- wlug - University of Waikato Mail Lists

Google's Auto-Delete Tools Are Practically Worthless For Privacy
by Peter Reutemann 15 Oct '19

15 Oct '19

'By default, Google collects a vast amount of data on users' behavior, including a lifelong record of web searches, locations, and YouTube views. But amid a privacy backlash and ongoing regulatory threats, the company has started to hype its recently released privacy tools, like the ability to automatically delete some of the data it collects about you -- data that helps power its $116 billion ad business. [...] In reality, these auto-delete tools accomplish little for users, even as they generate positive PR for Google. Experts say that by the time three months rolls around, Google has already extracted nearly all the potential value from users' data, and from an advertising standpoint, data becomes practically worthless when it's more than a few months old. "Anything up to one month is extremely valuable," says David Dweck, the head of paid search at digital ad firm WPromote. "Anything beyond one month, we probably weren't going to target you anyway." Dweck says that in the digital ad industry, recent activity is essential. If you start searching on Google for real estate or looking up housing values, for instance, Google might lump you into a "prospective home buyers" category for advertisers. That information becomes instantly valuable to realtors, appraisers, and lenders for ad targeting, and it could remain valuable for a while as other companies, such as painters or appliance brands, try to follow up on your home buying. Still, it's unusual for advertisers to target users based on their activity from months earlier, Dweck says.' -- source: https://yro.slashdot.org/story/19/10/15/1933230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaw In Sudo Enables Non-Privileged Users To Run Commands As Root
by Peter Reutemann 14 Oct '19

14 Oct '19

'A vulnerability has been discovered in Sudo -- one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system. The vulnerability in question is a sudo security policy bypass issue that could allow a malicious user or a program to execute arbitrary commands as root on a targeted Linux system even when the "sudoers configuration" explicitly disallows the root access. Sudo, stands for "superuser do," is a system command that allows a user to run applications or commands with the privileges of a different user without switching environments -- most often, for running commands as the root user. The vulnerability, tracked as CVE-2019-14287 and discovered by Joe Vennix of Apple Information Security, is more concerning because the sudo utility has been designed to let users use their own login password to execute commands as a different user without requiring their password. What's more interesting is that this flaw can be exploited by an attacker to run commands as root just by specifying the user ID "-1" or "4294967295." That's because the function which converts user id into its username incorrectly treats -1, or its unsigned equivalent 4294967295, as 0, which is always the user ID of root user. The vulnerability affects all Sudo versions prior to the latest released version 1.8.28, which has been released today.' -- source: https://linux.slashdot.org/story/19/10/14/2231235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apple's Safari Browser Is Sending Some Users' IP Addresses To China's Tencent
by Peter Reutemann 14 Oct '19

14 Oct '19

'"Apple, which often positions itself as a champion of privacy and human rights, is sending some IP addresses from users of its Safari browser on iOS to Chinese conglomerate Tencent -- a company with close ties to the Chinese Communist Party," reports the Reclaim the Net blog: Apple admits that it sends some user IP addresses to Tencent in the "About Safari & Privacy" section of its Safari settings.... The "Fraudulent Website Warning" setting is toggled on by default which means that unless iPhone or iPad users dive two levels deep into their settings and toggle it off, their IP addresses may be logged by Tencent or Google when they use the Safari browser. However, doing this makes browsing sessions less secure and leaves users vulnerable to accessing fraudulent websites... Even if people install a third-party browser on their iOS device, viewing web pages inside apps still opens them in an integrated form of Safari called Safari View Controller instead of the third-party browser. Tapping links inside apps also opens them in Safari rather than a third-party browser. These behaviors that force people back into Safari make it difficult for people to avoid the Safari browser completely when using an iPhone or iPad. Engadget adds that it's "not clear" whether or not Tencent is actually collecting IP addresses from users outside of China. ("You'll see mention of the collection in the U.S. disclaimer, but that doesn't mean it's scooping up info from American web surfers.") But Reclaim the Net points out that the possibility is troubling, in part because Safari is the #1 most popular mobile internet browser in America, with a market share of over 50%.' -- source: https://apple.slashdot.org/story/19/10/14/033225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

AGM next month
by Peter Reutemann 14 Oct '19

14 Oct '19

Hi everyone We have our AGM coming up next month, November 25th: Agenda (preliminary) • President's Report • Treasurer's Report • Election of 2020 Committee • General business • Consumption of pizza Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884356/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bell Labs Plans Big 50th Anniversary Event For Unix
by Peter Reutemann 13 Oct '19

