- wlug - list.wlug.org.nz

GnuPG crypto library cracked, look for patches
by Lawrence D'Oliveiro 05 Jul '17

05 Jul '17

What they found is that the libgcrypt library used what's called “sliding windows”, a method for carrying out the mathematics of cryptography – but one that's known to leak data. ... What they found was an unpleasant surprise: a complete break of the library's RSA-1024... <https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_…> Cue the conspiracy theorists lining up to say “Given the controversy surrounding GnuPG and the way they operate, one just has to wonder "bug or backdoor?"”

2 2

Latte Dock – An Elegant and Intuitive Dock for Your Tasks and Plasmoids
by Peter Reutemann 03 Jul '17

03 Jul '17

'Latte Dock is arguably the best dock app for KDE Plasma especially since the release of its stable version 0.6 in April. It is based on plasma frameworks, that working together to provide users with an elegant and intuitive experience while going about their everyday PC tasks. Latte Dock is unlike some dock apps in the market in the sense that it lets you replace your desktop panels completely. You can use it to run multiple docks on one screen, mimic several panel layouts including that of Unity and Plasma, set animation styles especially using its parabolic zoom effects, and organize Plasmoids.' -- source: https://www.fossmint.com/latte-dock-an-elegant-and-intuitive-dock-for-kde-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 4.12 Officially Released
by Peter Reutemann 03 Jul '17

03 Jul '17

'After seven weeks of announcing release candidate versions, Linus Torvalds today informs the Linux community through a mailing list announcement about the general availability of the Linux 4.12 kernel series. Development on the Linux 4.12 kernel kicked off in mid-May with the first release candidate, and now, seven weeks later we can finally get our hands on the final release... A lot of great improvements, new hardware support, and new security features were added during all this time, which makes it one of the biggest releases, after Linux 4.9... Prominent features of the Linux 4.12 kernel include initial support for AMD Radeon RX Vega graphics cards, intial Nvidia GeForce GTX 1000 "Pascal" accelerated support, implementation of Budget Fair Queueing (BFQ) and storage-I/O schedulers, more MD RAID enhancements, support for Raspberry Pi's Broadcom BCM2835 thermal driver, a lot of F2FS optimizations, as well as ioctl for the GETFSMAP space mapping ioctl for both XFS and EXT4 filesystems. Linus said in announcing the release that "I think only 4.9 ends up having had more commits," also noting that 4.9 was a Long Term Support kernel, whereas "4.12 is just plain big." "There's also nothing particularly odd going on in the tree - it's all just normal development, just more of it than usual."' -- source: https://linux.slashdot.org/story/17/07/03/0410253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

HTTPS Certificate Revocation Doesn’t Work: Some Fixes
by Lawrence D'Oliveiro 03 Jul '17

03 Jul '17

The traditional mechanisms for revoking compromised TLS/SSL certifications--cert revocation lists (CRLs) and Online Certificate Status Protocol (OCSP)--don’t really work. But something can be done about this, in the form of “OCSP Must Staple”. Also the issue of rogue certifications--certs issued for your domain without your knowledge or permission--can be mitigated with Certificate Transparency (CT), where the issuing Certificate Authorities (CAs) publish all the certs they have given out, to allow crosschecks. There is also Certificate Authority Authorization (CAA), where the DNS entry for your domain specifies which CA(s) are allowed to issue certs for it. <https://arstechnica.com/security/2017/07/https-certificate-revocation-is-br…>

1 0

Debian Linux reveals Intel Skylake and Kaby Lake processors have broken hyper-threading
by Peter Reutemann 03 Jul '17

03 Jul '17

'Do you have an Intel Skylake and Kaby Lake processor under your computer's hood? Have you experienced unexplained application and system hiccups, data corruption, or data loss? It could be because your chipset has hyper-threading enabled and the chips are malfunctioning. Henrique de Moraes Holschuh, a Debian Linux developer, revealed the Intel chip problem on the Debian developer list. Officially, Intel hasn't acknowledged the problem, but engineers at Dell and Intel have told me that the problem, and its fix, exists. This processor/microcode defect has been found on Intel Skylake and Intel Kaby Lake processors with hyper-threading enabled. Besides these 6th and 7th generation Intel Core processors, its also found on its related server processors, such as Xeon v5 and Xeon v6, and some select Intel Pentium processor models. While the Debian community revealed the problem, it's not Linux-specific. Any operating system -- Windows, macOS,FreeBSD, you name it -- can run into the problem. According to Intel chip errata, "Under complex micro-architectural conditions, short loops of less than 64 instructions that use AH, BH, CH or DH registers as well as their corresponding wider register (e.g. RAX, EAX or AX for AH) may cause unpredictable system behavior. This can only happen when both logical processors on the same physical processor are active." This will lead to the computer experiencing "unpredictable system behavior." What programs will cause a computer to act up? That's a good question, and we don't have a good answer. As Holschuh wrote, "We do not have enough information at this time to know how much software out there will trigger this specific defect."' -- source: http://www.zdnet.com/article/debian-linux-reveals-intel-skylake-kaby-lake-p… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

