- wlug - University of Waikato Mail Lists

Can Users Poison the Data Big Tech Uses to Surveil Them?
by Peter Reutemann 07 Mar '21

07 Mar '21

'"Algorithms are meaningless without good data. The public can exploit that to demand change," argues a new article in MIT's Technology Review (shared by long-time Slashdot reader mspohr): Data is fed into machine-learning algorithms to target you with ads and recommendations. Google cashes your data in for over $120 billion a year of ad revenue. Increasingly, we can no longer opt out of this arrangement... Now researchers at Northwestern University are suggesting new ways to redress this power imbalance by treating our collective data as a bargaining chip... In a new paper being presented at the Association for Computing Machinery's Fairness, Accountability, and Transparency conference next week, researchers including PhD students Nicholas Vincent and Hanlin Li propose three ways the public can exploit this to their advantage: Data strikes, inspired by the idea of labor strikes, which involve withholding or deleting your data so a tech firm cannot use it — leaving a platform or installing privacy tools, for instance. Data poisoning, which involves contributing meaningless or harmful data. AdNauseam, for example, is a browser extension that clicks on every single ad served to you, thus confusing Google's ad-targeting algorithms. Conscious data contribution, which involves giving meaningful data to the competitor of a platform you want to protest, such as by uploading your Facebook photos to Tumblr instead. Will we someday see "white-hat data poisoners" trying to convince tech companies that the best place to advertise is the classified sections of small local newspapers? While the researchers believe sporadic individual actions have little impact, the article takes this to its ultimate conclusion. "What if millions of people were to coordinate to poison a tech giant's data well...? That might just give them some leverage to assert their demands."' -- source: https://yro.slashdot.org/story/21/03/06/0149242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Why the 'Small Internet' Movement Wants to Revive Gopher
by Peter Reutemann 07 Mar '21

07 Mar '21

'Linux magazine: The danger and irritations of the modern web have unleashed a movement dedicated to creating a safer and simpler alternative. The old Gopher network and the new Gemini protocol have emerged as building blocks for this new "small Internet." Anyone who has used the World Wide Web (WWW) lately knows that something bad is happening to it. It does not resemble the WWW of the early years, with enthusiastic amateurs freely sharing ideas and information. These things still exist, and the web is still an indispensable medium connecting the world. But the web experience is now encumbered with advertising, invasions of privacy in the form of pervasive tracking, enormous file sizes, CPU straining JavaScript, the danger of exploits, and door slams asking you to subscribe to a newsletter before viewing a site. This unpleasant environment has led to a backlash. There are now some communities of developers and computer users who still desire a connected information system, but who seek a refuge from the noise, danger, and increasingly resource-hungry WWW. They feel that web technology does too much, and that since it makes various forms of abuse too easy, no lasting reform is possible. The solution is to use or create a separate protocol that is simply not capable of supporting the technologies that enable advertising networks, user fingerprinting, or the myriad of other things that exploit users rather than helping them. This small movement has approached the problem from two directions that in practice are often merged: the revival of the Gopher protocol and the creation of a new protocol called Gemini. Gemini would support its own lightweight hypertext format, and would co-exist with Gopher and HTTP as an alternative client-server protocol with built-in privacy-assuring features like mandatory Transport Layer Security and a "Trust On First Use" public-key security model. ("Connections are closed at the end of a single transaction and cannot be reused," notes the Project Gemini home page.) "You may think of Gemini as 'the web, stripped right back to its essence,'" explains its FAQ, "or as 'Gopher, souped up and modernised just a little', depending upon your perspective..." "Gemini is also intended to be very privacy conscious, to be difficult to extend in the future (so that it will *stay* simple and privacy conscious), and to be compatible with a 'do it yourself' computing ethos."' -- source: https://tech.slashdot.org/story/21/03/06/014255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The One-Week Hijacking of Perl.com - Explained
by Peter Reutemann 07 Mar '21

07 Mar '21

'"For a week we lost control of the Perl.com domain," a long-running site offering news and articles about the programming language, writes the site's senior editor, brian d foy. "Now that the incident has died down, we can explain some of what happened and how we handled it." This incident only affected the domain ownership of Perl.com and there was no other compromise of community resources. This website was still there, but DNS was handing out different IP numbers... Recovering the domain wasn't the end of the response though. While the domain was compromised, various security products had blacklisted Perl.com and some DNS servers had sinkholed it. We figured that would naturally work itself out, so we didn't immediately celebrate the return of Perl.com. We wanted it to be back for everyone. And, I think we're fully back. However, if you have problems with the domain, please raise an issue so we at least know it's not working for part of the internet. What we think happened This part veers into some speculation, and Perl.com wasn't the only victim. We think that there was a social engineering attack on Network Solutions, including phony documents and so on. There's no reason for Network Solutions to reveal anything to me (again, I'm not the injured party), but I did talk to other domain owners involved and this is the basic scheme they reported. John Berryhill provided some forensic work in Twitter that showed the compromise actually happened in September. The domain was transferred to the BizCN registrar in December, but the nameservers were not changed. The domain was transferred again in January to another registrar, Key Systems, GmbH. This latency period avoids immediate detection, and bouncing the domain through a couple registrars makes the recovery much harder... Once transferred to Key Systems in late January, the new, fraudulent registrant listed the domain (along with others), on Afternic (a domain marketplace). If you had $190,000, you could have bought Perl.com. This was quickly de-listed after the The Register made inquiries. "I think we were very fortunate here and that many people with a soft spot in their hearts for Perl did a lot of good work for us," the article notes. "All sides understood that Perl.com belonged to Tom and it was a simple matter of work to resolve it. A relatively unknown domain name might not fare as well in proving they own it..." But again, the incident ended happily, foy writes, and "The Perl.com domain is back in the hands of Tom Christiansen and we're working on the various security updates so this doesn't happen again. The website is back to how it was and slightly shinier for the help we received."' -- source: https://developers.slashdot.org/story/21/03/06/0510239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

