- wlug - list.wlug.org.nz

Hundreds of E-Commerce Sites Hacked In Supply-Chain Attack
by Peter Reutemann 06 May '25

06 May '25

'Ars Technica reports: Hundreds of e-commerce sites, at least one owned by a large multinational company, were backdoored by malware that executes malicious code inside the browsers of visitors, where it can steal payment card information and other sensitive data, security researchers said Monday. The infections are the result of a supply-chain attack that compromised at least three software providers with malware that remained dormant for six years and became active only in the last few weeks. At least 500 e-commerce sites that rely on the backdoored software were infected, and it's possible that the true number is double that, researchers from security firm Sansec said. Among the compromised customers was a $40 billion multinational company, which Sansec didn't name. In an email Monday, a Sansec representative said that "global remediation [on the infected customers] remains limited." "Since the backdoor allows uploading and executing arbitrary PHP code, the attackers have full remote code execution (RCE) and can do essentially anything they want," the representative wrote. "In nearly all Adobe Commerce/Magento breaches we observe, the backdoor is then used to inject skimming software that runs in the user's browser and steals payment information (Magecart)." The three software suppliers identified by Sansec were Tigren, Magesolution (MGS), and Meetanshi. All three supply software that's based on Magento, an open source e-commerce platform used by thousands of online stores. A software version sold by a fourth provider named Weltpixel has been infected with similar code on some of its customers' stores, but Sansec so far has been unable to confirm whether it was the stores or Weltpixel that were hacked. Adobe has owned Megento since 2018.' -- source: https://it.slashdot.org/story/25/05/05/2034207/hundreds-of-e-commerce-sites… Cheers, Peter

1 0

Happy Birthday To Steve Jobs’ Screed Against Flash
by Lawrence D'Oliveiro 30 Apr '25

30 Apr '25

It was 15 years ago to day that Apple boss Steve Jobs published a blog post railing against Adobe Flash <https://www.theverge.com/apple/657934/happy-birthday-to-steve-jobs-screed-a…>, particularly about how it impinged on Apple’s control over its own platform: If developers grow dependent on third party development libraries and tools, they can only take advantage of platform enhancements if and when the third party chooses to adopt the new features. We cannot be at the mercy of a third party deciding if and when they will make our enhancements available to our developers. In hindsight, we all know now about the problems with lack of open standards, security and battery life. But as always, at the time, there were those who played down these problems and who assumed that, because Flash was so prevalent, it would remain so into the future. There’s a lesson in there, about history repeating itself ...

1 0

Ubuntu 25.04 “Plucky Puffin” Is Now Available for Download, This Is What’s New
by Peter Reutemann 30 Apr '25

30 Apr '25

'Canonical published today the Ubuntu 25.04 (Plucky Puffin) release, the latest stable version of their popular GNU/Linux distribution, featuring up-to-date components and new features. Powered by the latest and greatest Linux 6.14 kernel series for top-notch hardware support, Ubuntu 25.04 features the GNOME 48 desktop environment with the usual enhancements and look that Ubuntu users are used to, specifically the dynamic triple buffering feature for an extra boost on low-end systems. Some exciting changes in Ubuntu 25.04 include an official generic ARM64 (AArch64) desktop ISO targeting virtual machines, ACPI + EFI platforms, and Snapdragon-based WoA devices, as well as initial hardware enablement for the Snapdragon X Elite platform is now included in the Ubuntu Desktop ISO image. The Ubuntu Desktop installer has been updated with support for local file paths for autoinstall import, a new option to replace an existing Ubuntu installation, dual boot improvements with a focus on BitLocker-protected Windows systems, allowing users to install Ubuntu alongside existing BitLocker partitions. Ubuntu 25.04 also brings some networking enhancements as Netplan received support for wpa-psk-sha256 Wi-Fi connections, support for configuring routing policy on the NetworkManager backend, and support for a new functionality in systemd-networkd-wait-online to wait for DNS servers to be configured and reachable before considering an interface to be online. Other than that, the xdg-terminal-exec package is now installed by default for easier access to the default terminal using the Ctrl+Alt+T keyboard shortcut, Papers has been added as the default document viewer instead of Evince, and BeaconDB-powered geolocation services are now enabled by default on new installations. Among other noteworthy changes, the AppArmor package now includes many new profiles for apps to improve sandboxing and mitigate the impact of any exploit in confined apps, the JPEG XL image format is now supported by default, and NVIDIA Dynamic Boost is now enabled by default on supported laptops with NVIDIA GPUs. It also brings full support for Intel Core Ultra Xe2 integrated Intel Arc graphics and Intel Arc B580 and B570 “Battlemage” discrete GPUs, improved GPU and CPU ray tracing rendering performance in apps with Intel Embree support, full hardware accelerated video encoding of AVC, JPEG, HEVC, and AV1 on “Battlemage” devices, new CCS optimization in Intel Compute Runtime, and debugging support for Intel Xe GPUs.' -- source: https://9to5linux.com/ubuntu-25-04-plucky-puffin-is-now-available-for-downl… Cheers, Peter

