- wlug - list.wlug.org.nz

Georgia Institute of Technology Researchers Bridge the Airgap
by Peter Reutemann 29 Jan '15

29 Jan '15

"Hacked has a piece about Georgia Institute of Technology researchers keylogging from a distance using the electromagnetic radiation of CPUs. They can reportedly do this from up to 6 meters away. In this video, using two Ubuntu laptops, they demonstrate that keystrokes are easily interpreted with the software they have developed. In their white paper they talk about the need for more research in this area so that hardware and software manufacturers will be able to develop more secure devices. For now, Farraday cages don't seem as crazy as they used to, or do they?" -- source: http://it.slashdot.org/story/15/01/29/141243 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Mozilla Dusts Off Old Servers, Lights Up Tor Relays
by Peter Reutemann 29 Jan '15

29 Jan '15

"According to The Register, "Mozilla has given the Tor network a capacity kick with the launch of 14 relays that will help distribute user traffic. Engineers working under the Foundation's Polaris Project inked in November pulled Mozilla's spare and decommissioned hardware out of the cupboard for dedicated use in the Tor network. It included a pair of Juniper EX4200 switches and three HP SL170zG6 (48GB ram, 2*Xeon L5640, 2*1Gbps NIC) servers, along with a dedicated existing IP transit provider (2 X 10Gbps). French Mozilla engineer Arzhel Younsi (@xionoxfr) said its network was designed to fall no lower than half of its network capacity in the event of maintenance or failure. The Polaris initiative was a effort of Mozilla, the Tor Project and the Centre for Democracy and Technology to help build more privacy controls into technology." -- source: http://hardware.slashdot.org/story/15/01/29/192215 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu 15.04 Is The Easy Path To Better Performance For Ubuntu Users On Intel Broadwell
by Peter Reutemann 29 Jan '15

29 Jan '15

"Unless you manually upgrade your kernel and other system packages from your Ubuntu 14.10 installation, Ubuntu 15.04 Vivid Vervet is an important release for users of new Intel Broadwellsystems for ensuring your hardware reaches its maximum performance potential." -- source: http://www.phoronix.com/scan.php?page=article&item=ubuntu-1504-5600u&num=1 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Serious Network Function Vulnerability Found In Glibc
by Peter Reutemann 28 Jan '15

28 Jan '15

"A very serious security problem has been found and patched in the GNU C Library (Glibc). A heap-based buffer overflow was found in __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() function calls. A remote attacker able to make an application call to either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the program. The vulnerability is easy to trigger as gethostbyname() can be called remotely for applications that do any kind of DNS resolving within the code. Qualys, who discovered the vulnerability (nicknamed "Ghost") during a code audit, wrote a mailing list entry with more details, including in-depth analysis and exploit vectors." -- sources: http://news.slashdot.org/story/15/01/27/1925208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

3 4

Opera Founder Is Back, WIth a Feature-Heavy, Chromium-Based Browser
by Peter Reutemann 27 Jan '15

27 Jan '15

"Almost two years ago, the Norwegian browser firm Opera ripped out the guts of its product and adopted the more standard WebKit and Chromium technologies, essentially making it more like rivals Chrome and Safari. But it wasn't just Opera's innards that changed; the browser also became more streamlined and perhaps less geeky. Many Opera fans were deeply displeased at the loss of what they saw as key differentiating functionality. So now Jon von Tetzchner, the man who founded Opera and who would probably never have allowed those drastic feature changes, is back to serve this hard core with a new browser called Vivaldi." -- source: http://tech.slashdot.org/story/15/01/27/1733259 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 3

EFF Unveils Plan For Ending Mass Surveillance
by Peter Reutemann 27 Jan '15

27 Jan '15

'The Electronic Frontier Foundation has published a detailed, global strategy for ridding ourselves of mass surveillance. They stress that this must be an international effort — while citizens of many countries can vote against politicians who support surveillance, there are also many countries where the citizens have to resort to other methods. The central part of the EFF's plan is: encryption, encryption, encryption. They say we need to build new secure communications tools, pressure existing tech companies to make their products secure against everyone, and get ordinary internet-goers to recognize that encryption is a fundamental part of communication in the surveillance age. They also advocate fighting for transparency and against overreach on a national level. "[T]he more people worldwide understand the threat and the more they understand how to protect themselves—and just as importantly, what they should expect in the way of support from companies and governments—the more we can agitate for the changes we need online to fend off the dragnet collection of data." The EFF references a document created to apply the principles of human rights to communications surveillance, which they say are "our way of making sure that the global norm for human rights in the context of communication surveillance isn't the warped viewpoint of NSA and its four closest allies, but that of 50 years of human rights standards showing mass surveillance to be unnecessary and disproportionate."' -- source: http://yro.slashdot.org/story/15/01/27/042212 Cheers, Pete -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linus Fixes Kernel Regression Breaking Witcher 2
by Peter Reutemann 24 Jan '15

