- wlug - list.wlug.org.nz

US NIST Unveils Winning Encryption Algorithm For IoT Data Protection
by Peter Reutemann 09 Feb '23

09 Feb '23

'The National Institute of Standards and Technology (NIST) announced that ASCON is the winning bid for the "lightweight cryptography" program to find the best algorithm to protect small IoT (Internet of Things) devices with limited hardware resources. BleepingComputer reports: ASCON was selected as the best of the 57 proposals submitted to NIST, several rounds of security analysis by leading cryptographers, implementation and benchmarking results, and feedback received during workshops. The whole program lasted for four years, having started in 2019. NIST says all ten finalists exhibited exceptional performance that surpassed the set standards without raising security concerns, making the final selection very hard. ASCON was eventually picked as the winner for being flexible, encompassing seven families, energy efficient, speedy on weak hardware, and having low overhead for short messages. NIST also considered that the algorithm had withstood the test of time, having been developed in 2014 by a team of cryptographers from Graz University of Technology, Infineon Technologies, Lamarr Security Research, and Radboud University, and winning the CAESAR cryptographic competition's "lightweight encryption" category in 2019. Two of ASCON's native features highlighted in NIST's announcement are AEAD (Authenticated Encryption with Associated Data) and hashing. AEAD is an encryption mode that provides confidentiality and authenticity for transmitted or stored data, combining symmetric encryption and MAC (message authentication code) to prevent unauthorized access or tampering. Hashing is a data integrity verification mechanism that creates a string of characters (hash) from unique inputs, allowing two data exchange points to validate that the encrypted message has not been tampered with. Despite ASCON's lightweight nature, NIST says the scheme is powerful enough to offer some resistance to attacks from powerful quantum computers at its standard 128-bit nonce. However, this is not the goal or purpose of this standard, and lightweight cryptography algorithms should only be used for protecting ephemeral secrets. ' -- source: https://it.slashdot.org/story/23/02/08/2239210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android 14 Preview 1 is Out, Will Officially Ban Installation of Old Apps
by Peter Reutemann 09 Feb '23

09 Feb '23

'Android 14 is here -- or the first preview is, at least. From a report: Google is kicking off the months-long developer preview process for Android's latest version, which will get a final release in the second half of the year. Even with multiple previews, Google likes to keep the final set of Android features under wraps at least until its I/O conference in May, so we can't look at the features here to determine the scope of Android 14. These are just some of the features Google wants developers to have a head start on. The biggest news is that Android 14 will block the installation of old Android apps. As Android changes over the years, new APIs and increased security, privacy, or background processing restrictions could break old apps, but Android's backward-compatibility system keeps these old apps running. Apps can declare the newest version of Android they support via a "Target SDK" flag. To prevent old apps from breaking, new features and app restrictions in, say, Android 12 only apply to apps that target Android 12 or above. Older apps will continue to run with the older set of restrictions they're used to. (A different setting, called "Minimum SDK," determines if a new app can run on an old Android OS.) The system works great for honest developers, but if you're building a piece of malware, it's an easy decision to target a very old version of Android. While you'll get access to fewer features, you'll also be subject to fewer security and privacy restrictions. For the first time, Android 14 will close this malware loophole by simply refusing to install old apps. The cutoff point is generous enough that it shouldn't cause anyone problems; any app targeting the 8-year-old Android 6.0 or below will be blocked. Google says it picked Android 6 because it's the version that introduced runtime permissions, the allow/deny boxes that pop up asking for things like camera access. In addition, "some malware apps use a targetSdkVersion of [Android 5.1] to avoid being subjected to the runtime permission model introduced in 2015 by Android 6.0," Google said.' -- source: https://tech.slashdot.org/story/23/02/08/1919253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 6.1 Officially Promoted To Being An LTS Kernel
by Peter Reutemann 09 Feb '23

