- wlug - list.wlug.org.nz

Bad DIMM on Linus Torvalds' Desktop System Moves Kernel Merges to His Laptop
by Peter Reutemann 17 Oct '22

17 Oct '22

'When a kernel developer asked Linus Torvalds if he'd missed a Git pull, Torvalds "revealed the request was still in his queue as 'I'm doing merges (very slowly) on my laptop, while waiting for new ECC memory DIMMs to arrive,'" reports The Register: Torvalds needs the DIMMs because over the last few days he experienced what he described as "some instability on my main desktop... with random memory corruption in user space resulting in my allmodconfig builds randomly failing with internal compiler errors etc." The Linux boss's first thought was that a new kernel bug had caused the problem — which isn't good but sometimes happens. His instinct was wrong. "It was literally a DIMM going bad in my machine randomly after 2.5 years of it being perfectly stable," he wrote. "Go figure. Verified first by booting an old kernel, and then with memtest86+ overnight." Torvalds appears to have been tracking delivery of the new DIMMs as he reported replacement memory was "out for delivery" and predicted it should arrive later on Sunday evening.... His post also mentions that his main PC was set up for error correction code memory (ECC memory), but "during the early days of COVID when there wasn't any ECC memory available at any sane prices. And then I never got around to fixing it, until I had to detect errors the hard way." "I absolutely *detest* the crazy industry politics and bad vendors that have made ECC memory so 'special'," he added.' -- source: https://linux.slashdot.org/story/22/10/15/2334251 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Kernel 6.0 Released for the AmigaOne X1000/X5000 PowerPC-Based AmigaOS Computers
by Peter Reutemann 17 Oct '22

17 Oct '22

'Hyperion Entertainment is pleased to announce the immediate availability of a very substantial and comprehensive update of the Software Development Kit (SDK) for AmigaOS 4.1 54.16. Also Linux: Kernel 6.0 for AmigaOne X1000/X5000 has been released and the biggest Amiga event of the year will be held upcoming weekend in Mönchengladbach, Germany: the Amiga37 event.' -- source: https://linux.slashdot.org/story/22/10/15/2124215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office Rebranding
by Lawrence D'Oliveiro 14 Oct '22

14 Oct '22

I suppose you’ve heard by now that “Microsoft Office” is losing the “Office” part of the name, and becoming “Microsoft 365”. Accompanying this rebranding is a new set of logos <https://arstechnica.com/gadgets/2022/10/rip-to-microsoft-office-henceforth-…>. One thing I notice about them is the gradient shading, shadows and general faux-3D look. Does this mark an end to the “flat” design fad that seems to have become so popular over the last decade? Or does this only apply to the logo branding, not to onscreen icons, UI etc? (In which case, I wonder how their design gurus feel about such a disconnect between those different aspects of the same product.) Of course, I ask this as someone who never stopped being a fan of 3D style ...

1 0

Android Leaks Some Traffic Even When 'Always-On VPN' Is Enabled
by Peter Reutemann 13 Oct '22

13 Oct '22

'Mullvad VPN has discovered that Android leaks traffic every time the device connects to a WiFi network, even if the "Block connections without VPN," or "Always-on VPN," features is enabled. BleepingComputer reports: The data being leaked outside VPN tunnels includes source IP addresses, DNS lookups, HTTPS traffic, and likely also NTP traffic. This behavior is built into the Android operating system and is a design choice. However, Android users likely didn't know this until now due to the inaccurate description of the "VPN Lockdown" features in Android's documentation. Mullvad discovered the issue during a security audit that hasn't been published yet, issuing a warning yesterday to raise awareness on the matter and apply additional pressure on Google. Android offers a setting under "Network & Internet" to block network connections unless you're using a VPN. This feature is designed to prevent accidental leaks of the user's actual IP address if the VPN connection is interrupted or drops suddenly. Unfortunately, this feature is undercut by the need to accommodate special cases like identifying captive portals (like hotel WiFi) that must be checked before the user can log in or when using split-tunnel features. This is why Android is configured to leak some data upon connecting to a new WiFi network, regardless of whether you enabled the "Block connections without VPN" setting. Mullvad reported the issue to Google, requesting the addition of an option to disable connectivity checks. "This is a feature request for adding the option to disable connectivity checks while "Block connections without VPN" (from now on lockdown) is enabled for a VPN app," explains Mullvad in a feature request on Google's Issue Tracker. "This option should be added as the current VPN lockdown behavior is to leaks connectivity check traffic (see this issue for incorrect documentation) which is not expected and might impact user privacy." In response to Mullvad's request, a Google engineer said this is the intended functionality and that it would not be fixed for the following reasons: - Many VPNs actually rely on the results of these connectivity checks to function, - The checks are neither the only nor the riskiest exemptions from VPN connections, - The privacy impact is minimal, if not insignificant, because the leaked information is already available from the L2 connection. Mullvad countered these points and the case remains open.' -- source: https://tech.slashdot.org/story/22/10/12/2057246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How Wi-Fi Spy Drones Snooped On Financial Services Firm
by Lawrence D'Oliveiro 13 Oct '22

