- wlug - list.wlug.org.nz

Tips For Securing Your Secure Shell
by Peter Reutemann 07 Jan '15

07 Jan '15

"As you may have heard, the NSA has had some success in cracking Secure Shell (SSH) connections. To respond to these risks, a guide written by Stribika tries to help you make your shell as robust as possible. The two main concepts are to make the crypto harder and make stealing keys impossible. So prepare a cup of coffee and read the tutorial carefully to see what could be improved in your configuration. Stribika gives also some extra security tips: don't install what you don't need (as any code line can introduce a bug), use the kind of open source code that has actually been reviewed, keep your software up to date, and use exploit mitigation technologies." -- source: http://it.slashdot.org/story/15/01/07/161227 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Browsing in privacy mode? Super Cookies can track you anyway
by Peter Reutemann 07 Jan '15

07 Jan '15

"For years, Chrome, Firefox, and virtually all other browsers have offered a setting that doesn't save or refer to website cookies, browsing history, or temporary files. Privacy-conscious people rely on it to help cloak their identities and prevent websites from tracking their previous steps. Now, a software consultant has devised a simple way websites can in many cases bypass these privacy modes unless users take special care." -- source: http://goo.gl/jnkuaA Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

I Just Want The Root Filesystem!
by Lawrence D'Oliveiro 06 Jan '15

06 Jan '15

Sometimes you want to perform some operation on the volume mounted at /, but not in any volume mounted under it. Some commands (e.g. “find” and “rsync”) provide options to avoid recursing into lower filesystems, but others (e.g. “du”) don’t make it so easy. A simple technique for getting around this is to use a bind mount. For example, after mount --bind / /mnt the /mnt directory shows you a view of the same filesystem as /, except you will notice that directories like /mnt/proc and (assuming your user files are on a separate volume) /mnt/home are empty. Or, to be more precise, those directories are now showing their original contents, unobscured by any other filesystem mounted on top of them. An example use of this is, the root partition on a machine might be filling up, and I want to know why. To narrow down which directories are using the space, I try to do du -ks /*/ but this wants to scan /home/ as well, which on this machine is a separate volume and therefore just adds greatly to the time taken without telling me anything relevant. But with the bind mount, I can do du -ks /mnt/*/ and it will only check the root volume. Another use of this is, as I mentioned above, you can see what is originally in the directories being used for mounting other filesystems. For example, one machine might normally have a network volume from another server mounted on a directory into which it regularly saves files. For some reason the network link might go down, and during that interval it blithely continues saving files into the local directory where the network volume was mounted, rather than the network volume itself. After the network mount is restored, you will probably want to check what files were accidentally saved locally, and move them onto the network volume where they belong. A bind mount lets you do this without disrupting access to the network volume. Then when you are finished with the bind mount, you can get rid of it in the usual way: umount /mnt

1 0

Life With Debian Unstable
by Lawrence D'Oliveiro 06 Jan '15

06 Jan '15

Doing an “apt-get dist-upgrade -s” on a Debian Unstable system is currently telling me it wants to remove most of KDE. This even though I tried an apt-get update on two different repo mirrors. I think I’ll leave it, and check again in a few days...

1 0

Browsing The Linux Kernel Sources Online
by Lawrence D'Oliveiro 06 Jan '15

06 Jan '15

You may remember at one of my presentations I was trying to bring up a website that allowed browsing and linking to the Linux kernel sources online, complete with cross references and search. However, that original site seems to have long gone. The good news is, another site <http://lxr.free-electrons.com/> is offering exactly the same thing, and I think they’re using the same software (developed by people at Oslo University in Norway) as well.

1 0

AMD Catalyst Linux Driver Catching Up To and Beating Windows
by Peter Reutemann 03 Jan '15

03 Jan '15

'Along with the open-source AMD Linux driver having a great 2014, the AMD Catalyst proprietary driver for Linux has also improved a lot. Beyond the open-source Radeon Gallium3D driver closing in on Catalyst, the latest Phoronix end-of-year tests show the AMD Catalyst Linux driver is beating Catalyst on Windows for some OpenGL benchmarks. The proprietary driver tests were done with the new Catalyst "OMEGA" driver. Is AMD beginning to lead real Linux driver innovations or is OpenGL on Windows just struggling?' -- source: http://linux.slashdot.org/story/15/01/03/1426208 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Red Hat Engineer Improves Math Performance of Glibc
by Peter Reutemann 03 Jan '15