24 Jan '15

'There has been quite a debate around the Linux version of The Witcher 2: Assassins of Kings and the fact that it wasn't really a port. A special kind of wrapper was used to make the Windows version of the game run on Linux systems, similar to Wine. The performance on Linux systems took a hit and users felt betrayed because they thought that they would get a native port. However, after the gamestopped launching properly at some point, the reason was actually found to be a Linux regression.Linus quickly took care of the issue on an unofficial Witcher 2 issue tracker on GitHub: "It looks like LDT_empty is buggy on 64-bit kernels. I suspect that the behavior was inconsistent before the tightening change and that it's now broken as a result. I'll write a patch. Serves me right for not digging all the way down the mess of macros." This one goes to the bin "don't break userspace". Linus also reminds of QA: "And maybe this is an excuse for somebody in the x86 maintainer team to try a few games on steam. They *are* likely good tests of odd behavior.."' -- source: http://games.slashdot.org/story/15/01/24/1528232 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Accidentally Deleting Directories
by Lawrence D'Oliveiro 21 Jan '15

21 Jan '15

I suppose every seasoned Linux user has been there (I know I have): done “rm -rf” (or equivalent) to wipe out a directory, only to realize--too late--that it was the wrong one. There’s a discussion currently raging <http://www.theregister.co.uk/2015/01/17/scary_code_of_the_week_steam_cleans…> over a bug just like this in the Steam client for Linux. There is a script that contains the line rm -rf "$STEAMROOT/"* However, as a result of certain (unusual) user actions, the value of the STEAMROOT variable could end up empty, in which case the script proceeds to wipe out every file on the system that your userid has privilege over. What’s the best way to handle this? On the one hand, when setting up a new installation/preferences directory, you want to ensure there is no leftover rubbish in it. But on the other, you want to ensure that any existing directory you delete/replace is in fact an old installation/preferences directory. I’m leaning towards the solution--discussed in the GitHub issue entry--of checking for some distinctive file in the existing directory. If that doesn’t exist, then the directory is not what the script thinks it is. For example, my wipetree script <https://github.com/ldo/git-useful/blob/master/wipetree> checks that there is a .git subdirectory in the directory you want to wipe. It also helps to use “set -e”, so bash aborts the script on an error, instead of barrelling on.

2 1

Canonical Launches Internet-of-Things Version of Ubuntu Core
by Peter Reutemann 21 Jan '15

21 Jan '15

'Ubuntu Linux isn't just for desktops, servers and the cloud anymore. Mark Shuttleworth wants Ubuntu to be the operating system of choice for the Internet of Things too. The new Snappy Ubuntu Core is targeted at device developers and it's the basis for an entire new division of Canonical Inc. The promise of Snappy Ubuntu Core is also one of security, protecting the devices of the world, by keeping them updated. "With Snappy there is also a division of responsibilities for updating that can also help protect IoT devices and users. So we could deliver an update for a Heartbleed or Shellshock vulnerability, completely independently of the lawnmower control app that would come from the lawnmower company," Shuttleworth said.' -- source: http://news.slashdot.org/story/15/01/20/2347214 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

3 6

The current state of video editing for Linux
by Peter Reutemann 21 Jan '15

21 Jan '15

"I often ask myself what the current state of video editing is for free and open source software (FOSS). Here are my thoughts. I've spent many years in the visual effects (VFX) industry from the perspective of being either an artist, compositor, video editor, or systems engineer. (I've even got film creds on IMDB!) In the past, I had the pleasure of cutting on, training people on, setting up, and supporting Avid Media Composer, the cream of the crop of professional real-time video editing tools for film and TV alike—at least before things like Final Cut Pro and Adobe Premiere became useful enough to professionals." Tested: Pitivi, OpenShot, Lightworks, Avidemux, Cinelerra, KDEnlive, Blender The winner (spoiler): Blender -- source: http://opensource.com/life/15/1/current-state-linux-video-editing Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

3 3