- wlug - University of Waikato Mail Lists

New Pine64 phones with upgraded hardware begin shipping in August
by Peter Reutemann 17 Jul '20

17 Jul '20

'Yesterday, Pine64 announced the end of the PinePhone UBPorts Community Edition campaign—but more importantly, the company declared the beginning of the postmarketOS Community Edition campaign. The base version of the new run of PinePhones shares the same $149 price point and the same basic technical specs as the original developer edition—but there's also a new, upgraded "Convergence Package" available at $199. Before anyone gets too excited, we need to make something clear—these devices, while attractively priced, should be considered beta gadgets for tinkerers to experiment and play with. They are not yet fully functional phones, and in their current development status, they are unlikely to be anyone's full-time daily-usage smartphone. The apps don't all work yet—including making calls—and battery life still leaves a lot to be desired.' -- source: https://arstechnica.com/gadgets/2020/07/pine64-launches-postmarketos-editio… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 84 Arrives With SameSite Cookie Changes, Web OTP API and Web Animations
by Peter Reutemann 17 Jul '20

17 Jul '20

'Google today launched Chrome 84 for Windows, Mac, Linux, Android, and iOS. Chrome 84 resumes SameSite cookie changes, includes the Web OTP API and Web Animations API, and removes older Transport Layer Security (TLS) versions. [...] First deprecated with Chrome 81 in April, TLS 1.0 and TLS 1.1 have now been completely removed with Chrome 84. This is notable for anyone who manages a website, even if they donâ(TM)t use Chrome at home or at work. TLS is a cryptographic protocol designed to provide communications security over a computer network -- websites use it to secure all communications between their servers and browsers. TLS also succeeds Secure Sockets Layer (SSL) and thus handles the encryption of every HTTPS connection.' -- source: https://it.slashdot.org/story/20/07/16/1444257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NSA On Securing VPNs
by Lawrence D'Oliveiro 16 Jul '20

16 Jul '20

Bruce Schneier reports <https://www.schneier.com/blog/archives/2020/07/nsa_on_securing.html> on an advisory from the US National Security Agency on how to secure your VPN setup. The document is available in a 10-page or 2-page version. The tips can be summarized as * Reduce the VPN gateway attack surface * Verify on CNSSP-15-compliant algorithms are in use * Avoid using default settings * Remove unused or non-compliant cryptography suites * Apply vendor-provided updates The one about not using default settings I found interesting, the explanation given being that “many vendors provide default configurations, automated configuration scripts, or graphical user interface wizards to aid in the deployment of VPNs”, but that these tools/defaults may prioritize ease of setup over security, and therefore enable extra options that should not be enabled. The longer version gives detailed configuration examples.

1 0

Microsoft urges patching severe-impact, wormable server vulnerability
by Peter Reutemann 16 Jul '20

16 Jul '20

'Microsoft is urgently advising Windows server customers to patch a vulnerability that allows attackers to take control of entire networks with no user interaction and, from there, rapidly spread from computer to computer. The vulnerability, dubbed SigRed by the researchers who discovered it, resides in Windows DNS, a component that automatically responds to requests to translate a domain into the IP address computers need to locate it on the Internet. By sending maliciously formed queries, attackers can execute code that gains domain administrator rights and, from there, take control of an entire network. The vulnerability, which doesn’t apply to client versions of Windows, is present in server versions from 2003 to 2019. SigRed is formally tracked as CVE-2020-1350. Microsoft issued a fix as part of this month's Update Tuesday.' -- source: https://arstechnica.com/information-technology/2020/07/microsoft-urges-patc… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

SoftBank To Sell ARM?
by Lawrence D'Oliveiro 15 Jul '20

15 Jul '20

Just four years after acquiring it, SoftBank now wants to sell off Arm Holdings, the company that creates (and licenses) designs for ARM chips <https://www.theregister.com/2020/07/14/softbank_considering_arm_sale_report/>. Besides SoftBank’s well-known string of recent investment missteps, there was this interesting quote: Speaking to The Register, one company insider said SoftBank was dissatisfied with Arm's business model and wanted it to charge more for royalties. But if it does that, it just makes alternatives like RISC-V look more competitive.

