- wlug - list.wlug.org.nz

Bug that can leak crypto keys just fixed in widely used OpenSSH
by Peter Reutemann 17 Jan '16

17 Jan '16

'A critical bug that can leak secret cryptographic keys has just just been fixed in OpenSSH, one of the more widely used implementations of the secure shell (SSH) protocol. The vulnerability resides only in the version end users use to connect to servers and not in versions used by servers. A maliciously configured server could exploit it to obtain the contents of the connecting computer's memory, including the private encryption key used for SSH connections. The bug is the result of code that enables an experimental roaming feature in OpenSSH versions 5.4 to 7.1 "The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys," OpenSSH officials wrote in an advisory published Thursday. "The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers." The advisory said that anyone using a vulnerable version should update right away. Those who are unable to update should disable roaming by adding the string UseRoaming no to the global ssh_config(5) file or to the user configuration in ~/.ssh/config, or by entering -UseRoaming=no on the command line.' -- source: http://arstechnica.com/security/2016/01/bug-that-can-leak-crypto-keys-just-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Global Game Jam and Unity Game Engine Introductory Course.
by William Mckee 15 Jan '16

15 Jan '16

Attached an Email I got from Bill Rogers regarding Global Game Jam and some Unity3d training. http://blogs.unity3d.com/2015/08/26/unity-comes-to-linux-experimental-build… cheers, William. ---------- Forwarded message ---------- From: Bill Rogers <coms0108(a)cs.waikato.ac.nz> Date: Tue, Jan 12, 2016 at 11:44 PM Subject: Global Game Jam and Unity Game Engine Introductory Course. To: Bill Rogers <coms0108(a)cs.waikato.ac.nz> Hi Everyone, I'm sending this to all CS and CGD students, 2015 GGJ participants and High School Entrants in the NZ Programming Contest. If you are interested, good. If not feel free to pass it on to anyone you know who might be. If it is unwelcome spam, sorry about that. Global Game Jam is just over two weeks away. As usual we are running a site at Waikato University. On Friday 29th we kick off at 5pm with the 2016 Jam. We are also running an introductory session on using the Unity Game Engine prior to the jam on Thursday 21st January (just over one week away). For those who are new to the idea, GGJ is an international game (computer and board) development festival. For 48 hours (Friday 5pm to Sunday 5pm) people gather and develop games following a theme announced at the start. Almost anyone can take part (at Waikato we have an age limit of 16 or over). If you can program, design, develop artwork, have game ideas, or can game test, or would just like to watch, come and participate. To find out more about this year's event at Waikato and to register go to globalgamejam.org.nz The entry fee at Waikato is $25 - for that you get a t-shirt and meals for the weekend. You can come with friends or come alone and join a team formed at the event. So, if you would like ... 1. ... to attend the Unity Training Session on Thursday Jan 21st (from 1pm) please reply to this email. 2. ... to take part at the Waikato Site for Global Game Jam 2016, please register at globalgamejam.org.nz. (We will ask you for the $25 in due course.) 3. ... to know more about GGJ and see games developed in previous years, visit the global site at www.globalgamejam.org. (Please register to take part at our site, not at the global one.) Bill Rogers and Brian Cole Waikato GGJ Site 2016

1 0

Another Advantage Of Linux Software RAID
by Lawrence D'Oliveiro 11 Jan '16

11 Jan '16

I am a long-time fan of Linux software RAID. But in reading an online discussion which happened to mention variations in actual sizes of storage devices (disks or flash) of supposedly identical capacity, I realized that there is yet another advantage of Linux software RAID: the fact that it can build arrays out of disk partitions, not necessarily entire disks. This means you can create the partitions to be a standard size, slightly smaller than the maximum capacity of the disk. (Each disk will have just one partition on it, the rest of the disk being unused.) Then if you have to replace a failed disk, you can create a new partition of the same size on the replacement. Otherwise, if you use the entire disk, you run the risk that the new disk is a bit smaller than the old one, and trying to add it to the RAID container may fail.

