- wlug - list.wlug.org.nz

Critical Git Security Vulnerability Announced
by Peter Reutemann 19 Dec '14

19 Dec '14

'Github has announced a security vulnerability and has encourage users to update their Git clients as soon as possible. The blog post reads in part: "A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, github.com and GitHub Enterprise are not directly affected. The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux clients are not affected if they run in a case-sensitive filesystem....Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and both contain the security fix on the Desktop application itself and on the bundled version of the Git command-line client."' -- source: http://it.slashdot.org/story/14/12/18/2346238 Cheers, Petere -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Grinch Vulnerability Could Put a Hole In Your Linux Stocking
by Peter Reutemann 18 Dec '14

18 Dec '14

"In a blog post Tuesday, security service provider Alert Logic warned of a Linux vulnerability, named grinch after the well-known Dr. Seuss character, that could provide attackers with unfettered root access. The fundamental flaw resides in the Linux authorization system, which can inadvertently allow privilege escalation, granting a user full administrative access. Alert Logic warned that Grinch could be as severe as the Shellshock flaw that roiled the Internet in September." -- source: http://linux.slashdot.org/story/14/12/18/2022245 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Manufacturer's Backdoor Found On Popular Chinese Android Smartphone
by Peter Reutemann 17 Dec '14

17 Dec '14

"A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users' consent. The Coolpad devices, however, are ripe for much more malicious abuse, researchers at Palo Alto Networks said today, especially after the discovery of a vulnerability in the backend management interface that exposed the backdoor's control system. Ryan Olson, intelligence director at Palo Alto, said the CoolReaper backdoor not only connects to a number of command and control servers, but is also capable of downloading, installing and activating any Android application without the user's permission. It also sends phony over-the-air updates to devices that instead install applications without notifying the user. The backdoor can also be used to dial phone numbers, send SMS and MMS messages, and upload device and usage information to Coolpad." -- source: http://it.slashdot.org/story/14/12/17/1815250 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Python Moving To Git
by Lawrence D'Oliveiro 16 Dec '14

16 Dec '14

About 5½ years ago, the decision was made <http://lwn.net/Articles/326201/> to use Mercurial as the preferred version-control system (VCS) for Python development. It was already clear at the time that there was a strong preference among developers for Git instead of Mercurial. And since that time, the dominance of Git has only grown. It appears that Mercurial is still the official VCS for at least the CPython core, but the Python project already has a GitHub area <https://github.com/python> which includes a “Semi-official read-only mirror of the CPython Mercurial repository”. I would suspect that a lot of their contributors are already doing their work in Git, and communicating with the upstream Mercurial repo using an addon like git-remote-hg, which makes it look just like a native Git repo. Now there is a plan to migrate at least some supporting repositories <http://lwn.net/Articles/624101/> <http://lwn.net/Articles/623905/> officially to Git, and also use GitHub to host these instead of at python.org. These stats from the PEP are quite interesting: The Open Hub (Previously Ohloh) statistics ... show that currently 37% of the repositories Open Hub is indexing is using git which is second only to SVN (which has 48%) while Mercurial has just 2% of the indexed repositories (beating only bazaar which has 1%). In addit[i]on to the Open Hub statistics a look at the top 100 projects on PyPI (ordered by total download counts) shows us that within the Python space itself there is a majority of projects using git: === ========= ========== ====== === ==== Git Mercurial Subversion Bazaar CVS None === ========= ========== ====== === ==== 62 22 7 4 1 1 === ========= ========== ====== === ==== Interesting that Subversion (aka SVN, an older, centralized, much less flexible version-control system) manages to handily beat Mercurial in non-Python-specific projects...