23 Years Of The Open Source 'FreeDOS' Project
by Peter Reutemann 03 Jul '17

03 Jul '17

Not quite Linux, but a good example of an open-source project: 'Jim Hall is celebrating the 23rd birthday of the FreeDOS Project, calling it "a major milestone for any free software or open-source software project," and remembering how it all started. An anonymous reader quotes Linux Journal: If you remember Windows 3.1 at the time, it was a pretty rough environment. I didn't like that you could interact with Windows only via a mouse; there was no command line. I preferred working at the command line. So I was understandably distressed in 1994 when I read via various tech magazines that Microsoft planned to eliminate MS-DOS with the next version of Windows. I decided that if the next evolution of Windows was going to be anything like Windows 3.1, I wanted nothing to do with it... I decided to create my own version of DOS. And on June 29, 1994, I posted an announcement to a discussion group... Our "PD-DOS" project (for "Public Domain DOS") quickly grew into FreeDOS. And 23 years later, FreeDOS is still going strong! Today, many people around the world install FreeDOS to play classic DOS games, run legacy business software or develop embedded systems... FreeDOS has become a modern DOS, due to the large number of developers that continue to work on it. You can download the FreeDOS 1.2 distribution and immediately start coding in C, Assembly, Pascal, BASIC or a number of other software development languages. The standard FreeDOS editor is quite nice, or you can select from more than 15 different editors, all included in the distribution. You can browse websites with the Dillo graphical web browser, or do it "old school" via the Lynx text-mode web browser. And for those who just want to play some great DOS games, you can try adventure games like Nethack or Beyond the Titanic, arcade games like Wing and Paku Paku, flight simulators, card games and a bunch of other genres of DOS games. On his "Open Source Software and Usability" blog, Jim says he's been involved with open source software "since before anyone coined the term 'open source'," and first installed Linux on his home PC in 1993. Over on the project's blog, he's also sharing appreciative stories from FreeDOS users and from people involved with maintaining it (including memories of early 1980s computers like the Sinclair ZX80, the Atari 800XL and the Coleco Adam). Any Slashdot readers have their own fond memories to share?' -- source: https://news.slashdot.org/story/17/07/02/1710200 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Disputes 'Ads In MOTD' Claims
by Peter Reutemann 03 Jul '17

03 Jul '17

'Thursday Lproven (Slashdot reader #6030) wrote: It appears that Ubuntu is using a feature it has added -- intended to insert headlines of breaking tech news (security alerts and so on) into the Message of the Day displayed at login to the console -- to display advertising and promotional messages. The message in question linked to a Hacker Noon article titled "How HBO's Silicon Valley built 'Not Hotdog' with mobile TensorFlow, Keras & React Native." Later that day Dustin Kirkland, a Ubuntu Product Manager for the feature's design (and the Core Developer for its implementation) suggested the message had been mistaken for an ad, describing it on Hacker News as a "fun fact... an interesting tidbit of potpourri from the world of Ubuntu," and later saying it was intended like Google's doodles. "Last week's message actually announced an Ubuntu conference in Latin America. The week before, we linked to an article asking for feedback on Kubuntu. Before that, we announced the availability of Extended Security Maintenance updates for 12.04. And so on." He later confirmed Canonical received no money for the message, and also pointed out that the messages all come from an open source repository, and "You're welcome to propose your own messages for merging, if you have a well formatted, informative message for Ubuntu users." Click through for a condensed version of the complete response by Dustin Kirkland, Ubuntu Product and Strategy at Canonical.' -- source: https://news.slashdot.org/story/17/07/01/0550251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

15 Devices (Including 6 Laptops) Awarded FSF's 'Respects Your Freedom' Certification
by Peter Reutemann 03 Jul '17

03 Jul '17

'This week the Free Software Foundation awarded its coveted 'Respects Your Freedom' certification to 15 products -- more than doubling the number of certified products (from 12 to 27) since the program began in 2012. An anonymous reader writes: The non-profit FSF certified six different laptops, two docking stations, three WiFi USB adapters and two internal WiFi devices, a mainboard, and their first-ever certified Bluetooth device, the TET-BT4 USB adapter. The products are all from Technoethical (formerly Tehnoetic), a Romania-based company who previously had just one mini wireless USB adapter on their list of FSF-certified products. "In 2014 we started selling hardware compatible with fully free systems in order to fund the free software activism work that we've been doing with our foundation," said Technoethical founder, Tiberiu C. Turbureanu. "Since then, we worked hard to build a hardware catalog that allows free software users to choose what best fits their computing needs, while also helping with the funding of different free software projects." "We are excited that Technoethical has brought out such an impressive collection of hardware whose associated software respects user freedom," said the FSF's executive director, John Sullivan. "RYF certification continues to gain speed and momentum, thanks to companies like them."' -- source: https://hardware.slashdot.org/story/17/07/02/205201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Mint 18.2 (Sonya) released
by Peter Reutemann 02 Jul '17

02 Jul '17

Hi everyone Linux Mint 18.2, nicknamed Sonya, has been released. Here are the blog entries for the various flavors: - KDE http://blog.linuxmint.com/?p=3292 - XFCE http://blog.linuxmint.com/?p=3291 - MATE http://blog.linuxmint.com/?p=3290 - Cinnamon http://blog.linuxmint.com/?p=3289 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Govhack hamilton
by William Mckee 01 Jul '17

01 Jul '17

Hi, Govhack is happening end of July. Tickets are free. https://www.eventbrite.co.nz/e/govhack-nz-hamilton-tickets-35833922226 I'm planning on a project involving Waikato bus data. a static website that displays bus stops and when the next buses leave. Hope to see you there! Cheers, William

2 1