03 Jan '15

"Siddhesh Poyarekar from Red Hat has taken a professional look into mathematical functions found in Glibc (the GNU C library). He has been able to provide an 8-times performance improvement to slowest path of pow() function. Other transcendentals got similar improvements since the fixes were mostly in the generic multiple precision code. These improvements already went into glibc-2.18 upstream. Siddhesh believes that a lot of the low hanging fruit has now been picked, but that this is definitely not the end of the road for improvements in the multiple precision performance. There are other more complicated improvements, like the limitation of worst case precision for exp() andlog() functions, based on the results of the paper Worst Cases for Correct Rounding of the Elementary Functions in Double Precision (PDF). One needs to prove that those results apply to the Glibc multiple precision bits." -- source: http://linux.slashdot.org/story/15/01/02/2025232 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Bots Scanning GitHub To Steal Amazon EC2 Keys
by Peter Reutemann 03 Jan '15

03 Jan '15

'As one developer found out, posting your Amazon keys to GitHub on accident can be a costly mistake if they are not revoked immediately. "When I woke up the next morning, I had four emails from Amazon AWS and a missed phone call from Amazon AWS. Something about 140 servers running on my AWS account. What? How? I only had S3 keys on my GitHub and they where gone within 5 minutes! Turns out through the S3 API you can actually spin up EC2 instances, and my key had been spotted by a bot that continually searches GitHub for API keys. Amazon AWS customer support informed me this happens a lot recently; hackers have created an algorithm that searches GitHub 24 hours per day for API keys. Once it finds one it spins up max instances of EC2 servers to farm itself bitcoins."' -- source: http://it.slashdot.org/story/15/01/02/2342228 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

The Case Against "Non-Commercial" Restrictions
by Lawrence D'Oliveiro 21 Dec '14

21 Dec '14

The Creative Commons <http://creativecommons.org/> family of copyright licences has become very popular for artworks, documentation and all kinds of creative works generally. But there are different kinds of Creative Commons (CC) licences, with additional qualifications, namely “BY” (attribution required, i.e. give credit to the creators), “SA” (sharealike or “copyleft”, i.e. if you redistribute, do it on the same terms it was given to you), “NC” (non-commercial use only) and “ND” (no derivatives--i.e. modified versions--allowed), and certain combinations thereof. These qualifications divide the CC licences into two categories: Free and non-Free. The non-Free CC licences are those including NC or ND or both, while the Free ones are the rest: * CC0 -- effectively public domain * CC-BY -- distribution with attribution required * CC-BY-SA -- sharealike distribution with attribution If you want to promote sharing and contribute to Free Culture, stick to these three licences. In particular, here <http://freedomdefined.org/Licenses/NC> is a detailed discussion of the NC restriction, and why it is such a bad idea. Most people who stick an NC licence on their work think in terms of preventing big commercial outfits from “ripping them off”. However, this licensing restriction may not achieve what you think it does, particularly since it is often unclear what constitutes “commercial” use anyway.

1 0

Does Anybody Like GNU Info?
by Lawrence D'Oliveiro 21 Dec '14

21 Dec '14

Anybody who has looked at Linux documentation on the command line would know about man pages, and quite likely about GNU info as well. The GNU project invented the “info” system as a (supposedly) superior replacement for man pages, but for some reason it never became that popular. I personally find it quite annoying to use, and it’s clear I’m not the only one. The GNU info system requires documentation to be written in Texinfo format, from which it can be generated in other formats displayable with the info command as well as other means. Now at least one GNU project, namely Emacs <http://lwn.net/Articles/625072/>, is contemplating moving away from maintaining its documentation in Texinfo format. The suggestion is to use AsciiDoc instead. This is one of a raft of newer, simpler markup formats that are designed so that even the source can be read and understood by ordinary humans, since the appearance of many of the markup sequences already gives some indication of their function in the layout. You may also have heard of Markdown (GitHub uses a flavour of this) and reStructedText (understood by Docutils/Sphinx, the standard toolset for Python documentation)--these are variations on the same idea. The LWN article has an error in it, though: the AsciiDoc package itself is not constrained to only generating HTML, it can output (shudder) DocBook SGML as well. And then there is another piece of software called Pandoc, which can convert between a whole range of different formats, including AsciiDoc.

1 0