1 0

Raspberry Pi In Space
by Peter Reutemann 14 Dec '14

14 Dec '14

"When British astronaut Tim Peake heads off to the International Space Station in November 2015 he will be accompanied on his 6-month mission by two augmented Rapsberry Pis, aka Astro Pis. The Astro Pi board is a Raspberry Pi HAT and provides gyroscope, accelerometer and magnetometer and sensors for temperature, barometric pressure and humidity. It also has a real time clock, LED display and some push buttons — it sounds like the sort of addon that we could do with down here on earth as well! It will also be equipped with both camera module and an infra-red camera. UK school pupils are being challenged to write Rapberry Pi apps or experiments to run in space. During his mission Tim Peake will deploy the Astro Pis, upload the winning code whilst in orbit, set them running, collect the data generated and then download it to be distributed to the winning teams." -- source: http://build.slashdot.org/story/14/12/14/1827252 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Linux Mint 17.1 review—less change is good change
by Peter Reutemann 10 Dec '14

10 Dec '14

"This marks the first time Linux Mint has not used the newest version of Ubuntu for a release. But if you paid attention to the curious approach of Linux Mint 17.0, you'll know that was the plan all along. These days, Mint will not be changing its Ubuntu base again until the next LTS release—Ubuntu 16.04—arrives in 2016. And at first glance, it might seem like a bad thing. After all, Mint is missing out on whatever new stuff is in Ubuntu 14.10 (in this case it's not much, but 15.04 will have plenty of changes)." -- source: http://goo.gl/zaWPTV Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

$35 Quad-core Hacker SBC Offers Raspberry Pi-like Size and I/O
by Peter Reutemann 10 Dec '14

10 Dec '14

"Hardkernel has again set its sites on the Raspberry Pi with a new $35 Odroid-C1 hacker board that matches the RPI's board size and offers a mostly similar 40-pin expansion connector. Unlike the previous $30 Odroid-W that used the same Broadcom BCM2835 SoC as the Pi and was soon cancelled due to lack of BCM2835 SoC availability, the Odroid-C1 is based on a quad-core 1.5GHz Cortex-A5 based Amlogic S805 SoC, which integrates the Mali-400 GPU found on Allwinner's popular SoCs. Touted advantages over the similarly priced Raspberry Pi Model B+ include a substantially more powerful processor, double the RAM, an extra USB2.0 port that adds Device/OTG, and GbE rather than 10/100 Ethernet." -- source: http://hardware.slashdot.org/story/14/12/10/1334251 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Ubuntu Gets Container-Friendly "Snappy" Core
by Peter Reutemann 10 Dec '14

10 Dec '14

'Canonical just announced Ubuntu Core, which uses containers instead of packages. It's the biggest Ubuntu shakeup for 20 years, says Canonical's Mark Shuttleworth, and is based on a tiny core, which will run Docker and other container technology better, quicker and with greater security than other Linux distros. Delivered as alpha code today, it's going to become a supported product, designed to compete with both CoreOS and Red Hat Atomic, the two leading container-friendly Linux approaches. Shuttleworth says it came about because Canonical found it had solved the "cloud" problems (delivering and updating apps and keeping security) by accident — in its work on a mobile version of Ubuntu.' -- source: http://linux.slashdot.org/story/14/12/09/2225210 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0

Unity 8 Will Bring 'Pure' Linux Experience To Mobile Devices
by Peter Reutemann 09 Dec '14

09 Dec '14

'If you have tried the live images of Ubuntu Next you may worry that Canonical is trying to do a Windows 8 with Ubuntu. That's not true. There is no need to worry though: A great deal of work is happening at a deeper level that may not have yet surfaced. It will surface eventually, however. Will Cooke of Canonical clarifies: "We are trying to make it clear that Unity 8 desktop will look like the traditional desktop and will behave like a normal desktop. We are very aware that our users expect a normal desktop there." Unity 8 will offer the traditional desktop interface when it detects a desktop. The same OS will switch to a touch-based interface on touch-based devices such as tablets and smartphones.' -- source: http://linux.slashdot.org/story/14/12/09/1516240 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

2 1

Just-Announced X.Org Security Flaws Affect Code Dating Back To 1987
by Peter Reutemann 09 Dec '14

09 Dec '14

'Some of the worst X.Org security issues were just publicized in an X.Org security advisory. The vulnerabilities deal with protocol handling issues and led to 12 CVEs published and code dating back to 1987 is affected within X11. Fixes for the X Server are temporarily available via this Git repository.' -- source: http://it.slashdot.org/story/14/12/09/1747212 Cheers, Peter -- Peter Reutemann, Dept. of Computer Science, University of Waikato, NZ http://www.cms.waikato.ac.nz/~fracpete/ Ph. +64 (7) 858-5174

1 0