- wlug - list.wlug.org.nz

When The Internet Of Things Meets The Second-Hand Market
by Lawrence D'Oliveiro 20 Feb '17

20 Feb '17

The global head of IBM's X-Force Red penetration-testing team, Charles Henderson, created a flurry at RSA last week by relating how a connected car app could still access a car he traded in – two years after he'd sold it. ... Henderson feels that none of that should have been possible years after he disposed of the car. Especially as he says he ran a factory reset, reset his garage door and had traded the old car through a factory dealership ... which ... should have revoked his access to the old car. <https://www.theregister.co.uk/2017/02/20/connected_car_in_the_secondhand_lo…> Seems to me this could happen with other kinds of “smart” devices as well.

1 0

Aboard A Cable Survey Ship
by Lawrence D'Oliveiro 17 Feb '17

17 Feb '17

I mention this <http://www.theregister.co.uk/2017/02/16/iregi_tours_submarine_cable_survey_…> because it is scouting out the route for the “Southern Cross NEXT” cable. And also it was formerly an NZ Navy vessel.

1 0

Linus Torvalds: Talk of Tech Innovation is Bullshit. Shut Up and Get the Work Done
by Peter Reutemann 16 Feb '17

16 Feb '17

'Linus Torvalds believes the technology industry's celebration of innovation is smug, self-congratulatory, and self-serving. From a report on The Register: The term of art he used was more blunt: "The innovation the industry talks about so much is bullshit," he said. "Anybody can innovate. Don't do this big 'think different'... screw that. It's meaningless. Ninety-nine per cent of it is get the work done." In a deferential interview at the Open Source Leadership Summit in California on Wednesday, conducted by Jim Zemlin, executive director of the Linux Foundation, Torvalds discussed how he has managed the development of the Linux kernel and his attitude toward work. "All that hype is not where the real work is," said Torvalds. "The real work is in the details." Torvalds said he subscribes to the view that successful projects are 99 per cent perspiration, and one per cent innovation.' -- source: https://linux.slashdot.org/story/17/02/16/1530223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User?s Adventures In Linux
by rowan schischka 16 Feb '17

16 Feb '17

Third party ink works but don't fill up 100% and save OEM ink to periodically flush. I did not use a cheap printer for a few weeks and the third party ink blocked up the plumbing.

1 0

Google's Not-so-secret New OS
by Peter Reutemann 16 Feb '17

16 Feb '17

'According to reports late last year, Google is working on a new operating system called Andromeda. Much about it is still unknown, but according to the documentations Google has provided on its website, it's clear that the Fuchsia is the actual name of the operating system, and the kernel is called Magenta. A tech enthusiast dug around the documentations to share the followings: To my naive eyes, rather than saying Chrome OS is being merged into Android, it looks more like Android and Chrome OS are both being merged into Fuchsia. It's worth noting that these operating systems had previously already begun to merge together to an extent, such as when the Android team worked with the Chrome OS team in order to bring Update Engine to Nougat, which introduced A/B updates to the platform. Google is unsurprisingly bringing up Andromeda on a number of platforms, including the humble Intel NUC. ARM, x86, and MIPS bring-up is exactly what you would expect for an Android successor, and it also seems clear that this platform will run on Intel laptops. My best guess is that Android as an API and runtime will live on as a legacy environment within Andromeda. That's not to say that all development of Android would immediately stop, which seems extremely unlikely. But Google can't push two UI APIs as equal app frameworks over the long term: Mojo is clearly the future. Ah, but what is Mojo? Well it's the new API for writing Andromeda apps, and it comes from Chromium. Mojo was originally created to "extract a common platform out of Chrome's renderer and plugin processes that can support multiple types of sandboxed content."' -- source: https://mobile.slashdot.org/story/17/02/15/1023242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

JavaScript Attack Breaks ASLR On 22 CPU Architectures
by Peter Reutemann 16 Feb '17

16 Feb '17

'Five researchers from the Vrije University in the Netherlands have put together an attack that can be carried out via JavaScript code and break ASLR protection on at least 22 microprocessor architectures from vendors such as Intel, AMD, ARM, Allwinner, Nvidia, and others. The attack, christened ASLRCache, or AnC, focuses on the memory management unit (MMU), a lesser known component of many CPU architectures, which is tasked with improving performance for cache management operations. What researchers discovered was that this component shares some of its cache with untrusted applications, including browsers. This meant that researchers could send malicious JavaScript that specifically targeted this shared memory space and attempted to read its content. In layman's terms, this means an AnC attack can break ASLR and allow the attacker to read portions of the computer's memory, which he could then use to launch more complex exploits and escalate access to the entire OS. Researchers have published two papers [1, 2] detailing the AnC attack, along with two videos[1, 2] showing the attack in action.' -- source: https://developers.slashdot.org/story/17/02/15/2149235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

QOTW
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

Re the Internet of Things: A doctor friend of mine said to me many years ago, "Good thing they won't let you put 'General Protection Fault' down as a cause of death on the certificate." <https://forums.theregister.co.uk/forum/containing/3104004>

1 0

Bruce Schneier At The Open Source Leadership Summit
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

"We all had this special right to code the world as we saw fit," said Schneier. "My guess is we're going to lose that right, because it's too dangerous to give to a bunch of techies." <http://www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_c…>

1 0

Would A Phone That Makes Calls Fly In 2017?
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

A company called HMD Global wants to bring back the legendary Nokia 3310 candy-bar phone <https://arstechnica.com/gadgets/2017/02/report-hmd-to-resurrect-legendary-n…>. You regularly see comments from people lamenting the complexity of modern smartphones, and wishing for a return to the simpler days of mobile phones that were good at making calls, with less of all the extra bells and whistles. As well as having much longer battery life. Now we will see if resurrecting a popular model from the days when phones did exactly that will succeed, given that today making calls is one of the last things that people do with their phones...

3 2

Engineering Around Social Media Border Searches
by rowan schischka 15 Feb '17

15 Feb '17

What happens when the 2-factor authentication text gets sent to my NZ phone number, i cant exactly hand that over. I think ill start a bot that posts cat pictures from a fake account. Give the authorities what they want to see. -- Kind Regards Rowan Schischka

1 0