- wlug - list.wlug.org.nz

Azure Confidential Computing Will Keep Data Secret, Even From Microsoft
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

From <https://arstechnica.com/gadgets/2017/09/azure-confidential-computing-will-k…>: The SGX mode uses processor features to carve out a TEE within a regular process—no virtual machines necessary. The processor itself will encrypt and decrypt data from memory, such that the data is only decrypted when it's within the processor itself. With this mode, even Hyper-V's security isn't important; the only thing that an application has to trust is the processor and its implementation of SGX. With SGX enclaves, nobody—not even Microsoft—can see the data in the TEE. So we only have to trust Intel...

1 0

The Big List Of Naughty Strings
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

The Big List of Naughty Strings is an evolving list of strings which have a high probability of causing issues when used as user-input data. This is intended for use in helping both automated and manual QA testing; useful for whenever your QA engineer walks into a bar. <https://github.com/minimaxir/big-list-of-naughty-strings> The “walks into a bar” reference is to this <http://www.sempf.net/post/On-Testing1>: QA Engineer walks into a bar. Orders a beer. Orders 0 beers. Orders 999999999 beers. Orders a lizard. Orders -1 beers. Orders a sfdeljknesv. Because that’s what testing is all about...

3 2

Python Explosion Blamed On Pandas
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

Not content to bait developers by declaring that Python is the fastest-growing major programming language, coding community site Stack Overflow has revealed the reason for its metastasis. ... Programmers love pandas. <http://www.theregister.co.uk/2017/09/14/python_explosion_blamed_on_pandas/>

2 2

The Community bash Style Guide
by Lawrence D'Oliveiro 15 Sep '17

15 Sep '17

A collection of dos and don’ts for writing bash scripts: <https://github.com/azet/community_bash_style_guide>. Some tips are not bash-specific, but are about external commands usable with any shell: e.g. awk, sed, grep, pgrep, xargs. Also some builtins should be available with any POSIX-compliant shell, e.g. getopts, printf. Most surprising bit of information: that someone has written a “ctypes” (foreign-function interface) addon for bash <https://github.com/taviso/ctypes.sh>.

1 0

Yellow Rebrands, Celebrates Turnaround
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

The former Yellow Pages Group is getting over a rough patch by finding new business opportunities: Its work with SMEs, however, was the focus [acting CEO] Linton said, with companies able to use Yellow to set up a basic website, through to advertising, adding on e-commerce solutions, booking widgets and other add-on products for an additional regular cost. Yellow is also one of New Zealand's largest resellers of Google Adwords - helping boost customer profile online. ... “Almost 50 per cent of small businesses have no digital presence so you can't even find them on Google.” <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11922410>

1 0

Free Software, Open Access, And Open Science Groups Join Fight Against EU Copyright Directive's Terrible Ideas
by Lawrence D'Oliveiro 14 Sep '17

14 Sep '17

>From an item by the always-excellent Glyn Moody <https://www.techdirt.com/articles/20170912/08434938194/free-software-open-a…>: The problem they identified is that widely-used version control systems (VCS) like GitHub seem to meet the definition of "information society services" laid down by the proposed EU Copyright Directive, and as such would be required to filter all uploads to block copyright infringements. Moreover, as the white paper points out, developer Web sites would not only be held responsible for any material uploaded by users without permission of the copyright holders, but would also seem liable for illegitimate distributions of derivative works in violation of the applicable license. At which I can hear groups affiliated with Big Content™ responding “Yeah? So?”. Sites like YouTube are full of user-generated content, too (what is YouTube most famous for showing? Cat videos!), but that hasn’t stopped them being forced into granting special privileges to major film studios and the like <https://www.techdirt.com/search-g.php?num=20&q=youtube+dmca&search=Search>. If software is not the same as videos, pictures or music, why should the same principles of copyright apply to it?

1 0

Backdoor Found In WordPress Plugin With More Than 200, 000 Installations
by Peter Reutemann 14 Sep '17

14 Sep '17

'According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200,000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it's unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version -- v2.6.0 -- on June 21' -- source: https://it.slashdot.org/story/17/09/13/2152234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software In Use At Animation College
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Seeing their ads in various places prompted me to check out their site. There is a list of software that they use in their Bachelor of Animation degree here <http://www.animationcollege.co.nz/bachelor-of-animation/bachelor-faq/>, but it’s just a table of product logos, no names. Interesting to see one open-source product in that list, namely Audacity. Also note that “GitKraken”, which appears to be a GUI for the Git version-control system. I wonder how they use it in studio workflows? Purely to keep track of a linear sequence of revisions of assets? Because I can’t imagine that branching and merging would work very well with binary (e.g. still-image, audio, video) files. The faux-chemical symbols are all Adobe products, I believe; but I can’t find anything at Adobe’s site that has the “An” logo. My best guess for the product denoted by “xN” is this company <http://www.realityvirtual.co/>. And that purple one that looks like a purple pixelated landslide, I can’t identify at all.

1 0

Hacking Voice Assistant Systems With Inaudible Voice Commands
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

Turns out that all the major voice assistants -- Siri, Google Now, Samsung S Voice, Huawei HiVoice, Cortana and Alexa -- listen at audio frequencies the human ear can't hear. Which means somebody could send commands to your device that you have no idea about. <https://www.schneier.com/blog/archives/2017/09/hacking_voice_a.html>

1 0

AT HOP: Pitfalls In Electronic Transaction Systems
by Lawrence D'Oliveiro 13 Sep '17

13 Sep '17

There seems to be a subtle issue with topping up the balance on AT HOP cards used by Auckland Transport: you actually have to use the card somewhere within 60 days of the topup, otherwise the deposit will get taken out again. It appears this has to do with the terminals having to be refreshed daily with their own copies of details about valid cards, and these uploads only include active cards. But try explaining that to the customers... <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11921624>

2 1