- wlug - list.wlug.org.nz

WLUG meeting next Monday
by Peter Reutemann 17 Feb '16

17 Feb '16

Hi everyone We have a meeting coming up next Monday: "Peter Reutemann will demo Alpine Linux, a security-oriented, lightweight Linux distribution based on musl libc and busybox. Discussion of March meeting: potential introduction to git version control, in conjunction with CS^3 student society from Computer Science. Discussion of meetup.com's new pricing strategy: going up from USD 12 per 6 months to USD 29.94 per 6 months. Feel like demoing another distro? Or some other great open-source tool (doesn't necessarily have to be Linux)? Then let me know." http://www.meetup.com/WaikatoLinuxUsersGroup/events/228718557/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

New Warnings In GCC 6
by Lawrence D'Oliveiro 16 Feb '16

16 Feb '16

Couple of interesting blog posts <https://gnu.wildebeest.org/blog/mjw/2016/02/15/looking-forward-to-gcc6-many…>, <https://gnu.wildebeest.org/blog/mjw/2016/01/09/looking-forward-to-gcc6-nice…> about new dubious-looking constructs that the GCC 6 C and C++ compilers can pick up. I particularly like the latter, which warns against a situation like the following: if (cond) statement_guarded_by_cond; statement_not_guarded_by_cond; /* though it may look like it is */ Of course, this only works in a language that allows the redundancy of having both bracketing symbols and indentation. This is why trying to get rid of one, and having the other do duty for both--is such a bad idea.

2 2

UEFI aka Ooof!!y links - more than a lifetime to know
by Ian Young 13 Feb '16

13 Feb '16

Following a recent refererence to the dread Oofy at a LUG meeting and after looking at a couple of Intel PC type machines using this boot method I am pretty well totally baffled. The people of Arch however know it all. Or as much as can be known. https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface#… I seem to have a vague recollection that Sun once used Ooofy. And Apple of course was an early adopter. Or am I thinking of Open Firmware? Somewhat related. Hmmm. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface https://en.wikipedia.org/wiki/Open_Firmware

1 0

The Truth Behind “true”
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

Among the many useful commands you will find as standard on any POSIX system is “true”. This command does absolutely nothing, but returns a successful exit status. (There is also “false”, which also does nothing, but always returns a failure status. If anyone is curious as to how you would make use of these in shell scripts, just ask.) This page <http://trillian.mit.edu/~jc/humor/ATT_Copyright_true.html> gives the history of the “true” command from the original AT&T Unix--it was essentially a shell script that did absolutely nothing at all. Yet AT&T claimed copyright on it. This article <http://www.theregister.co.uk/2016/02/10/line_break_ep2/> includes, among its examples of supposedly bad code, the full source of the GNU “true” program (which actually also shares its source with the “false” program), which runs to 80 lines, as compared to the version from OpenBSD, which is just four lines (including a blank line and comments). But as pointed out in the previous link, the GNU version uses less memory and runs faster.

2 1

San Francisco To Open-Source Its Voting Software
by Lawrence D'Oliveiro 11 Feb '16

11 Feb '16

The San Francisco Elections Commission has resolved to “support the development and certification of an open source voting system running on commercial off-the-shelf hardware; and to request that the Mayor and Board of Supervisors initiate and fund a project to develop and certify such a system for use in San Francisco”. <http://www.theregister.co.uk/2016/02/10/san_francisco_to_open_source_voting…> Contrast this with ongoing unsuccessful attempts to get access to the software used for Australian federal elections under its Freedom Of Information Act <http://www.theregister.co.uk/2015/12/13/aec_easycount_foi_decision/>: [Hobart lawyer Michael] Cordover sought the source code because Australia's 2013 election produced some irregularities. What software do we use in NZ?

2 1

Docker Images To Be Based On Alpine Linux
by Peter Reutemann 07 Feb '16

07 Feb '16

"Docker container sizes continue a race to the bottom with a couple of environments weighing in at less than 10MB. Following on the heels of this week's story regarding small images based on Alpine Linux, it appears that the official Docker images will be moving from Debian/Ubuntu to Alpine Linux in the near future. How low will they go?" -- source: http://linux.slashdot.org/story/16/02/06/0433228 Alpine Linux is rather small, coming in at 82MB as ISO download: http://www.alpinelinux.org/ Anybody feel like giving a demo at the next meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Open Source Pioneer Michael Tiemann On the Myth of the Average
by Peter Reutemann 03 Feb '16

03 Feb '16

'In a recent article, Michael Tiemann, one of the world's first open source entrepreneurs and VP of Open Source Affairs at Red Hat, highlights an example from the 1950s US Air Force where the "myth of the average resulted in a generation of planes that almost no pilots could reliably fly, and which killed as many as 17 pilots in a single day." He uses this example to argue that IT leaders who think that playing it safe means being as average as possible in order to avoid risks (i.e. "Buy what others are buying. Deploy what others are deploying. Manage what others are managing.") may be making IT procurement and strategy decisions based on flawed data. Instead, Tiemann says that IT leaders should understand elements of differentiation that are most valuable, and then adopt the standards that exploit them. "Don't aim for average: it may not exist. Aim for optimal, and use the power of open source to achieve what uniquely benefits your organization."' -- source: http://it.slashdot.org/story/16/02/03/177233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

New Hack Shrinks Docker Containers
by Peter Reutemann 03 Feb '16

03 Feb '16

'Promising "uber tiny Docker images for all the things," Iron.io has released a new library of base images for every major language optimized to be as small as possible by using only the required OS libraries and language dependencies. "By streamlining the cruft that is attached to the node images and installing only the essentials, they reduced the image from 644 MB to 29MB,"explains one technology reporter, noting this makes it quicker to download and distribute the image, and also more secure. "Less code/less programs in the container means less attack surface..." writes Travis Reeder, the co-founder of Iron.io, in a post on the company's blog. "Most people who start using Docker will use Docker's official repositories for their language of choice, but unfortunately if you use them, you'll end up with images the size of the Empire State Building..."' -- source: http://developers.slashdot.org/story/16/02/03/221231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chromodo Browser Disables Key Web Security
by Peter Reutemann 03 Feb '16

03 Feb '16

"A Google Security Research update has claimed that Comodo's internet browser Chromodo, based on the open-source project Chromium, contains significant security failings and puts its users at risk. This week's Google alert suggested that the Chromodo browser – available as a standalone download, as well as part of the company's Security package – is less secure than it promises. According to analysis, the browser is disabling the Same Origin policy, hijacking DNS settings, and replacing shortcuts with Chromodo links, among other security violations." -- source: http://it.slashdot.org/story/16/02/03/1416236 NB: I know that the browser is for Windows, but you might know someone who's using it, blindly trusting the marketing of Comodo. Chromium builds are available here: https://www.chromium.org/getting-involved/dev-channel Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Crypto flaw was so glaring it may be intentional eavesdropping backdoor
by Peter Reutemann 03 Feb '16

03 Feb '16

"Socat is a more feature-rich variant of the once widely used Netcat networking service for fixing bugs in network applications and for finding and exploiting security vulnerabilities. One of its features allows data to be transmitted through an encrypted channel to prevent it from being intercepted by people monitoring the traffic. Amazingly, when using the Diffie-Hellman method to establish a cryptographic key, Socat used a non-prime parameter to negotiate the key, an omission that violates one of the most basic cryptographic principles." -- source: http://arstechnica.com/security/2016/02/crypto-flaw-was-so-glaring-it-may-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1