- wlug - list.wlug.org.nz

Term Of The Week: “Electronic Suppression Software”
by Lawrence D'Oliveiro 13 Dec '22

13 Dec '22

What is “Electronic Suppression Software” (ESS)? It’s the computer equivalent of the old accounting scam of keeping two sets of books -- the one where you record the real profits of the business, and the one you show to the tax department <https://www.nzherald.co.nz/business/ird-warns-businesses-of-severe-conseque…>. This software seems to work at retail point-of-sale (tills). There have been some international raids lately on those suspected of supplying or using such tools.

1 0

Xnspy Stalkerware Spied on Thousands of iPhones and Android Devices
by Peter Reutemann 13 Dec '22

13 Dec '22

'A little-known phone monitoring app called Xnspy has stolen data from tens of thousands of iPhones and Android devices, the majority whose owners are unaware that their data has been compromised. From a report: Xnspy is one of many so-called stalkerware apps sold under the guise of allowing a parent to monitor their child's activities, but are explicitly marketed for spying on a spouse or domestic partner's devices without their permission. Its website boasts, "to catch a cheating spouse, you need Xnspy on your side," and, "Xnspy makes reporting and data extraction simple for you." Stalkerware apps, also known as spouseware, are surreptitiously planted by someone with physical access to a person's phone, bypassing the on-device security protections, and are designed to stay hidden from home screens, which makes them difficult to detect. Once installed, these apps will silently and continually upload the contents of a person's phone, including their call records, text messages, photos, browsing history and precise location data, allowing the person who planted the app near-complete access to their victim's data. But new findings show many stalkerware apps are riddled with security flaws and are exposing the data stolen from victims' phones. Xnspy is no different.' -- source: https://yro.slashdot.org/story/22/12/12/1658208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Inventory Improving, Could Reach Pre-Pandemic Levels In 2023
by Peter Reutemann 13 Dec '22

13 Dec '22

'According to CEO Eben Upton, "hundreds of thousands" of Raspberry Pi Zero, 3A+, and 4 models should show up next year. Ars Technica reports: In a "Supply chain update" blog post ("It's good news!"), CEO Eben Upton wrote that Raspberry Pi has "set aside a little over a hundred thousand units, split across Zero W, 3A+, and the 2GB and 4GB variants of Raspberry Pi 4, for single-unit sales." During the pandemic-spurred component shortage, most of the Pis produced every month were going to businesses, leaving those in need of one or two for a project refreshing rpilocator and cursing their timing. Zeros will start showing up first, then 3A+, then different models of 4. Upton acknowledged this reality (and even linked the locator) and asked that people buy only from approved resellers and consider the Pico and Pico W lines for projects that might fit, as those lines remain strong. As of this morning, a few 3A+ and CM4 models showed an optimistic green on the rpilocator spreadsheet. Raspberry Pi will continue to serve its commercial and industrial customers, Upton wrote, but will "make sure that inventory-building behavior which would otherwise prolong the shortage for everybody else can't take place." Meanwhile, Raspberry Pi will increase the percentage of boards designated for single-unit sales. With that change and future chip allocations, Upton expects that by the end of the third quarter of 2023, things will be back to how they were before the Great Pi Shortage, with "hundreds of thousands of units available at any given time." ' -- source: https://hardware.slashdot.org/story/22/12/12/2242236 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OSnews Decries 'The Mass Extinction of Unix Workstations'
by Peter Reutemann 12 Dec '22