1 0

OpenBSD 7.7 Released
by Peter Reutemann 30 Apr '25

30 Apr '25

'OpenBSD quietly released the new version (7.7) of its "secure by default" operating system. This is the 58th release. Changes include improved hardware and VMM support, along with many kernel improvements. This release brings several specific improvements, including performance boosts on ARM64, Arm SVE support, AMD SEV virtualization enhancements, better low-memory handling on i386, and improved suspend/hibernate and SMP performance. It also updates graphics drivers with support for AMD Ryzen IA 300, Radeon RX 9070, and Intel Arrow Lake, along with expanded hardware support for MediaTek SoCs.' -- source: https://bsd.slashdot.org/story/25/04/29/0456227 Cheers, Peter

1 0

Firefox Finally Delivers Tab Groups Feature
by Peter Reutemann 30 Apr '25

30 Apr '25

'Firefox has launched its long-awaited tab groups feature, responding to the most upvoted request in Mozilla Connect's three-year history. The feature allows users to organize tabs by name or color through a drag-and-drop interface. Mozilla is now developing an AI-powered "smart tab groups" feature that automatically suggests organization based on open tabs. Unlike competitors, the company said, Firefox processes this data locally, keeping tab information on the user's device rather than sending it to cloud servers.' -- source: https://news.slashdot.org/story/25/04/29/1853259 Cheers, Peter

1 0

CVE Foundation Emerges From Stealth to Rescue CVE Program
by Peter Reutemann 28 Apr '25

28 Apr '25

'I’m guessing that Trump and Musk are behind this, and that this is just another essential thing the government does that they’re trying to break into pieces. The good news is that in this case not only was there a last minute reprieve, but some people saw it coming and made plans to keep things going in case the rug still eventually gets pulled out. If this was the work of the dynamic duo of Pennsylvania Avenue, what they were busy trying to break was the Common Vulnerabilities and Exposures program — better known as CVE — which keeps track of security vulnerabilities found in software so that it can get fixed, hopefully before the bad guys develop a way to exploit the bug. The story started on Tuesday when MITRE — a nonprofit that among other things operates federally funded research and development centers that support various federal government agencies, including the CVE program — sent a letter to CVE board members, telling them that funding for CVE and other related programs was set to expire on Wednesday. As you might imagine, when that news hit the internet, it got social networks buzzing. [...] Then on Wednesday morning, at about the time that tech oriented websites and tech-focused users on social sites were at peak craziness over this withdrawal of funding, a monkey wrench was thrown into the machinery by a news release from the CVE Foundation, an organization that nobody — at least not anybody that I know — has heard anything about until now. “The CVE Foundation has been formally established to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures Program, a critical pillar of the global cybersecurity infrastructure for 25 years,” the release opened, under the heading: “CVE Foundation Launched to Secure the Future of the CVE Program.' -- source: https://fossforce.com/2025/04/cve-foundation-emerges-from-stealth-to-rescue… Cheers, Peter

1 0

Lenovo May Be Avoiding the 'Windows Tax' By Offering Cheaper Laptops With Pre-Installed Linux
by Peter Reutemann 28 Apr '25

28 Apr '25

'"The U.S. and Canadian websites for Lenovo offered U.S. $140 and CAD $211 off on the same ThinkPad X1 Carbon model when choosing any one of the Linux-based alternatives," reports It's FOSS News: This was brought to my attention thanks to a Reddit post... Others then chimed in, saying that Lenovo has been doing this since at least 2020 and that the big price difference shows how ridiculous Windows' pricing is... Not all models from their laptop lineup, like ThinkPad, Yoga, Legion, LOQ, etc., feature an option to get Linux pre-installed during the checkout process. Luckily, there is an easy way to filter through the numerous laptops. Just go to the laptops section (U.S.) on the Lenovo website and turn on the "Operating System" filter under the Filter by specs sidebar menu. The article end with an embedded YouTube video showing a VCR playing a videotape of a 1999 local TV news report... about the legendary "Windows Refund Day" protests.' -- source: https://linux.slashdot.org/story/25/04/27/0127203 Cheers, Peter

2 1

Linus Torvalds Expresses His Hatred For Case-Insensitive File-Systems
by Peter Reutemann 28 Apr '25

