- wlug - University of Waikato Mail Lists

Will Businesses Make 2021 The Year of the Linux Desktop?
by Peter Reutemann 08 Dec '20

08 Dec '20

'Writing for TechRepublic, open source advocate Jack Wallen predicts 2021 will be a year where open source technology dominates the world of big data even more than 2021 (with a big role predicted for SUSE). But he also sees businesses cutting costs by switching to open source solutions — including a big move to Linux on enterprise desktops, thanks to enterprise-ready options now available from System76, Lenovo, and Dell: This will have the added benefit of even more companies jumping into the mix and offering more and more desktops and laptops, all powered by Linux and open source technology. One added bonus for this movement is that System76 will finally gain the recognition they've deserved for so many years. Linux on the desktop would not be where it is today, had it not been for their stalwart support for open source technology. Year after year, System76 has proved that high-quality, business-class systems, powered by Linux, can be produced at a level befitting the enterprise. That success within the realm of business will start trickling down to consumers. As more and more people start using Linux at their place of business, they'll begin seeing the benefits of the open source operating system and desire to adopt it for their home computers. I suspect that by the end of 2021, we'll see Linux desktop market share to finally break the 10% bubble. It may not sound like much, but given how Linux has hovered around 2% and maxed out at 5%, that 10% figure is like a dream come true. That's only the tip of the iceberg. Although Linux will max out at around 10% by the end of the year, it will lead to continued growth over the coming years.' -- source: https://linux.slashdot.org/story/20/12/07/0332259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should Qualcomm Feel Threatened By Apple's M1 Macs?
by Peter Reutemann 07 Dec '20

07 Dec '20

'PCMag.com's lead mobile analyst calls Qualcomm "a little too unbothered by Apple's M1 Macs" Qualcomm executives brushed off a question about Apple's new M1-based Macs during a question-and-answer session at the company's Snapdragon Summit today, where Qualcomm announced a new flagship smartphone chipset but no upgrades to its year-old chips for PCs... In general, reviews of Qualcomm-powered laptops such as the Microsoft Surface Pro X have celebrated the devices' long battery life, but lamented problems with third-party apps that were originally coded for Intel processors. That stands in stark contrast to Apple's new M1-based Macs, which don't seem to be slowed down as badly by older software... "It's a great validation of what we've been doing for the past few years and [Qualcomm's product line] is just going to get stronger and stronger as we broaden our scope," said Alex Katouzian, Qualcomm SVP for mobile. Katouzian made sure to subtly call out ways in which Qualcomm's always-connected PCs are superior to Apple's newest Macs. The Macs lack 4G connectivity and still have poor-quality, 720p front-facing cameras... Katouzian also pointed out that (presumably unlike Apple) Qualcomm addresses "many tiers...and many price points" with its 7c, 8c, and 8cx laptop chipsets, letting Windows laptop makers drive prices well below the MacBook Air's $999 list price. The core problem with Qualcomm's always-connected PC strategy is one that Qualcomm itself can't fix. While Qualcomm could, and probably will, soon announce a laptop chip that's based on the new Snapdragon 888 and has a level of raw power closer to Apple's M1, it's really down to Microsoft, as well as peripheral and app makers to solve the platform incompatibilities that have frustrated PC reviewers. Hot Hardware cites Microsoft's promises of changes come in future updates to Windows 10, arguing that "with the arrival of x64 emulation and a growing library of native Arm64 apps, Windows 10 on Arm is going to be an even more powerful platform." From a performance perspective, while running Windows 10 on Arm, these [Snapdragon 8cx] chips may currently be at a disadvantage to the Apple M1, but some day in the not so distant future that might not be the case. We have no doubt that Qualcomm is likely working on a new Windows PC-centric SoC that is based on Snapdragon 888 or similar architecture. Qualcomm has promised a 25 percent uplift in CPU and a 35% lift in GPU performance over the Snapdragon 865, with the Snapdragon 888, which already offers a big boost over the previous gen Snapdragon 855/8cx. So, Qualcomm has the potential to put up a strong showing against the Apple M1, whenever its next-generation Snapdragon PC chip launches. That may be, but John Gruber at Daring Fireball argues that currently "M1 Macs embarrass all other PCs — all Intel-based Macs, including automobile-priced Mac Pros, and every single machine running Windows or Linux." Those machines are just standing around in their underwear now because the M1 stole all their pants. Well, that just doesn't happen, your instincts tell you. One company, even a company like Apple, doesn't just embarrass the entire rest of a highly-competitive longstanding industry. But just because something hasn't happened — or hasn't happened in a very long while — doesn't mean it can't happen. And in this case, it just happened... M1 Macs completely upend what we can and should expect from PCs. It's a breakthrough along the lines of the iPhone itself in 2007.' -- source: https://hardware.slashdot.org/story/20/12/06/060238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Richard Stallman Answers Questions at EmacsConf 2020
by Peter Reutemann 07 Dec '20