CentOS Is Gone -- But RHEL Is Now Free For Up To 16 Production Servers
by Peter Reutemann 06 Mar '21

06 Mar '21

'Ars Technica: Last month, Red Hat caused a lot of consternation in the enthusiast and small business Linux world when it announced the discontinuation of CentOS Linux. Long-standing tradition -- and ambiguity in Red Hat's posted terms -- led users to believe that CentOS 8 would be available until 2029, just like the RHEL 8 it was based on. Red Hat's early termination of CentOS 8 in 2021 cut eight of those 10 years away, leaving thousands of users stranded. Red Hat's December announcement of CentOS Stream -- which it initially billed as a "replacement" for CentOS Linux -- left many users confused about its role in the updated Red Hat ecosystem. As of February 1, 2021, Red Hat will make RHEL available at no cost for small-production workloads -- with "small" defined as 16 systems or fewer. This access to no-cost production RHEL is by way of the newly expanded Red Hat Developer Subscription program, and it comes with no strings -- in Red Hat's words, "this isn't a sales program, and no sales representative will follow up." Red Hat is also expanding the availability of developer subscriptions to teams, as well as individual users. Moving forward, subscribing RHEL customers can add entire dev teams to the developer subscription program at no cost. This allows the entire team to use Red Hat Cloud Access for simplified deployment and maintenance of RHEL on well-known cloud providers, including AWS, Google Cloud, and Microsoft Azure.' -- source: https://linux.slashdot.org/story/21/01/20/2016202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Torvalds warns the world: Don’t use the Linux 5.12-rc1 kernel
by Peter Reutemann 06 Mar '21

06 Mar '21

'In a message to the Linux Kernel Mailing List yesterday, founding developer Linus Torvalds warned the world not to use the 5.12-rc1 kernel in his public git tree. Hey peeps - some of you may have already noticed that in my public git tree, the "v5.12-rc1" tag has magically been renamed to "v5.12-rc1-dontuse". It's still the same object, it still says "v5.12-rc1" internally and it is still is signed by me, but the user-visible name of the tag has changed. As it turns out, when Linus Torvalds flags some code dontuse, he really means it—the problem with this 5.12 release candidate broke swapfile handling in a very unpleasant way. Specifically, the updated code would lose the proper offset pointing to the beginning of the swapfile. Again, in Torvalds' own words, "swapping still happened, but it happened to the wrong part of the filesystem, with the obvious catastrophic end results."' -- source: https://arstechnica.com/gadgets/2021/03/psa-linux-folks-stay-away-from-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Windows.com Bitsquatting Hack Can Wreak 'Unknown Havoc' On PCs
by Peter Reutemann 05 Mar '21

05 Mar '21

'Ars Technica: Bitflips are events that cause individual bits stored in an electronic device to flip, turning a 0 to a 1 or vice versa. Cosmic radiation and fluctuations in power or temperature are the most common naturally occurring causes. Research from 2010 estimated that a computer with 4GB of commodity RAM has a 96 percent chance of experiencing a bitflip within three days. An independent researcher recently demonstrated how bitflips can come back to bite Windows users when their PCs reach out to Microsoft's windows.com domain. Windows devices do this regularly to perform actions like making sure the time shown in the computer clock is accurate, connecting to Microsoft's cloud-based services, and recovering from crashes. Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase. This was surprising because Microsoft and other companies normally buy these types of one-off domains to protect customers against phishing attacks. He bought them for $126 and set out to see what would happen. Over the course of two weeks, Remy's server received 199,180 connections from 626 unique IP addresses that were trying to contact ntp.windows.com. By default, Windows machines will connect to this domain once per week to check that the time shown on the device clock is correct. What the researcher found next was even more surprising. "The NTP client for windows OS has no inherent verification of authenticity, so there is nothing stopping a malicious person from telling all these computers that it's after 03:14:07 on Tuesday, 19 January 2038 and wreaking unknown havoc as the memory storing the signed 32-bit integer for time overflows," he wrote in a post summarizing his findings. "As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."' -- source: https://tech.slashdot.org/story/21/03/04/2152239 I wonder whether anyone has tested apt-get in regards to this... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US Issues Warning After Microsoft Says China Hacked Its Mail Server Program
by Peter Reutemann 04 Mar '21

