- wlug - University of Waikato Mail Lists

MIT Numerical Courses Moving From MATLAB To Julia
by Lawrence D'Oliveiro 03 Feb '20

03 Feb '20

Came across this <https://github.com/mitmath/julia-mit> repo, which is an intro to the Julia language. Apparently this is increasingly being used in place of MATLAB in numerical-computation courses at MIT. Why not Python? Because it is fine as long as you can use existing computational kernels, but as soon as you need custom ones, it gets slow if you do them in Python, or requires special skills to write them in C or Fortran, and make them callable from Python. Julia incorporates a “just-in-time” compiler using LLVM to achieve speed close to that of C in this case. Why not MATLAB? Because it is proprietary: Unlike Matlab, [Julia] is free/open-source software, which eliminates licensing headaches and allows you to look inside the Julia implementation to see how it works (since Julia is mostly written in Julia, its code is much more readable than a language like Python that is largely implemented in low-level C). They do like using Julia in Jupyter notebooks. I see a few .ipynb files in the repos for other courses (along with a few .pptx ones as well, unfortunately). Also several “.jmd” files, which look like some variety of markdown.

2 1

The State Of Video Streaming In NZ
by Lawrence D'Oliveiro 02 Feb '20

02 Feb '20

Apple’s TV+ streaming service is coming soon, followed by Disney’s one <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=122666…>. Note: Disney+ will break Sky's longtime near-monopoly on Disney content in these parts. Disney says that, ultimately, Disney+ will be the exclusive home of its content. So to get a comparable range of TV content to that you currently have free-to-air, you are going to have to subscribe to two or three or maybe more different streaming services. The increasing multitude of things to pay for isn’t about choice, but about no choice at all.

1 2

Should Huawei Just Abandon Android?
by Peter Reutemann 02 Feb '20

02 Feb '20

'Due to a U.S. government ban on sales to Huawei, Google revoked its license for popular apps last spring (including Gmail and the Play Store). But this week Huawei executive Fred Wangfei suggested that even if that ban is lifted, Huawei would continue developing its own app ecosystem instead to avoid the possibility of future political complications. The vice president of risk management and partner relations at Huawei later called those remarks "incorrect," while elsewhere Huawei issued a slightly different statement -- that "An open Android ecosystem is still our first choice, but if we are not able to continue to use it, we have the ability to develop our own." But BGR was already noting that Huawei "is ready to invest $3 billion this year to incentivize more than 4,000 developers to improve its Huawei Mobile Services system. Another billion is reserved for marketing purposes." And Android Authority suggests Huawei should stick to its original statement. "Maybe it's time for Huawei to go all-in on Harmony OS and do what it can to bring a viable alternative to Android and iOS..." If there's any company today that has the financial resources and raw talent necessary to bring in a viable third choice for smartphone operating systems, it's Huawei... Sure, it would be a long-term investment and there would inevitably be short-term losses as the company tries to find its footing and develop Harmony OS to have its own identity. But it would prevent something like the Huawei ban from happening to the company again as well as further the company's ambitions as not only a smartphone manufacturer but as a technology creator.... Huawei would have major difficulties in encouraging wide adoption of Harmony OS for one major reason: it's Huawei. The Huawei ban exists because the United States government doesn't trust Huawei and there are numerous (as yet unproven) accusations against the company related to espionage, IP theft, fraud, and even violations of international treaties... Huawei is already in a bad situation. It's going to need to dig itself out of the hole it's in regardless, so why not use this opportunity to turn lemons into lemonade and develop Harmony OS as a viable third option on the way? Maybe the industry needs a shake-up... Maybe a new operating system is just the kind of fire OEMs need to turn the market around. Maybe a real, potent threat that the billions of people who use Android and iOS just might jump ship to something else would scare companies into taking some real risks. As I said earlier, there aren't too many companies out there right now that could do this, but Huawei could. ' -- source: https://tech.slashdot.org/story/20/02/01/0152225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds Pulls WireGuard VPN into Linux 5.6 Kernel Source Tree
by Peter Reutemann 02 Feb '20

02 Feb '20

'"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar: While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities. While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android. Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration. Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.' -- source: https://it.slashdot.org/story/20/02/01/1846256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

OpenBSD Mail Server Bug Allowed Remotely Executing Shell Commands As Root
by Peter Reutemann 02 Feb '20