13 Oct '19

'Photographer Peter Adams launched a "Faces of Open Source" portrait project in 2014. This week he posted a special announcement on the web site of Bell Labs: Later this month, Bell Labs will celebrate the 50th anniversary of Unix with a special two day "Unix 50" event at their historic Murray Hill headquarters. This event should be one for the history books with many notable Unix and computer pioneers in attendance...! As I was making those photographs (which will be on display at the event), I gained much insight into Bell Labs and the development of Unix. However, it was some of the more personal stories and anecdotes that brought Bell Labs to life and gave me a feel for the people behind the code. One such time was when Ken Thompson (who is an accomplished pilot) told me how he traveled to Russia after the fall of the Soviet Union in order to fly in a MiG-29 fighter jet... Brian Kernighan told me about how a certain portrait of Peter Weinberger found its way into some very interesting places. These included the concrete foundation of a building on Bell Labs campus, the cover images printed onto Unix CD-ROMs, and most notably, painted on the top of a nearby water tower. Which brings us to another important piece of Unix mythology that I learned about: the fictitious Bell Labs employee G.R. Emlin (a.k.a. "the gremlin").... A lot of this folklore (including the gremlin) is going to be on display at the Unix 50 event. The archivists at Bell Labs have outdone themselves by pulling together a massive collection of artifacts taken from the labs where Unix was developed for over 30 years. I was able to photograph a few of these artifacts last year, but so much more will be exhibited at this event -- including several items from the personal archives of some attendees. As if that wasn't enough, the event will also showcase a number of vintage computers and a look into Bell Labs future with a tour of their Future X Labs. The article includes some more quick stories about the Unix pioneers at Bell Labs (including "the gremlin") and argues that "the decision to freely distribute Unix's source code (to anyone who asked for it) inadvertently set the stage for the free and open source software movements that dominate the technology industry today... "In hindsight, maybe 1969 should be called the 'summer of code.'"' -- source: https://tech.slashdot.org/story/19/10/12/1625237 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Planting tiny spy chips in hardware can cost as little as $200
by Peter Reutemann 13 Oct '19

13 Oct '19

'More than a year has passed since Bloomberg Businessweek grabbed the lapels of the cybersecurity world with a bombshell claim: that Supermicro motherboards in servers used by major tech firms, including Apple and Amazon, had been stealthily implanted with a chip the size of a rice grain that allowed Chinese hackers to spy deep into those networks. Apple, Amazon, and Supermicro all vehemently denied the report. The National Security Agency dismissed it as a false alarm. The Defcon hacker conference awarded it two Pwnie Awards, for "most overhyped bug" and "most epic fail." And no follow-up reporting has yet affirmed its central premise. But even as the facts of that story remain unconfirmed, the security community has warned that the possibility of the supply chain attacks it describes is all too real. The NSA, after all, has been doing something like it for years, according to the leaks of whistle-blower Edward Snowden. Now researchers have gone further, showing just how easily and cheaply a tiny, tough-to-detect spy chip could be planted in a company's hardware supply chain. And one of them has demonstrated that it doesn't even require a state-sponsored spy agency to pull it off—just a motivated hardware hacker with the right access and as little as $200 worth of equipment.' -- source: https://arstechnica.com/information-technology/2019/10/planting-tiny-spy-ch… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast
by Peter Reutemann 10 Oct '19

10 Oct '19

Apologies for cross-posting. Cheers, Peter -------- Original Message -------- From: Simon Lyall <simon(a)darkmere.gen.nz> Sent: October 11, 2019 9:50:45 PM GMT+13:00 To: NZ Linux Users Group <nzlug(a)lists.nzoss.org.nz> Subject: [NZLUG] Sysadmin Miniconf CFP - Linux.conf.au 2020 on The Gold Coast The Sysadmin Miniconf is being held on The Gold Coast in January. We are looking for talks about all aspects of System Administration and Operations. Sysadmin Miniconf Call for Presentations https://sysadmin.miniconf.org/cfp20.html The Sysadmin Miniconf is part of Linux.conf.au, a 5-day technical conference being held in The Gold Coast in January 2020. There are 12 Single-day Miniconfs on specific topics such as Kubernetes, Documentation, Kernel and Security being held as part of the conference. The Miniconfs are currently looking for talk proposals https://linux.conf.au/programme/miniconfs/ Tickets for Linux.conf.au are now available: https://linux.conf.au/ Please forward to your colleagues, peers, or others you think may be interested -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar _______________________________________________ NZLUG mailing list NZLUG(a)lists.nzoss.org.nz http://lists.nzoss.org.nz/mailman/listinfo/nzlug -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 Will Begin Shipping 2 Linux Laptops With Coreboot-Based Open Source Firmware
by Peter Reutemann 10 Oct '19