09 Feb '23

'Linux 6.1 was widely anticipated to be a Long-Term Support (LTS) kernel with normally the last major release series for the calendar year normally promoted to LTS status. Greg Kroah-Hartman as the Linux stable maintainer went ahead today and formally recognized Linux 6.1 as the 2022 LTS kernel. From a report: Greg KH was planning on Linux 6.1 being LTS given its December debut. But he was waiting on feedback from kernel stakeholders over their test results with Linux 6.1 and plans around using Linux 6.1 for the long-term. He's finally collected enough positive responses -- along with co-maintainer Sasha Levin -- that there is confidence in maintaining Linux 6.1 as an LTS series. As of now the plan is on maintaining Linux 6.1 through December 2026, which is just a few months longer than the current Linux 5.15 LTS series that will be maintained through October 2026. We'll see over time if Linux 6.1 ends up potentially being maintained for the longer six-year LTS period that would put it through 2028. However, the number of Linux LTS series being maintained in tandem is growing and will ultimately depend upon how much these kernels are used by major industry players and how much commitment there is for testing of the point release candidates, etc.' -- source: https://linux.slashdot.org/story/23/02/08/174210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

minutes from AGM
by Peter Reutemann 08 Feb '23

08 Feb '23

Hi everyone Apologies for the late update on our AGM last month. You can find the minutes here: http://wiki.wlug.org.nz/MeetingTopics.2023-01-23 Since we were unable to get a quorum, we will try again on February 27th at 7.30pm (in-person and online). Should we be able unable to fill the required offices and spots on the committee, we will start the process for dissolving the society. See above minutes for details. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Mozilla, Like Google, is Looking Ahead To the End of Apple's WebKit Rule
by Peter Reutemann 08 Feb '23

08 Feb '23

'Mozilla is planning for the day when Apple will no longer require its competitors to use the WebKit browser engine in iOS. From a report: Mozilla conducted similar experiments that never went anywhere years ago but in October 2022 posted an issue in the GitHub repository housing the code for the iOS version of Firefox that includes a reference to GeckoView, a wrapper for Firefox's Gecko rendering engine. Under the current Apple App Store Guidelines, iOS browser apps must use WebKit. So a Firefox build incorporating Gecko rather than WebKit currently cannot be distributed through the iOS App Store. As we reported last week, Mozilla is not alone in anticipating an iOS App Store regime that tolerates browser competition. Google has begun work on a Blink-based version of Chrome for iOS. The major browser makers -- Apple, Google, and Mozilla -- each have their own browser rendering engines. Apple's Safari is based on WebKit; Google's Chrome and its open source Chromium foundation is based on Blink (forked from WebKit a decade ago); and Mozilla's Firefox is based on Gecko. Microsoft developed its own Trident rendering engine in the outdated Internet Explorer and a Trident fork called EdgeHTML in legacy versions of Edge but has relied on Blink since rebasing its Edge browser on Chromium code.' -- source: https://news.slashdot.org/story/23/02/07/1733204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Carbonyl: a New Graphical Web Browser in Your Linux Terminal
by Peter Reutemann 07 Feb '23

07 Feb '23

'Long-time Slashdot reader destinyland writes: Someone made a Chromium fork... for your terminal. The terminal-based browser Carbonyl "adheres to, and is compatible with modern standards," writes MUO, "meaning that pages behave as they should, and you can even watch streaming video, within the Linux terminal!" But best of all, "Pages connect and render in an instant—seemingly quicker than a desktop GUI browser, and every page we visited was rendered correctly." >From the article: There are a bunch of good reasons to browse the internet from the comfort of your terminal. It could be that eschewing the bloat of X.org and Wayland, a terminal is all you have. Maybe you like SSHing into remote machines and browsing the internet from there. Perhaps you, like us, just really, really like terminals. Whatever the reason, your choices of web browsers have, until recently, been limited, and your experience of the world wide web has been a janky, barely-functional one.... We tested Carbonyl in a range of Linux terminals, including the XFCE terminal. GNOME terminal, kitty, and the glorious Cool Retro Terminal. Carbonyl was smooth, fast, and flawless in all of them. We even connected to our Raspberry Pi via SSH in CRT, and ran Carbonyl remotely, watching Taylor Swift music videos on YouTube. No problem. And yes, you can use it to play DOOM.' -- source: https://linux.slashdot.org/story/23/02/04/0246248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Swears It's Not Coming For Your Data With Scan For Old Office Versions
by Peter Reutemann 07 Feb '23

07 Feb '23

'Microsoft wants everyone to know that it isn't looking to invade their privacy while looking through their Windows PCs to find out-of-date versions of Office software. From a report: In its KB5021751 update last month, Microsoft included a plan to scan Windows systems to smoke out those Office versions that are no longer supported or nearing the end of support. Those include Office 2007 (which saw support end in 2017) and Office 2010 (in 2020) and the 2013 build (this coming April). The company stressed that it would run only one time and would not install anything on the user's Windows system, adding that the file for the update is scanned to ensure it's not infected by malware and is stored on highly secure servers to prevent unauthorized changes to it. The update caused some discussion among users, at least enough to convince Microsoft to make another pitch that it is respecting user privacy and won't access private data despite scanning their systems. The update collects diagnostic and performance data so that it can determine the use of various versions of Office and how to best support and service them, the software maker wrote in an expanded note this week. The update will silently run once to collect the data and no files are left on the user's systems once the scan is completed.' -- source: https://yro.slashdot.org/story/23/02/06/1753258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