28 Apr '25

'Some patches for Linux 6.15-rc4 (updating the kernel driver for the Bcachefs file system) triggered some "straight-to-the-point wisdom" from Linus Torvalds about case-insensitive filesystems, reports Phoronix. Bcachefs developer Kent Overstreet started the conversation, explaining how some buggy patches for their case-insensitive file and folder support were upstreamed into the Bcachefs kernel driver nearly two years ago: When I was discussing with the developer who did the implementation, I noted that fstests should already have tests. However, it seems I neglected to tell him to make sure the tests actually run... It is _not_ enough to simply rely on the automated tests. You have to have eyes on what your code is doing. Overstreet added "There's a story behind the case insensitive directory fixes, and lessons to be learned." To which Torvalds replied.... "No." "The only lesson to be learned is that filesystem people never learn." Torvalds: Case-insensitive names are horribly wrong, and you shouldn't have done them at all. The problem wasn't the lack of testing, the problem was implementing it in the first place. The problem is then compounded by "trying to do it right", and in the process doing it horrible wrong indeed, because "right" doesn't exist, but trying to will make random bytes have very magical meaning. And btw, the tests are all completely broken anyway. Last I saw, they didn't actually test for all the really interesting cases — the ones that cause security issues in user land. Security issues like "user space checked that the filename didn't match some security-sensitive pattern". And then the shit-for-brains filesystem ends up matching that pattern *anyway*, because the people who do case insensitivity *INVARIABLY* do things like ignore non-printing characters, so now "case insensitive" also means "insensitive to other things too".... Dammit. Case sensitivity is a BUG. The fact that filesystem people *still* think it's a feature, I cannot understand. It's like they revere the old FAT filesystem _so_ much that they have to recreate it — badly. And this led to a very lively back-and-forth discussion.' -- source: https://linux.slashdot.org/story/25/04/27/0547245 Cheers, Peter

1 0

'Linux Mint Debian Edition 7' Gets OEM Support
by Peter Reutemann 15 Apr '25

15 Apr '25

'Linux Mint Debian Edition 7 "will come with full support for OEM installations," according to their monthly newsletter, so Linux Mint "can be pre-installed on computers which are sold throughout the World. It's a very important feature and it's one of the very few remaining things which wasn't supported by Linux Mint Debian Edition." Slashdot reader BrianFagioli speculates that "this could be a sign of something much bigger." OEM installs are typically reserved for operating systems meant to ship on hardware. It's how companies preload Linux on laptops without setting a username, password, or timezone... Mint has supported this for years — but only in its Ubuntu-based version. So why is this feature suddenly coming to Linux Mint Debian Edition, which the team has repeatedly described as a contingency? In other words, if the Debian variant is merely a plan B, why make it ready for OEMs? Their blog post goes on to speculate about possible explanations (like the hypothetical possibility of dissatisfaction with Snap packages or Canonical's decisions around telemetry and packaging).' -- source: https://linux.slashdot.org/story/25/04/12/0518218 Cheers, Peter

2 1

The EFF's 'Certbot' Now Supports Six-Day Certs
by Peter Reutemann 15 Apr '25

15 Apr '25

'10 years ago "certificate authorities normally issued certificate lifetimes lasting a year or more," remembers a new blog post Thursday by the EFF's engineering director. So in 2015 when the free cert authority Let's Encrypt first started issuing 90-day TLS certificates for websites, "it was considered a bold move, that helped push the ecosystem towards shorter certificate life times." And then this January Let's Encrypt announced new six-day certificates... This week saw a related announcement from the EFF engineering director. More than 31 million web sites maintain their HTTPS certificates using the EFF's Certbot tool (which automatically fetches free HTTPS certificates forever) — and Certbot is now supporting Let's Encrypt's six-day certificates. (It's accomplished through ACME profiles with dynamic renewal at 1/3rd of lifetime left or 1/2 of lifetime left, if the lifetime is shorter than 10 days): There is debate on how short these lifetimes should be, but with ACME profiles you can have the default or "classic" Let's Encrypt experience (90 days) or start actively using other profile types through Certbot with the --preferred-profile and --required-profile flags. For six day certificates, you can choose the "shortlived" profile. Why shorter lifetimes are better (according to the EFF's engineering director): - If a certificate's private key is compromised, that compromise can't last as long. - With shorter life spans for the certificates, automation is encouraged. Which facilitates robust security of web servers. - Certificate revocation is historically flaky. Lifetimes 10 days and under prevent the need to invoke the revocation process and deal with continued usage of a compromised key.' -- source: https://it.slashdot.org/story/25/04/14/0356212 Cheers, Peter

1 0