insecure. The US government has no appetite for intervention, so we won't see serious safety and security regulations, a new federal agency, or better liability laws. We might have a better chance in the EU. Depending on how the General Data Protection Regulation on data privacy pans out, the EU might pass a similar security law in 5 years. No other country has a large enough market share to make a difference. <https://www.schneier.com/blog/archives/2017/10/iot_cybersecuri.html>

1 0

GPL Abuse In The Linux Kernel
by Lawrence D'Oliveiro 18 Oct '17

18 Oct '17

The questionable legal activities of a former Linux kernel developer <http://www.theregister.co.uk/2017/10/18/linux_kernel_community_enforcement_…> have driven a bunch of senior kernel figures to issue a “Community Enforcement Statement” to try to put a stop to this sort of thing in the future. What’s interesting about this is their admission that the GPL 2.0 has “ambiguities … that no one in our community has ever considered part of compliance”. And to fix it, their Statement “adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified”. Do you remember back when GPL 3.0 came out, and Linus Torvalds and other senior kernel figures issued a statement claiming that they were quite happy with GPL 2.0, they had no intention of moving to GPL 3.0, which he quite publicly loathed? Seems like now they are slowly coming to a realization of the reasons why GPL 3.0 was created in the first place...

1 0

Ah, The Joys Of Debian Unstable ...
by Lawrence D'Oliveiro 17 Oct '17

17 Oct '17

Did my (roughly) monthly system upgrades over the last couple of days. Debian has changed the default Python version for the “python3” command to 3.6. (And Blender now requires that version for building as well.) Didn’t notice anything broken until today, when I tried to print something on my HP inkjet. Turns out the various HP/CUPS-related packages with version number 3.17 want the system default Python to be 3.5, not 3.6. In situations like these, the first thing I have learned to try is to manually download older versions of packages from <http://ftp.debian.org/debian/> and install them with “dpkg -i”. For reference, these are the packages I downgraded: dpkg -i hplip-data_3.16.11+repack0-3_all.deb dpkg -i libhpmud0_3.16.11+repack0-3_amd64.deb dpkg -i libsane-hpaio_3.16.11+repack0-3_amd64.deb dpkg -i printer-driver-hpcups_3.16.11+repack0-3_amd64.deb dpkg -i hplip_3.16.11+repack0-3_amd64.deb And it worked. My printer now prints again. Presumably this will be sorted out in time for my next upgrade ...

1 3

Unlikely Things Running Linux
by Lawrence D'Oliveiro 16 Oct '17

16 Oct '17

>From the International Space Station and Large Hadron Collider, through self-driving cars, an electric motorbike and a solar-powered surfboard, down to a milking machine, Computer Engineer Barbie and a crockpot, Brian Lunduke presents a quick tour of just some of the unlikely places you will find a computer running Linux <https://www.youtube.com/watch?v=xPbAXKMCDkY>. Complete with a sting in the tail for those who uncritically subscribe to the old “do one thing and do it well” misconception...

1 0

meeting suggestions?
by Peter Reutemann 16 Oct '17

16 Oct '17

Hi everyone Since we had no volunteers for demoing "Sogo Groupware Server" (Roger?), does anybody else have a topic for next Monday's meeting? Ubuntu 17.10 should be out then... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

qTox – An Open Source P2P Instant Messaging and VoIP App
by Peter Reutemann 16 Oct '17

16 Oct '17

'As you probably already know, GNU/Linux has no shortage of VoIP apps. We’ve written on Wire and Discord. And we even compiled a list of The 10 Best Instant Messaging Apps for Linux. Today, we’ve got a new app to add to our list of instant messaging apps and it goes by the name of qTox. qTox is a free and open source p2p instant messaging, audio and video calls app and is (apparently) the most feature-rich Tox client. As a powerful Tox client, it follows Tox’s design guidelines while maintaining a uniform UI/UX across all the major platforms. It is built with privacy as its paramount goal and the team has even made a public statement that user safety is their priority and nothing in the world can change that.' -- source: https://www.fossmint.com/qtox-an-open-source-p2p-instant-messaging-and-voip… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0