1 0

Rust Code In The Linux Kernel?
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Looks like several kernel developers, up to and including Linus Torvalds himself, are receptive <https://www.theregister.com/2020/07/13/rust_code_in_linux_kernel/> towards including code written in Mozilla’s Rust language in the Linux kernel. Albeit Torvalds sees it being used, initially at least, in parts “not very central to the kernel itself”, like drivers. A principal feature of Rust is the strict way it manages memory pointers, to limit the scope for common mistakes like memory leaks and double-frees. But unlike other languages like Java, Go or Kotlin, it does not bake the overhead of garbage collection into the language itself. This makes it more suitable for high-performance and lower-level tasks than those languages. More info here: <https://www.rust-lang.org/>.

1 0

Microsoft’s Dotnet Core Runs Better On Linux Than Windows
by Lawrence D'Oliveiro 14 Jul '20

14 Jul '20

Microsoft now has a (pre-release) extension for Visual Studio <https://www.theregister.com/2020/07/13/microsoft_visual_studio_gets_net/> so that you can not only deploy your Dotnet Core application on Linux, you can now debug it on a genuine Linux environment as well, using WSL 2. Mentioned in passing in that report are a couple of stories of developers finding their apps run better on cloud Linux instances than on Windows ones. So it seems the only thing left running on Windows proper is Visual Studio itself.

1 0

Microsoft Dropping PHP For Windows
by Lawrence D'Oliveiro 13 Jul '20

13 Jul '20

I didn’t know that Microsoft had been offering “official” PHP builds for Windows versions up to 7.x, but that is now due to end <https://www.theregister.com/2020/07/10/microsoft_php/>: they will not supply builds for PHP 8.0 or later. Also interesting to note in the article that Windows IIS’ share of the web server market has fallen precipitously lately, and has become a poor third (or even fourth) behind Apache and Nginx. And Google!?

2 1

Linus Torvalds Hopes Intel's AVX-512 'Dies A Painful Death'
by Peter Reutemann 13 Jul '20

13 Jul '20

'"Linux creator Linus Torvalds had some choice words today on Advanced Vector Extensions 512 (AVX-512) found on select Intel processors," reports Phoronix: In a mailing list discussion stemming from the Phoronix article this week on the compiler instructions Intel is enabling for Alder Lake (and Sapphire Rapids), Linus Torvalds chimed in. The Alder Lake instructions being flipped on in GCC right now make no mention of AVX-512 but only AVX2 and others, likely due to Intel pursuing the subset supported by both the small and large cores in this new hybrid design being pursued. The lack of seeing AVX512 for Alder Lake led Torvalds to comment: I hope AVX512 dies a painful death, and that Intel starts fixing real problems instead of trying to create magic instructions to then create benchmarks that they can look good on. I hope Intel gets back to basics: gets their process working again, and concentrate more on regular code that isn't HPC or some other pointless special case. I've said this before, and I'll say it again: in the heyday of x86, when Intel was laughing all the way to the bank and killing all their competition, absolutely everybody else did better than Intel on FP loads. Intel's FP performance sucked (relatively speaking), and it matter not one iota. Because absolutely nobody cares outside of benchmarks. The same is largely true of AVX512 now - and in the future... After several more paragraphs, Torvalds reaches his conclusion. "Stop with the special-case garbage, and make all the core common stuff that everybody cares about run as well as you humanly can." Phoronix notes that Torvalds' comments came "just weeks after he switched to AMD Ryzen Threadripper for his primary development rig."' -- source: https://linux.slashdot.org/story/20/07/12/1729255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Whither Dotnet Core?
by Lawrence D'Oliveiro 10 Jul '20

10 Jul '20

From <https://www.theregister.com/2020/07/09/net_core_still_a_microsoft/>, people are wondering why there isn’t a greater uptake of Microsoft’s cross-platform, open-source versions of Dotnet and C#: "What's up with non-.NET developers thinking C# is a Windows only, corporate bloatware language? It's not 2005 any more." Yeah, but it’s not clear why we would want *cross-platform* bloatware ...

1 0