07 Dec '20

'All the videos have now appeared online for the talks at this year's virtual EmacsConf 2020, "the conference about the joy of Emacs, Emacs Lisp, and memorizing key sequences." And among them are an appearance by 67-year-old Richard Stallman, reminding the audience he'd created the first Emacs editor in 1976 "with some help from Guy Steele," then created GNU Emacs in 1984. Stallman was there to tell the history of the GNU Emacs Lisp Package Archive (and the licensing issues involved) — and how it's ultimately led to the creation of the NonGNU ELPA. "The fundamental plan of NonGNU ELPA is that we won't ask for copyright assignments for those packages, so we won't be able to put them into core Emacs, at least not easily — but we will have some control over how we distribute them. We can put any package into NonGNU ELPA as long as its free software. "If we like it, we can set up that way for users to get it. We can put the package in exactly as it is, if there's no problem at all with it. We can make an arrangement with the package's developers to work on it with us and maintain it directly for distribution by NonGNU ELPA. But if they are not interested, we can put it in ourselves, and if we need to make any changes we can do so. So NonGNU ELPA is not meant to be just a way that others can distribute their packages. Its meant at least in a minimal, technical sense to work with GNU Emacs, and we will make changes if necessary so that it works smoothly with GNU Emacs... "The idea is to have a single Git repository where you can download various packages, but they won't be maintained there. Each of those packages will be copied automatically from some other place, probably some other people have the right access to work on it. This way we can avoid giving a gigantic number of people access to it. "So far NonGNU ELPA is just a plan. We need people to implement the plan, so if you'd like to help, please write to me. I think this is a very important step for progress, and it's got to be implemented. Thanks, and happy hacking." Stallman provided a status update on NonGNU ELPA as part of the 46-minute Q&A that followed. ' -- source: https://news.slashdot.org/story/20/12/06/1957219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenZFS 2.0 release unifies Linux, BSD and adds tons of new features
by Peter Reutemann 04 Dec '20

04 Dec '20

'This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between "ZFS on Linux" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.' -- source: https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-b… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

One of the Internet’s most aggressive threats could take UEFI malware mainstream
by Peter Reutemann 04 Dec '20

04 Dec '20

'One of the Internet’s most aggressive threats has just gotten meaner, with the ability to infect one of the most critical parts of any modern-day computer. Trickbot is a piece of malware that’s notable for its advanced capabilities. Its modular framework excels at gaining powerful administrator privileges, spreading rapidly from computer to computer in networks and performing reconnaissance that identifies infected computers belonging to high-value targets. It often uses readily available software like Mimikatz or exploits like EternalBlue stolen from the National Security Agency. Once a simple banking fraud trojan, Trickbot over the years has evolved into a full-featured malware-as-a-service platform. Trickbot operators sell access to their vast number of infected machines to other criminals, who use the botnet to spread bank trojans, ransomware, and a host of other malicious software. Rather than having to go through the hassle of ensnaring victims themselves, customers have a ready-made group of computers that will run their crimeware. Now, Trickbot has acquired a new power: the ability to modify a computer’s UEFI. Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer’s device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it’s the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove.' -- source: https://arstechnica.com/information-technology/2020/12/dangerous-uefi-malwa… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

FBI Warns of Email Forwarding Rules Being Abused in Recent Hacks
by Peter Reutemann 03 Dec '20