LINUX OS and Desktop build - Compatibility question
by Michael James 02 Feb '23

02 Feb '23

Kia ora WLUG Participants..... Mike here in Whanganui. A total newbie and not at all a Linux programmer nor very knowledgeable about all things Linux but a very enthusiastic Linux proponent and open source advocate. I am trying to put together a new desktop build and wish to know if it will be compatible with the latest version of Linux, whether this be Ubuntu or whichever iteration is appropriate. The components of the build are as follows, and I would be most grateful if experienced participants can have a look at them to see if everything will work together with an appropriate Linux OS so the computer runs smoothly and without any problems for the longterm. *DESKTOP BUILD COMPONENTS* ASUS PRIME Z790-P WIFI-CSM DDR5 Motherboard Corsair CMH64GX5M2B5600C36 Vengeance RGB 64GB (2x32GB) DDR5-5600 XFX Radeon RX 7900 XT SPEEDSTER MERC310 Gaming 20GB Graphics Card Intel Raptor Lake Core i9-13900F Processor Corsair iCUE H150i ELITE CAPELLIX 360mm Liquid CPU Cooler Corsair RM1000e 1000W 80 Plus Gold Fully Modular Kingston NV2 2TB PCIe Gen 4 NVMe M.2 SSD Corsair 4000D Tempered Glass Mid-Tower Seagate IronWolf Pro ST4000NE001 4TB 128MB Hard Drive With kind thanks to all, All the best, Michael James __________________________________________________________________________________________ MICHAEL JAMES PASTROFF phone: inside New Zealand 021 115 3713 outside New Zealand 64 21 115 3713

1 0

EU's Proposed CE Mark for Software Could Have Dire Impact on Open Source
by Peter Reutemann 31 Jan '23

31 Jan '23

'The EU's proposed Cyber Resilience Act (CRA), which aims to "bolster cybersecurity rules to ensure more secure hardware and software products," could have severe unintended consequences for open source software, according to leaders in the open source community. From a report: The proposed Act can be described as CE marking for software products and has four specific objectives. One is to require manufacturers to improve the security of products with digital elements "throughout the whole life cycle." Second is to offer a "coherent cybersecurity framework" by which to measure compliance. Third is to improve the transparency of digital security in products, and fourth is to enable customers to "use products with digital elements securely." The draft legislation includes an impact assessment that says "for software developers and hardware manufacturers, it will increase the direct compliance costs for new cybersecurity requirements, conformity assessment, documentation and reporting obligations." This extra cost is part of a total cost of compliance, including the burden on businesses and public authorities, estimated at EUR 29 billion ($31.54 billion), and consequent higher prices for consumers. However, the legislators foresee a cost reduction from security incidents estimated at EUR 180 to 290 billion annually. The question is though: how can free software developers afford the cost of compliance, when lack of funding is already a critical issue for many projects? Mike Milinkovich, director of the Eclipse Foundation, said it is "deeply concerned that the CRA could fundamentally alter the social contract which underpins the entire open source ecosystem: open source software provided for free, for any purpose, which can be modified and further distributed for free, but without warranty or liability to the authors, contributors, or open source distributors. Legally altering this arrangement through legislation can reasonably be expected to cause unintended consequences to the innovation economy in Europe."' -- source: https://news.slashdot.org/story/23/01/26/1211223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, Hamilton, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Customer Conned Out Of Deposit, Company Liable
by Lawrence D'Oliveiro 30 Jan '23

30 Jan '23

A malicious third party intercepted email messages between a carpeting company and a customer, and was able to send a fake email asking for a deposit to the customer with all the right contact details, but the wrong bank account number <https://www.nzherald.co.nz/lifestyle/hacker-intercepts-carpet-companys-emai…>. And now the Disputes Tribunal has ruled that, since the email looked completely convincing, with the right personal details and everything, it was not reasonable to expect the customer to be suspicious or to want to double-check. And so the company had to wear the cost of the scam.

1 0