5 12

X.Org Might Lose Its Domain Name
by Lawrence D'Oliveiro 11 Jan '16

11 Jan '16

Seems like the ownership of the x.org domain was not properly handed over during the reorg of the organization into a nonprofit. So now it is likely to expire in a matter of days, unless some (unspecified) back-room maneouvring succeeds... <http://phoronix.com/scan.php?page=news_item&px=X.Org-Domain-Woes>

1 1

a quad core Atom from Intel with added Windows 10
by Ian Young 09 Jan '16

09 Jan '16

Anyone got a use case? http://hardware.slashdot.org/story/16/01/07/2218254/intels-next-gen-compute… What on earth is Core-M you may possibly ask? 'Delving a little deeper into exactly what Core M offers, its headline figure is a Thermal Deisgn Power (TDP - read max power consumption) of just 4.5W. This compares to around 10-15W for a typical laptop processor and 50-100W for desktop processors. Previously this level of power draw was only possible in severely under-powered Atom processors, such as the Bay-Trail line, which were really only good for more simple tablet-type devices. Core M really is the first processor to bridge the gap between ultra-low TDP and acceptable laptop performance. Read more at http://www.trustedreviews.com/opinions/intel-core-m-everything-you-need-to-…'

2 1

Programmers’ Note-To-Selves
by Lawrence D'Oliveiro 08 Jan '16

08 Jan '16

An Ubuntu kernel engineer has done an analysis of how many instances there are in the Linux kernel of comments saying “FIXME” or “TODO”. The total numbers of these are increasing with the size of the code, but at least the number of FIXMEs per source line seems to be going down. <http://phoronix.com/scan.php?page=news_item&px=Linux-Kernel-FIXME-TODO>

1 0

Elementary OS' Freya Dumbs Down Linux
by Peter Reutemann 07 Jan '16

07 Jan '16

'The release last month of Elementary OS Freya version 0.3.2 showed little has changed in this new-style Linux distro that wraps its own lightweight desktop design around the Ubuntu core. Elementary OS first appeared in 2011. I last looked at its Freya beta release in 2014. I liked its fresh, new look and simplified approach to desktop management. However, my hopes for more features and a faster-evolving desktop environment in the latest release went unfulfilled.' -- source: http://www.linuxtoday.com/infrastructure/elementary-os-freya-dumbs-down-lin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android N switches to OpenJDK, Google tells Oracle it is protected by the GPL
by Peter Reutemann 07 Jan '16

07 Jan '16

'The Oracle v. Google legal battle over the use of Java in Android keeps on going, but this week Google made a change to Android that it hopes will let the company better navigate its current legal trouble. Google told VentureBeat that it in "Android N," the next major version of Android, it is swapping Android's Java libraries from its own Apache Harmony-based implementation to one based on Oracle's OpenJDK—yes that Oracle, the same company suing Google. OpenJDK is the "official" open source version of the Java Platform, and Oracle makes it available under the GPL with a linking exception.' -- source: http://arstechnica.com/tech-policy/2016/01/android-n-switches-to-openjdk-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Murdock On The Birth Of Debian
by Lawrence D'Oliveiro 06 Jan '16

06 Jan '16

Noted Free Culture rapporteur Glyn Moody recalls his 1999 interview with late Debian founder Ian Murdock about the genesis of the project: <http://arstechnica.com/information-technology/2016/01/the-birth-of-debian-i…>. As Murdock told me in 1999, the problems arose from the fact that "the fellow who was doing [SLS] was trying to do everything himself. And so I looked on that and I thought, well, you know, if Linux has taught us anything it's that that kind of model is sub-optimal. What we really ought to do is we ought try to take the model that Linux has pioneered, intentionally or not, and try to get the same benefits from that for building the system around it."

1 0

Microsoft's Latest Patent Aggression Comes Under Fire From the EFF, Former GNU/Linux Company the Patent's Target
by Peter Reutemann 04 Jan '16

04 Jan '16

'MICROSOFT, which is connected to many patent trolls (includingIntellectual Ventures, the world’s biggest), is still busy suing companies. Microsoft has a long history of patent aggression, including patent litigation against Linux (not just threats thereof). As longtime readers of this site may know, this and only this was the raison d’être of this Web site. “…since winning a case for infringement of design patents can lead to a damage analysis based on “lost profits,” which can theoretically lead to a patent owner getting all of a defendant’s profits.” –Joe MullinAs we noted the other day, referring tothe original from the EFF, Microsoft is now attacking a company that once dominated word processing. Microsoft allegedly engaged in competition crimes against this company, leading to decades of expensive litigation. This company also pioneered some important GNU/Linux efforts until Microsoft shut these down with a mysterious deal (which we wrote about on several occasions around 2007). Well, Microsoft is now trying to drive this company into bankruptcy, using patents. What’s the name of this company? Corel. We have a whole category about Corel (with 51 articles, as well as leaked court documents). History is important here and it’s imperative that people properly study Corel to truly grasp how severe this situation really is.' -- source: http://techrights.org/2015/12/31/patent-aggression-against-corel/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0