10 Oct '19

'System76, the Denver-based Linux PC manufacturer and developer of Pop OS, has some stellar news for those who prefer their laptops a little more open. Later this month the company will begin shipping two of their laptop models with its Coreboot-powered open source firmware. From a report: Beginning today, System76 will start taking pre-orders for both the Galago Pro and Darter Pro laptops. The systems will ship out later in October, and include the company's Coreboot-based open source firmware which was previously teased at the 2019 Open Source Firmware Conference. (Coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.) What's so great about ripping out the proprietary firmware included in machines like this and replacing it with an open alternative? To begin with, it's leaner. System76 claims that users can boot from power off to the desktop 29% faster with its Coreboot-based firmware. [...] Both of these laptops can be kitted out with 10th-Generation Intel CPUs (specifically the i5-10210U and the i7-10510U), and both have glare-resistant matte 1080p IPS displays. Beginning at $949, the Galago Pro features an all-aluminum chassis, a wealth of connectivity options including HDMI, DisplayPort to USB-C and Thunderbolt, and can be configured with up to 32GB of RAM and up to 6TB of storage space. The Darter Pro, meanwhile, can be built out with 32GB of RAM and up to 2TB of storage, and features up to 10 hours of battery life.' -- source: https://hardware.slashdot.org/story/19/10/10/1847228 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Forum cracks the vintage passwords of Ken Thompson and other Unix pioneers
by Peter Reutemann 10 Oct '19

10 Oct '19

'As one of the original versions of Unix, BSD is an ancient operating system. So it shouldn’t come as a surprise that it used what are, by today’s standards, strange, even ridiculous security. For one, the hashing function protecting passwords, though state of the art 40 years ago, is now trivial to crack. Stranger still, the password hashes of some BSD creators were included in publicly available source code. And then, there are the passwords people chose. Last week, technologist Leah Neukirchen reported finding a source tree for BSD version 3, circa 1980, and successfully cracking passwords of many of computing’s early pioneers. In most of the cases the success was the result of the users choosing easy-to-guess passwords. BSD co-inventor Dennis Ritchie, for instance, used “dmac” (his middle name was MacAlistair); Stephen R. Bourne, creator of the Bourne shell command line interpreter, chose “bourne”; Eric Schmidt, an early developer of Unix software and now the executive chairman of Google parent company Alphabet, relied on “wendy!!!” (the name of his wife); and Stuart Feldman, author of Unix automation tool make and the first Fortran compiler, used “axolotl” (the name of a Mexican salamander). Weakest of all was the password for Unix contributor Brian W. Kernighan: “/.,/.,”—representing a three-character string repeated twice using adjacent keys on a QWERTY keyboard. (None of the passwords included the quotation marks.) But there were at least five plaintext passwords that remained out of reach. They included those belonging to Turkish computer scientist Özalp Babaoğlu, Unix software developer Howard Katseff, and crucial Unix contributors Tom London and Bob Fabry. But the uncracked hash that seemed to occupy Neukirchen the longest was the password used by Ken Thompson, another Unix co-inventor. “I never managed to crack ken's password with the hash ZghOT0eRm4U9s, and I think I enumerated the whole 8 letter lowercase + special symbols key space,” Neukirchen reported in the above-linked thread, posted to the Unix Heritage Society mailing list. “Any help is welcome.' -- source: https://arstechnica.com/information-technology/2019/10/forum-cracks-the-vin… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A detailed look at Ubuntu’s new experimental ZFS installer
by Peter Reutemann 10 Oct '19

10 Oct '19

'Yesterday brought exciting news on the ZFS and Ubuntu fronts—experimental ZFS root support in the installer for Ubuntu's upcoming interim release, Eoan Ermine. The feature appeared in the 2019-10-09 daily build of Eoan—it's not in the regular beta release and, in fact, wasn't even in the "current daily" when we first went to download it. It's that new! (Readers wanting to play with the new functionality can find it in today's daily build, available here.)' -- source: https://arstechnica.com/information-technology/2019/10/a-detailed-look-at-u… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0