13 Oct '22

Some security experts predicted this possibility years ago, and now we are seeing it for real <https://www.theregister.com/2022/10/12/drone-roof-attack/>: drones being used to attack network security. The company’s security team twigged to something odd going on when a user (or at least a device answering to their MAC address) seemed to be in two places at once: at home some distance away, and yet also at the premises, on a wi-fi network. Using a Fluke wi-fi meter, they traced the signal and found, not one, but two drones parked on the roof of the building. One had a “Wi-Fi Pineapple” penetration-testing device (which you can buy for USD120), while the other was carrying a range of kit, including a Raspberry Pi and a mini laptop. Seemed the attackers took advantage of a temporary lapse in security, due to some facilities reorganizations at the company, to trick a user into entering their credentials on a fake login page.

1 0

VirtualBox 7.0 adds first ARM Mac client, full encryption, Windows 11 TPM
by Peter Reutemann 12 Oct '22

12 Oct '22

'Nearly four years after its last major release, VirtualBox 7.0 arrives with a… host of new features. Chief among them are Windows 11 support via TPM, EFI Secure Boot support, full encryption for virtual machines, and a few Linux niceties. [...] Linux hosts receive "reworked" screen resizing, along with "initial support" for automatic updating of the Guest Additions inside Linux guests. Perhaps most interesting for Linux hosts is support for DXVK, the Vulkan-based implementation of DirectX layers that allows for running 3D Windows applications in Wine. This provides some parity with Windows hosts, which receive standard DirectX 11 support in this 7.0 release.' -- source: https://arstechnica.com/gadgets/2022/10/virtualbox-7-0-adds-first-arm-mac-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Confirms Alder Lake BIOS Source Code Leaked
by Peter Reutemann 10 Oct '22

10 Oct '22

'Tom's Hardware reports: We recently broke the news that Intel's Alder Lake BIOS source code had been leaked to 4chan and Github, with the 6GB file containing tools and code for building and optimizing BIOS/UEFI images. We reported the leak within hours of the initial occurrence, so we didn't yet have confirmation from Intel that the leak was genuine. Intel has now issued a statement to Tom's Hardware confirming the incident: "Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program...." The BIOS/UEFI of a computer initializes the hardware before the operating system has loaded, so among its many responsibilities, is establishing connections to certain security mechanisms, like the TPM (Trusted Platform Module). Now that the BIOS/UEFI code is in the wild and Intel has confirmed it as legitimate, both nefarious actors and security researchers alike will undoubtedly probe it to search for potential backdoors and security vulnerabilities.... Intel hasn't confirmed who leaked the code or where and how it was exfiltrated. However, we do know that the GitHub repository, now taken down but already replicated widely, was created by an apparent LC Future Center employee, a China-based ODM that manufactures laptops for several OEMs, including Lenovo. ' -- source: https://hardware.slashdot.org/story/22/10/09/2330258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Launches New Free Tier for Its Security-Focused 'Ubuntu Pro'
by Peter Reutemann 10 Oct '22