12 Dec '22

'Anyone remember the high-end commercial UNIX workstations from a few decades ago — like from companies like IBM, DEC, SGI, and Sun Microsystems? Today OSnews looked back — but also explored what happens when you try to buy one today> : As x86 became ever more powerful and versatile, and with the rise of Linux as a capable UNIX replacement and the adoption of the NT-based versions of Windows, the days of the UNIX workstations were numbered. A few years into the new millennium, virtually all traditional UNIX vendors had ended production of their workstations and in some cases even their associated architectures, with a lacklustre collective effort to move over to Intel's Itanium — which didn't exactly go anywhere and is now nothing more than a sour footnote in computing history. Approaching roughly 2010, all the UNIX workstations had disappeared.... and by now, they're all pretty much dead (save for Solaris). Users and industries moved on to x86 on the hardware side, and Linux, Windows, and in some cases, Mac OS X on the software side.... Over the past few years, I have come to learn that If you want to get into buying, using, and learning from UNIX workstations today, you'll run into various problems which can roughly be filed into three main categories: hardware availability, operating system availability, and third party software availability. Their article details their own attempts to buy one over the years, ultimately concluding the experience "left me bitter and frustrated that so much knowledge — in the form of documentation, software, tutorials, drivers, and so on — is disappearing before our very eyes." Shortsightedness and disinterest in their own heritage by corporations, big and small, is destroying entire swaths of software, and as more years pass by, it will get ever harder to get any of these things back up and running.... As for all the third-party software — well, I'm afraid it's too late for that already. Chasing down the rightsholders is already an incredibly difficult task, and even if you do find them, they are probably not interested in helping you, and even if by some miracle they are, they most likely no longer even have the ability to generate the required licenses or release versions with the licensing ripped out. Stuff like Pro/ENGINEER and SoftWindows for UNIX are most likely gone forever.... Software is dying off at an alarming rate, and I fear there's no turning the tide of this mass extinction. The article also wonders why companies like HPE don't just "dump some ISO files" onto an FTP server, along with patch depots and documentation. "This stuff has no commercial value, they're not losing any sales, and it will barely affect their bottom line.' -- source: https://tech.slashdot.org/story/22/12/12/0116206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Fixes Longstanding Bug in Its Handling of Floppy Disks
by Peter Reutemann 12 Dec '22

12 Dec '22

'"Linux kernel 6.2 should contain fixes for some problems handling floppy disks," reports the Register, "a move which shows that someone somewhere is still using them." This isn't the only such fix in recent years. As a series of articles on Phoronix details, there has been a slow but steady flow of fixes for the kernel's handling of floppy drives since at least kernel 5.17, as The Register mentioned when it came out.... Back in July 2016, SUSE kernel developer Jiri Kosina submitted a patch. The problem arose because this change broke something else and later got reverted, and so the problem hung around. In July last year, he sent in a new patch that fixed it again for the 5.12 kernel, and was later back-ported to 5.10, an LTS version, and again into kernel 5.15 — another an LTS version, and the one you're running today if you're on the current Ubuntu LTS release, or something built from it such as Linux Mint 21.... Now, in December 2022, a new patch for the forthcoming kernel 6.2 fixes a memory leak that dates back to 5.11 or before.' -- source: https://linux.slashdot.org/story/22/12/11/0711207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Reports Decline In Android Memory Safety Vulnerabilities As Rust Usage Grows
by Peter Reutemann 10 Dec '22

10 Dec '22

'Last year, Google announced Android Open Source Project (AOSP) support for Rust, and today the company provided an update, while highlighting the decline in memory safety vulnerabilities. 9to5Google reports: Google says the "number of memory safety vulnerabilities have dropped considerably over the past few years/releases."; Specifically, the number of annual memory safety vulnerabilities fell from 223 to 85 between 2019 and 2022. They are now 35% of Android's total vulnerabilities versus 76% four years ago. In fact, "2022 is the first year where memory safety vulnerabilities do not represent a majority of Android's vulnerabilities." That count is for "vulnerabilities reported in the Android security bulletin, which includes critical/high severity vulnerabilities reported through our vulnerability rewards program (VRP) and vulnerabilities reported internally." During that period, the amount of new memory-unsafe code entering Android has decreased: "Android 13 is the first Android release where a majority of new code added to the release is in a memory safe language. " Rust makes up 21% of all new native code in Android 13, including the Ultra-wideband (UWB) stack, DNS-over-HTTP3, Keystore2, Android's Virtualization framework (AVF), and "various other components and their open source dependencies." Google considers it significant that there have been "zero memory safety vulnerabilities discovered in Android's Rust code" so far across Android 12 and 13. Google's blog post today also talks about non-memory-safety vulnerabilities, and its future plans: "... We're implementing userspace HALs in Rust. We're adding support for Rust in Trusted Applications. We've migrated VM firmware in the Android Virtualization Framework to Rust. With support for Rust landing in Linux 6.1 we're excited to bring memory-safety to the kernel, starting with kernel drivers.' -- source: https://tech.slashdot.org/story/22/12/01/2124259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Vivaldi Integrates Mastodon In Its Desktop Browser
by Peter Reutemann 09 Dec '22