02 Feb '20

'This week a remotely-exploitable vulnerability (granting root privileges) was discovered in OpenSMTPD (OpenBSD's implementation of server-side SMTP). ZDNet notes that the library's "portable" version "has also been incorporated into other OSes, such as FreeBSD, NetBSD, and some Linux distros, such as Debian, Fedora, Alpine Linux, and more." To exploit this issue, an attacker must craft and send malformed SMTP messages to a vulnerable server... OpenSMTPD developers have confirmed the vulnerability and released a patch earlier Wednesday -- OpenSMTPD version 6.6.2p1... The good news is that the bug was introduced in the OpenSMTPD code in May 2018 and that many distros may still use older library versions, not affected by this issue. For example, only in-dev Debian releases are affected by this issue, but not Debian stable branches, which ship with older OpenSMTPD versions. Technical details and proof of concept exploit code are available in the Qualys CVE-2020-7247 security advisory. Hackaday has a more detailed description of the vulnerability, while the Register looks at the buggy C code. Interestingly, Qualys researchers exploited this vulnerability using a technique from the Morris Worm of 1988.' -- source: https://it.slashdot.org/story/20/02/01/2254237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Moves To Monetize Thunderbird, Transfers Project To New Subsidiary
by Peter Reutemann 31 Jan '20

31 Jan '20

'The Mozilla Foundation announced today that it was moving its Thunderbird email client to a new subsidiary named the MZLA Technologies Corporation. From a report: Mozilla said that Thunderbird will continue to remain free and open source, but by moving the project away from its foundation into a corporate entity they will be able to monetize the product and pay for its development easier than before. Currently, Thunderbird is primarily being kept alive through charitable donations from the product's userbase. "Moving to MZLA Technologies Corporation will not only allow the Thunderbird project more flexibility and agility, but will also allow us to explore offering our users products and services that were not possible under the Mozilla Foundation," said Philipp Kewisch, Mozilla Product Manager. "The move will allow the project to collect revenue through partnerships and non-charitable donations, which in turn can be used to cover the costs of new products and services," Kewisch added.' -- source: https://tech.slashdot.org/story/20/01/29/1430253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

64-Bit Times On 32-Bit Linux
by Lawrence D'Oliveiro 30 Jan '20

30 Jan '20

Some more patches have gone into the Linux kernel <https://www.theregister.co.uk/2020/01/30/linux_5_6_2038/> to allow 32-bit builds to deal with times past the year-2038 barrier. Basically the fix involves offering a 64-bit alternative to the original time_t type, without the whole app having to go 64-bit. One point I noticed is that certain filesystems (e.g. ext2, presumably ext3 as well) store on-disk fields with 32-bit timestamps, so if you’re using one of these, you’ll have to reformat the disks as well. And that would apply even if you’re already using a 64-bit OS.

1 0

GetTogether.community - alternative to meetup.com
by Peter Reutemann 30 Jan '20

30 Jan '20

Hi everyone Based on our discussions at the AGM on Monday night... Next year, I'll be advertising our meetings also on GetTogether, a free/open-source alternative to meetup.com. If you've been using meetup.com, please consider helping me test-drive GetTogether by creating an account and joining the WLUG team/group. WLUG is accessible here on GetTogether: https://gettogether.community/waikato-linux-users-group/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

autoremove
by john 29 Jan '20

29 Jan '20

Hi all, At our last meeting Tom was concerned about Linux bloating with surplus files. I have always found this to seldom be the case due to : a. The new download removes the older files or: b. The command autoremove clears the unused kernels and other not required files. eg. john@polomint:~$ sudo apt autoremove Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be REMOVED: linux-headers-4.15.0-72 linux-headers-4.15.0-72-generic linux-image-4.15.0-72-generic linux-modules-4.15.0-72-generic linux-modules-extra-4.15.0-72-generic 0 upgraded, 0 newly installed, 5 to remove and 4 not upgraded. After this operation, 332 MB disk space will be freed. Do you want to continue? [Y/n] Cheers John..

1 0

Intel Is Patching Its 'Zombieload' CPU Security Flaw For the Third Time
by Peter Reutemann 28 Jan '20

28 Jan '20

'For the third time in less than a year, Intel has disclosed a new set of vulnerabilities related to the speculative functionality of its processors. On Monday, the company said it will issue a software update "in the coming weeks" that will fix two more microarchitectural data sampling (MDS) or Zombieload flaws. This latest update comes after the company released two separate patches in May and November of last year. Compared to the MDS flaws Intel addressed in those two previous patches, these latest ones have a couple of limitations. To start, one of the vulnerabilities, L1DES, doesn't work on Intel's more recent chips. Moreover, a hacker can't execute the attack using a web browser. Intel also says it's "not aware" of anyone taking advantage of the flaws outside of the lab. In response to complaints of the company's piecemeal approach, Intel said that it has taken significant steps to reduce the danger the flaws represent to its processors. "Since May 2019, starting with Microarchitectural Data Sampling (MDS), and then in November with TAA, we and our system software partners have released mitigations that have cumulatively and substantially reduced the overall attack surface for these types of issues," a spokesperson for the company said. "We continue to conduct research in this area -- internally, and in conjunction with the external research community.' -- source: https://it.slashdot.org/story/20/01/27/2126231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0