10 Oct '22

'"Starting with the Ubuntu 16.04 edition and including the later LTS versions, Canonical will offer expanded security coverage for critical, high, and medium Common Vulnerabilities and Exposures (CVEs) to all of Ubuntu's open-source applications and toolchains for ten years," reports ZDNet. "Yes, you read that right, you get security patches not just for the operating system, but for all of Ubuntu's open-source applications for a decade." Most of these are server programs, such as Ansible, Apache Tomcat, Drupal, Nagios, Redis, and WordPress. But, it also includes such developer essentials as Docker, Node.js, phpMyAdmin, Python 2, and Rust. Altogether, Canonical is supporting more than 23,000 packages. Indeed, it's now offering security for, as Mark Shuttleworth, Canonical's CEO, said, "Security coverage to every single package in the Ubuntu distribution." Canonical isn't doing this on its own. It's offering free, improved security in partnership with the security management company Tenable. Robert Huber, Tenable's Chief Security Officer, said, "Ubuntu Pro offers security patch assurance for a broad spectrum of open-source software. Together, we give customers a foundation for trustworthy open source." Beyond ordinary security, Canonical is backporting security fixes from newer application versions. This enables Ubuntu Pro users to use the Ubuntu release of their choice for long-term security without forced upgrades. Happy to keep using Ubuntu 20.04? No problem. You can run it until April 2030. Knock yourself out.... Users can obtain a free personal Ubuntu Pro subscription at ubuntu.com/pro for up to five machines. This free tier is for personal and small-scale commercial use. Mark Shuttleworth, CEO of Ubuntu's parent company company Canonical, explains in a new video that Ubuntu "is now the world's most widely used Linux..." "What makes most proud, though, is that we have found a way to make this available free of charge to anybody for their personal and for small-scale commercial use.... full commercial use for you, and any business you own, on up to five machines."' -- source: https://linux.slashdot.org/story/22/10/09/007217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Court Won’t Order Bad Tenants Facebook Group To Release Information
by Lawrence D'Oliveiro 10 Oct '22

10 Oct '22

A bunch of landlords in NZ were running a Facebook group called “Bad Tenants”, where they were sharing personal details about tenants <https://www.nzherald.co.nz/nz/court-wont-force-bad-tenants-facebook-group-t…>: ... it provides a space for landlords to share personal information about their tenants as a warning to other property owners, essentially blacklisting them. The Privacy Commission and Renters United have stated explicitly that this sharing of private information is against the law. So a tenant named Adam Sheehan took a complaint to the Privacy Commissioner last year, who directed that the group hand over any information they had about him. But they did not comply, and deleted the group. So then he went to court. But the court decided that there was no way they could enforce any decision made against the group. Under the Privacy Act 2020, any individual can request information that any organisation holds about them - whether it's the police, the Ministry of Health or an insurance broker - and they have to supply it. However, because a Facebook group isn't an organisation or an incorporated body, just a group of individuals, there was no one specifically for the tribunal to order to release Sheehan's information. I wonder, when groups or accounts or pages are deleted, does Facebook guarantee that that information really and permanently disappears?

2 1

Matter Smart Home Standard Officially Launches
by Peter Reutemann 07 Oct '22

07 Oct '22

'The Connectivity Standards Alliance and its members that include Apple, Google, Amazon, Samsung, and other smart home manufacturers, today announced the official launch of the Matter 1.0 smart home accessory standard. MacRumors reports: Companies that have agreed to support Matter now have all of the resources that they need to begin implementing Matter into their platforms, so we could see Apple integrating Matter into HomeKit very soon. In fact, iOS 16.1 is already laying the groundwork for Matter, so Matter could be announced with the launch of the update. With the Matter 1.0 launch, authorized test labs are now available for product certification, tools are available, and the open-source reference design SDK is complete. Alliance members with devices that have already been deployed and with plans to update their products with Matter support can do so as soon as their products are certified. The Connectivity Standards Alliance says that the first release of Matter will support a variety of smart home products such as lighting, HVAC controls, window coverings, safety and security sensors, door locks, media devices, controllers, and bridges. "What started as a mission to unravel the complexities of connectivity has resulted in Matter, a single, global IP-based protocol that will fundamentally change the IoT," said Tobin Richardson, President and CEO of the Connectivity Standards Alliance. "This release is the first step on a journey our community and the industry are taking to make the IoT more simple, secure, and valuable no matter who you are or where you live. With global support from companies large and small, today's Matter 1.0 release is more than a milestone for our organization and our members; it is a celebration of what is possible." ' -- source: https://mobile.slashdot.org/story/22/10/04/2145233 Home assistant has support for it: https://www.home-assistant.io/blog/2022/05/29/matter-in-home-assistant-work… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1