09 Dec '22

'Vivaldi recently became the first browser to have its own Mastodon instance, Vivaldi Social. Now, the new version on the desktop is the first to integrate Mastodon into the browser itself, along with the ability to pin tab groups and other UI improvements. From a blog post: We believe in providing alternatives to Big Tech while putting your privacy first and launched Vivaldi Social, our Mastodon instance. And today we are integrating Vivaldi Social into the sidebar of our desktop browser becoming the first browser to offer this functionality. The new version -- Vivaldi 5.6 -- also allows you to pin your tab stacks. We've added a new private search engine You.com for select countries, helping to broaden your choices for searching the web. Vivaldi's sidebar of icons links to a number of utility functions. And now it integrates Vivaldi Social, our Mastodon instance. ' -- source: https://tech.slashdot.org/story/22/12/08/2151222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Xfce dialog buttons in header
by Peter Reutemann 09 Dec '22

09 Dec '22

Hi everyone Since moving to Xfce, I've been a bit annoyed at my muscle memory as I now have to click on Save/Load/Cancel buttons in the header of save/load dialogs instead of the bottom right. Apparently, I'm not the only dinosaur unhappy about this change, having to move the mouse so far between file format combobox and save button... With the following command, you can move the buttons back to the bottom: xfconf-query -c xsettings -p /Gtk/DialogsUseHeader -s false Found here: https://forums.linuxmint.com/viewtopic.php?p=2039043&sid=a6eeaaa02b60fe9ddd… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Chrome Gets Memory and Energy Saver Modes
by Peter Reutemann 09 Dec '22

09 Dec '22

'Google today announced two new performance settings in its Chrome browser: Memory Saver and Energy Saver. From a report: The Memory Saver mode promises to reduce Chrome's memory usage by up to 30% by putting inactive tabs to sleep. The tabs will simply reload when you need them again. The Energy Saver mode, meanwhile, limits background activity and visual effects for sites with animations and videos when your laptop's battery level drops below 20%.' -- source: https://tech.slashdot.org/story/22/12/08/1723207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Amazon Joins Open Invention Network
by Peter Reutemann 08 Dec '22

08 Dec '22

'Amazon and Amazon Web Services (AWS) have joined the Open Invention Network (OIN) -- the world's largest patent non-aggression consortium. ZDNet reports: OIN has long protected Linux and Linux-related software from patent aggression by rival companies. With the recent increase in patent troll attacks, the OIN is also defending companies from these assaults. This is a natural move for Amazon. Besides relying on Linux and open-source software both for its retail and cloud businesses, Amazon has a strict policy against patent infringement, and users who engage in this behavior can have their listings removed or accounts deleted. Nevertheless, like all large companies, Amazon has also been sued for patent violations. Joining the OIN simply makes good business sense. Nithya Ruff, the Amazon Open Source Program Office director, added: "Linux and open source are essential to many of our customers and a key driver of innovation across Amazon. We are proud to support a broad range of open-source projects, foundations, and partners, and we are committed to the long-term success and sustainability of open source as a whole. By joining OIN, we are continuing to strengthen open source communities and helping to ensure technologies like Linux remain thriving and accessible to everyone."' -- source: https://news.slashdot.org/story/22/12/07/2224237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ Mobile +64 22 190 2375 https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0