- wlug - University of Waikato Mail Lists

An Update On Microsoft's 'GitHub Arctic Vault Program'
by Peter Reutemann 01 Mar '20

01 Mar '20

'news.com.au reports: The GitHub Arctic Vault program is part of the now Microsoft-owned code repository GitHub...aimed at preserving the information for generations to come... "We chose to store GitHub's public repositories in the Arctic World Archive in Svalbard [a Norwegian island] because it is one of the most remote and geopolitically stable places on Earth and is about a mile down the road from the famous Global Seed Vault," said GitHub vice president of special projects Thomas Dohmke. Mr Dohmke said open source code in particular was worth preserving... "Ultimately, it's time to create multiple durable backups of the software our world depends on..." Other treasures include the original source code for MS-DOS (the precursor to Microsoft Windows), the open source code that powers Bitcoin, Facebook's React, and the publishing platform Wordpress... "The Arctic Code Vault was just the beginning of the GitHub Archive Program's journey to secure the world's open source code," GitHub vice president of special projects Thomas Dohmke told news.com.au. "We've partnered with multiple organisations and advisers to help us maximise the GitHub Archive Program's value and preserve all open-source software for future generations." One of those partners is Norwegian archival experts Piql, who specialise in very-long-term data storage. The company uses around 200 silver halide and polyester film reels designed to last a thousand years to store the information... ' -- source: https://developers.slashdot.org/story/20/03/01/2015212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ghostcat Bug Impacts All Apache Tomcat Versions Released in the Last 13 Years
by Peter Reutemann 01 Mar '20

01 Mar '20

'Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.' -- source: https://apache.slashdot.org/story/20/02/28/184218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

NZ Domain Costs Going Up
by Lawrence D'Oliveiro 28 Feb '20

28 Feb '20

InternetNZ is seeing fewer registrations of .nz domains, so it is raising prices <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=123126…>. Apparently some are using .kiwi, and others are simply setting up pages on Facebook instead.

1 0

How Melissa Di Donato Is Going To Reinvent SUSE
by Peter Reutemann 28 Feb '20

28 Feb '20

'SUSE is one of the oldest open source companies and the first to market Linux for the enterprise. Even though it has undergone several acquisitions and a merger, it remains a strong player in the business. It has maintained its integrity and core values around open source. It continues to rely on its tried-and-tested Linux business and European markets, and generally shies away from making big moves taking big risks. Until now. SUSE appointed Melissa Di Donato as its first female CEO. She is making some serious changes to the company, from building a diverse and inclusive culture to betting on emerging technologies and taking risks. Soon after taking the helm last year, Di Donato spent the first few months traveling around the globe to meet SUSE teams and customers and get a better sense of the perception of the market about the company. Just like Red Hat CEO Jim Whitehurst, Di Donato didn’t come to the company from an open source background. She had spent the last 25 years of her career as a SUSE customer, so she did have an outsider’s perspective of the company. “I am not interested in what SUSE was when I joined. I am more interested in what we want to become,” she said.' -- source: https://www.linux.com/topic/open-source/how-melissa-di-donato-is-going-to-r… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Raspberry Pi 4 Linux Computer Gets Twice the RAM and USB-C Power Fix
by Peter Reutemann 27 Feb '20

27 Feb '20

'Brian Fagioli, writing for BetaNews: The Raspberry Pi line has provided great little Linux computers to nerds -- its low price and small size makes it ideal for tinkering and doing projects. But also, the device has proven to be a solid media device, wonderful for watching videos and emulating classic video games. In other words, it has been a very versatile computer, serving as many things to many people. With the release of the Raspberry Pi 4, however, it finally became powerful enough to serve as a true desktop computer. By installing a Linux distribution, some people can use it for day-to-day computer use, such as web browsing, playing media, and word processing. Unfortunately, the $35 base model came with a paltry 1GB of RAM. Today, this changes, as the company has dropped the price of the 2GB version to $35, effectively doubling the memory for the base model.' -- source: https://linux.slashdot.org/story/20/02/27/1520258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Quotes From RSA
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Among the plethora of pithy apothegms from the panel of crypto experts at the RSA Conference <https://www.theregister.co.uk/2020/02/26/rsa_2020_panel_discussion/>: “I give fusion power a higher chance of succeeding than quantum computing.” -- Ron Rivest “Blockchain is the wrong security technology for voting. I like to think of it as bringing a combination lock to a kitchen fire.” -- Ron Rivest “Intelligence is not about playing fair, it is about succeeding.” -- Whitfield Diffie, on the Crypto AG backdooring saga “I would like to understand how right to be forgotten could be for anything except to keep the little people in line. It is not the right to be forgotten by the secret police.” -- Whitfield Diffie Of course, there were some dissenting opinions to that last one ...

1 0

Smithsonian Releases 2.8 Million Images And 3D Models Into The Public Domain
by Lawrence D'Oliveiro 27 Feb '20

27 Feb '20

Just came across this news report <https://www.techdirt.com/articles/20200225/14150743985/smithsonian-releases…> about the Smithsonian Institution making a whole bunch of stuff available for free download and reuse under a Creative Commons CC0 licence. More info on their home page <https://www.si.edu/OpenAccess>. I had a quick look at one or two 3D models from <https://3d.si.edu/cc0>, and I see OBJ, glTF (OpenGL Transfer Format) and GLB (binary version of glTF) options available. These are all open formats, well-supported in non-proprietary software.

2 1

Ars takes the new Opera R2020 browser for a spin
by Peter Reutemann 26 Feb '20

26 Feb '20

'Conclusion We've been briefly excited by lesser-known browsers many times in the last 20 years, only to eventually gravitate back to the most comfortable of the big, common options. But the tide may be turning for lesser-known options like Opera. Using the same Chromium open source browser upstream as Google Chrome and Microsoft Edge do, there aren't likely to be many compatibility surprises—at least for Windows and Mac users. The Good - Opera feels both fast and familiar (enough) for anyone accustomed to Google Chrome, Microsoft Edge, or Firefox - First-rate Linux installation and update experience - The stand-out features feel immediately useful—Snapshot, VPN, Workspaces, pinned Messengers, and My Flow all fit very neatly and obviously into our existing workflows - Chromium upstream base means sites render familiarly and accurately to Chrome or Edge users - Battery saver feature makes bloated sites feel less bloated and wasteful, even on a desktop The Bad - Unit and currency conversion is still a little wonky and limited - DRM is completely non-functional on Linux The Ugly - Many Linux users won't care about broken DRM for philosophical reasons—but they won't use a non-Libre browser, for the same philosophical reasons' -- source: https://arstechnica.com/gadgets/2020/02/browser-review-opera-r2020-and-oper… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw in Billions of Wi-Fi Devices Left Communications Open To Eavesdropping
by Peter Reutemann 26 Feb '20

26 Feb '20

'Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."' -- source: https://mobile.slashdot.org/story/20/02/26/165207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Mac and Linux To Get a New Security Sandbox System
by Peter Reutemann 25 Feb '20

25 Feb '20

'Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.' -- source: https://news.slashdot.org/story/20/02/25/2028214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0