03 Dec '20

'The US Federal Bureau of Investigation says that cyber-criminals are increasingly relying on email forwarding rules in order to disguise their presence inside hacked email accounts. From a report: In a PIN (Private Industry Notification) alert sent last week and made public today, the FBI says the technique has been seen and abused in recent BEC (Business Email Compromise) attacks reported over the summer. The hackers' technique relies on a feature found in some email services called "auto-forwarding email rules." As its name implies, the feature allows the owner of an email address to set up "rules" that forward (redirect) an incoming email to another address if a certain criteria is met. Threat actors absolutely love email auto-forwarding rules as they allow them to receive copies of all incoming emails without having to log into an account each day -- and be at risk of triggering a security warning for a suspicious login.' -- source: https://it.slashdot.org/story/20/12/02/1944205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Malicious npm Packages Caught Installing Remote Access Trojans
by Peter Reutemann 03 Dec '20

03 Dec '20

'The security team behind the "npm" repository for JavaScript libraries removed two npm packages this Monday for containing malicious code that installed a remote access trojan (RAT) on the computers of developers working on JavaScript projects. From a report: The name of the two packages was jdb.js and db-json.js., and both were created by the same author and described themselves as tools to help developers work with JSON files typically generated by database applications. Both packages were uploaded on the npm package registry last week and were downloaded more than 100 times before their malicious behavior was detected by Sonatype, a company that scans package repositories on a regular basis. According to Sonatype's Ax Sharma, the two packages contained a malicious script that executed after web developers imported and installed any of the two malicious libraries. The post-install script performed basic reconnaissance of the infected host and then attempted to download and run a file named patch.exe that later installed njRAT, also known as Bladabindi, a very popular remote access trojan that has been used in espionage and data theft operations since 2015.' -- source: https://tech.slashdot.org/story/20/12/02/1939247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever
by Peter Reutemann 03 Dec '20

03 Dec '20

'Dan Goodin, writing for ArsTechnica: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device -- over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable -- meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed. This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice. "This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.' -- source: https://apple.slashdot.org/story/20/12/02/1933245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: 'Don't Make Users Mad'
by Peter Reutemann 01 Dec '20

01 Dec '20

'Greg Kroah-Hartman, the Linux Foundation fellow currently responsible for stable Linux kernel releases, shared the lessons he's learned as a kernel developer that are applicable to other developers at this year's Linux App Summit. He started by showing how he could succinctly distill the essence of the talk into a single five-word slide: "Don't make your users mad...." Kroah-Hartman explains that one of Linus Torvalds' most deeply-held convictions: don't break userspace. "Other operating systems have this rule as well — it's a very solid rule — because we always want you to upgrade. And we want you to upgrade without worrying about it. We don't want you to feel scared. If you see a new release, and we say, 'Hey, this fixes a bunch of problems,' we don't want you to feel worried about taking that. That's really really important — especially with security...." If you do make a change, make sure there truly is a compelling reason. "You have to provide enough reason and enough goodness to force somebody to take the time to learn to do something else. That's very rare." His example of this was systemd, which unified a variety of service configurations and initialization processes. "They did it right. They provided all the functionality, they solved a real problem that was there. They unified all these existing tools and problems in such a way that it was just so much better to use, and it provided enough impetus that everybody was willing to do the work to modify their own stuff and move to the new model. It worked. People still complain about it, but it worked. Everybody switched... It works well. It solves a real problem. "That was an example of how you can provide a compelling reason to move on — and make the change."' -- source: https://linux.slashdot.org/story/20/11/28/0714229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi Used To Hack Tesla Model X SUV Key Fob
by Peter Reutemann 29 Nov '20

29 Nov '20

'According to this Tom's Hardware story, a Belgian PhD student managed to wrest full control of a Tesla Model X SUV, by way of hijacking the Bluetooth keyfob and reprogramming it, using a Raspberry Pi. Tesla has since issued a software update to protect against that kind of attack Since the attack is done via Bluetooth, control could be gained wirelessly from 5 meters away. According to the article this is the third time the same student "has managed to exploit the key fob and gain access to the car. Previously he was able to clone the fob..." Computer Weekly also got an interesting quote from a senior security consultant at the electronic design automation company Synopsys, who argues that the research "demonstrates the impacts of security requirements and security features not having proper validation."' -- source: https://tech.slashdot.org/story/20/11/28/2325210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 577-5304 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0