- wlug - list.wlug.org.nz

How Bulletproof Hosting Works
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

“Bulletproof” hosting providers tout their ability to stay online in spite of the efforts of law enforcement to shut them down. Here is a report <http://www.theregister.co.uk/2017/10/05/bulletproof_hosting/> into some research detailing how they manage to keep operating: One service cited by the work is a cloud proxy network that abuses the services of legitimate providers including AWS and TenCent. The product ... typically costs $250/month/domain and maintains operations by cycling through an enormous number of providers – 230 in just nine days, according to the researchers. ... Another provider ...is still in business despite being raided three times ... Operating out of political hotspots gives some BPH operations another shield against takedown attempts.

1 0

How Do Sysadmins Manage Patches?
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

The infamous Equifax breach (which has compromised the personal information belonging to 140 million Americans) was down to a vulnerability in an application library which had already been discovered and a patch issued months before, but the patch was never applied at the company. Why does this sort of thing keep happening? Here is a research survey <https://freedom-to-tinker.com/2017/10/04/avoid-an-equifax-like-breach-help-…> being undertaken to try to better understand the real-world constraints under which companies operate, with a view to making the software update process more effective (i.e. more likely to be followed).

1 0

HP Shared ArcSight Source Code With Russians
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

Bruce Schneier repeats a point that should be well-known about security and Open Source, but which some still have trouble grasping: This is one of the areas where open-source software has a security edge. If everyone has access to the source code -- and security doesn't depend on its secrecy -- then there's no advantage in getting a copy. As long as companies rely on obscurity for their security, these sorts of attacks are possible and profitable. <https://www.schneier.com/blog/archives/2017/10/hp_shared_arcsi.html>

1 0

Return Of The Algorithm Monster: YouTube Auto-Promoted Conspiracy Theory Videos
by Lawrence D'Oliveiro 06 Oct '17

06 Oct '17

During the [Wall Street Journal]'s Tuesday test, searches for hot-topic terms like "Las Vegas shooting" and "NFL anthem protest," along with the term "9/11," each brought up top-five video posts, specifically listed in the site's "Top News" box, whose titles and content were loaded with debunked and misleading content. The fifth result for "Las Vegas shooting" was titled "Proof Las Vegas Shooting Was a FALSE FLAG attack—Shooter on 4th Floor" and claimed that multiple shooters had been involved, in spite of Vegas officials stating otherwise. <https://arstechnica.com/gaming/2017/10/return-of-the-algorithm-monster-yout…>

1 0

“Your Account eStatement For February”
by Lawrence D'Oliveiro 05 Oct '17

05 Oct '17

It took me a few seconds to parse this one. Dear Customer Attached is your provisional statement with the new charges. For your security it has been encrypted. This means that you will need a decoder to view your statement. Before you can view your statement, you must Download the attachment and install the decoder. Read that far, and initially thought “for crying out loud, another bloody piece of Windows-only software”. Then a few seconds later, it dawned on me that, while it claimed to come from the right bank, the from-address <JOhnEdwarD011(a)gaea.ocn.ne.jp> couldn’t be that of any bank. It wasn’t until after I’d filed it as a scam that I noticed the most glaring thing: “February”??

1 0

World’s First 14TB Drive
by Lawrence D'Oliveiro 04 Oct '17

04 Oct '17

Western Digital has announced a drive using shingled media recording to push the capacity up to 14TB <http://www.theregister.co.uk/2017/10/03/wdc_14tb_disk_drive_hs14/>. Unfortunately, this recording technique complicates (and slows down) writing, so it is meant for applications where data is read a lot, and updated less frequently.

1 0

Timeshift A System Restore Utility Tool Review
by Peter Reutemann 03 Oct '17

03 Oct '17

'TimeShift is a system restore tool for Linux. It provides functionality that is quite similar to the System Restore feature in Windows or the Time Machine tool in MacOS. TimeShift protects your system by making incremental snapshots of the file system manually or at regular automated intervals. These snapshots can then be restored at a later point to undo all changes to the system and restore it to the previous state. Snapshots are made using rsync and hard-links and the tool shares common files amongst snapshots in order to save disk space' -- source: http://www.linuxandubuntu.com/home/timeshift-a-system-restore-utility-tool-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Quote Of The Week From UK Home Sec Amber Rudd
by Lawrence D'Oliveiro 03 Oct '17

03 Oct '17

"I don't need to understand how encryption works to understand how it's helping – end-to-end encryption – the criminals. I will engage with the security services to find the best way to combat that." <http://www.theregister.co.uk/2017/10/03/amber_rudd_still_does_not_understan…>

1 0

Asciinema – Record Terminal Sessions And Share Them On The Web
by Peter Reutemann 03 Oct '17

03 Oct '17

'I already know about recording the Terminal activities using “script” command in Unix-like systems. Today, I found out yet another similar utility called “asciinema” that can used to record Terminal sessions. Forget about the heavy screen-recording tools and/or apps. Asciinema is a fast, light-weight and open source Terminal recording tool. Unlike “script” command, Asciinema not just records our Terminal activities, but also helps us to share them on the web if necessary. You can share the recordings by copying its URL and sending it to a friend or posting it on a social network. It supports Linux, Mac OS X and *BSD.' -- source: https://www.ostechnix.com/asciinema-record-terminal-sessions-share-web/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android users rejoice! Linux kernel LTS releases are now good for 6 years
by Peter Reutemann 02 Oct '17

02 Oct '17

'A major change in the maintenance lifecycle of Linux kernels is coming. During a Linaro Connect 2017 presentation on Android's Project Treble, Googler Iliyan Malchev announced that Linux LTS (Long Term Support) kernels were switching from a two-year lifecycle to a whopping six years of support. The free and open source Linux kernel powers most of the devices around us. It's not only present in computers and servers, it also powers most of the ARM devices on earth, so it's present in Android devices, the Internet of things, and almost anything else you can call "smart." Major new versions of the Linux kernel arrive about every 70 days. Not everyone wants to upend their existing system every 70 days to upgrade to the new kernel, though, so to help with this, the Linux kernel has traditionally had a "Long Term Support (LTS)" kernel, which is supported for two years. Rather than do a major kernel bump, devices can keep running an LTS kernel and regularly get bug and security fixes, which aren't as disruptive as full releases.' -- source: https://arstechnica.com/gadgets/2017/09/android-users-rejoice-linux-kernel-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0