04 Mar '21

'NBC News: The U.S. has issued an emergency warning after Microsoft said it caught China hacking into its mail and calendar server program, called Exchange. The perpetrator, Microsoft said in a blog post, is a hacker group that the company has "high confidence" is working for the Chinese government and primarily spies on American targets. The latest software update for Exchange blocks the hackers, prompting the U.S. Cybersecurity and Infrastructure Security Agency to issue a rare emergency directive that requires all government networks do so. CISA, the U.S.'s primary defensive cybersecurity agency, rarely exercises its authority to demand the entire U.S. government take protective steps to protect its cybersecurity. The move was necessary, the agency announced, because the Exchange hackers are able "to gain persistent system access." All government agencies have until noon Friday to download the latest software update. In a separate blog post, Microsoft Vice President Tom Burt wrote that the hackers have recently spied on a wide range of American targets, including disease researchers, law firms and defense contractors. There was no immediate indication that the hack led to significant exploitation of U.S. government computer networks. But the announcement marks the second instance in recent months that the U.S. scrambled to address a widespread hacking campaign believed be the work of foreign government spies.' -- source: https://it.slashdot.org/story/21/03/04/022226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome Switches Its Release Cycle for First Time in a Decade
by Peter Reutemann 04 Mar '21

04 Mar '21

'Google Chrome releases will soon arrive more frequently than ever. From a report: In an announcement today, Google said it is updating the Chrome release schedule for the first time in over a decade. For a cool 10+ years now, Chrome stable releases have shipped every 6 weeks with new features, security fixes, etc. With improvements to testing and release processes, Google has realized that it can shorten the release cycle and will do so in Q3 of this year. Starting with Chrome 94, Google will move to a 4-week milestone release cycle. Freaked out at the possibility that Google might break features, remove things you like, or cause other issues with so many releases? Don't worry, Google is also introducing an Extended Stable release that will see milestone updates every 8 weeks. Now, it will still get updates every 2 weeks to address "important issues," but none of the new features or all security fixes that the 4-week milestones see will be included.' -- source: https://tech.slashdot.org/story/21/03/04/1924223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Privacy-first Browser Brave Now Has Its Own Google Search Rival
by Peter Reutemann 03 Mar '21

03 Mar '21

'Two years after publicly launching a privacy-focussed browser, Brave, founded by former Mozilla executive Brendan Eich, is taking on Google's search business, too. From a report: The announcement of Brave Search puts the upstart in the rare position of taking on both Google's browser and search dominance. Eich says that Brave Search, which has opened a waitlist and will launch in the first half of this year, won't track or profile people who use it. "Brave already has a default anonymous user model with no data collection at all," he says adding this will continue in its search engine. No IP addresses will be collected and the company is exploring how it can create both a paid, ad-free search engine and one that comes with ads. But building a search engine isn't straightforward. [...] Eich says Brave isn't starting its search engine or index from scratch and won't be using indexes from Bing or other tech firms. Instead Brave has purchased Tailcat, an offshoot of German search engine Cliqz, which was owned by Hubert Burda Media and closed down last year. The purchase includes an index of the web that's been created by Tailcat and the technology that powers it. Eich says that some users will be given the ability to opt-in to anonymous data collection to help fine-tune search results. "What Tailcat does is it looks at a query log and a click log anonymously," Eich says. "These allow it to build an index, which Tailcat has done and already did at Cliqz, and it's getting bigger." He admits that the index will not be anywhere near as deep as Google's but that the top results it surfaces are largely the same.' -- source: https://search.slashdot.org/story/21/03/03/1643231 Interesting that they didn't simply use DuckDuckGo... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Launches Power Fx, a New Open Source Low-Code Language
by Peter Reutemann 03 Mar '21

03 Mar '21

'Microsoft today announced Power Fx, a new low-code language that "will become the standard for writing logic customization across Microsoft's own low-code Power Platform," reports TechCrunch. "[S]ince the company is open-sourcing the language, Microsoft also hopes others will implement it as well and that it will become the de facto standard for these kinds of use cases." From the report: Microsoft says the language was developed by a team led by Vijay Mital, Robin Abraham, Shon Katzenberger and Darryl Rubin. Beyond Excel, the team also took inspiration from tools and languages like Pascal, Mathematica and Miranda, a functional programming language developed in the 1980s. Microsoft plans to bring Power Fx to all of its low-code platforms, but given the focus on community, it'll start making appearances in Power Automate, Power Virtual Agents and elsewhere soon. But the team clearly hopes that others will adopt it as well. Low-code developers will see it pop up in the formula bars of products like Power Apps Studio, but more sophisticated users will also be able to use it to go to Visual Studio Code and build more complex applications with it. As the team noted, it focused on not just making the language Excel-like but also having it behave like Excel -- or like a REPL, for you high-code programmers out there. That means formulas are declarative and instantly recalculate as developers update their code. ' -- source: https://news.slashdot.org/story/21/03/02/2126228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0