- wlug - University of Waikato Mail Lists

Schneier Slams Australia's Encryption Laws and CyberCon Speaker Bans
by Peter Reutemann 09 Oct '19

09 Oct '19

'Governments breaking encryption is bad, and "will get worse once breaking encryption means people can die," says one of the world's leading security experts. From a report: "Australia has some pretty draconian laws about forcing tech companies to break security," says cryptographer and computer security professional Bruce Schneier. He's referring to the controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, which came into force in December. "I actually don't like that, because stuff that you do flows downhill to the US. So stop doing that," he told the Australian Cybersecurity Conference, or CyberCon, in Melbourne on Wednesday. Schneier's argument against breaking encrypted communications is simple. "You have to make a choice. Either everyone gets to spy, or no one gets to spy. You can't have 'We get to spy, you don't.' That's not the way the tech works," he said. "As this tech becomes more critical to life, we simply have to believe, accept, that securing it is more important than leaving it insecure so you can eavesdrop on the bad guys."' -- source: https://it.slashdot.org/story/19/10/09/1855255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tor Project Removes 13.5% of Current Servers For Running EOL Versions
by Peter Reutemann 09 Oct '19

09 Oct '19

'The Tor Project has removed from its network this week more than 800 servers that were running outdated and end-of-life (EOL) versions of the Tor software. The removed servers represent roughly 13.5% of the 6,000+ servers that currently comprise the Tor network and help anonymize traffic for users across the world. Roughly 750 of the removed servers represent Tor middle relays, and 62 are exit relays -- where users exit the Tor network onto the world wide web after having their true location hidden through the Tor network. The organization said it plans to release a Tor software update in November that will natively reject connections with EOL Tor server versions by default, without any intervention from the Tor Project staff. "Until then, we will reject around 800 obsolete relays using their fingerprints," the Tor Project said in a statement this week.' -- source: https://tech.slashdot.org/story/19/10/09/1853238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Critical Remote Code Execution Flaw Fixed In Popular Terminal App For MacOS
by Peter Reutemann 09 Oct '19

09 Oct '19

'iTerm2 users: It's time to upgrade. A security audit sponsored by the Mozilla Open Source Support Program uncovered a critical remote code execution (RCE) vulnerability in the popular open-source terminal app for macOS. ITerm2 is an open-source alternative to the built-in macOS Terminal app, which allows users to interact with the command-line shell. Terminal apps are commonly used by system administrators, developers and IT staff in general, including security teams, for a variety of tasks and day-to-day operations. The iTerm2 app is a popular choice on macOS because it has features and allows customizations that the built-in Terminal doesn't, which is why the Mozilla Open Source Support Program (MOSS) decided to sponsor a code audit for it. The MOSS was created in the wake of the critical and wide-impact Heartbleed vulnerability in OpenSSL with the goal of sponsoring security audits for widely used open-source technologies. The flaw, which is now tracked as CVE-2019-9535, has existed in iTerm2 for the past seven years and is located in the tmux integration. Tmux is a terminal multiplexer that allows running multiple sessions in the same terminal window by splitting the terminal screen. The flaw was fixed in iTerm2 version 3.3.6, which was released today.' -- source: https://apple.slashdot.org/story/19/10/09/2048214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Essential Reveals Project Gem Smartphone With Very Long, Unusual Design
by Peter Reutemann 09 Oct '19

09 Oct '19

'Andy Rubin, the controversial mobile industry executive who co-founded Android, left Google amid allegations of sexual misconduct while retaining a huge severance package, and went on to create the Essential Phone, has tweeted photos teasing an upcoming device with an elongated design and very tall UI composed of card-like apps. The Verge reports: It look extremely small in his hands, too. The device has a large button and volume rocker on the right edge and a fingerprint divot around back, below what appears to be a single main camera. And as you can see, these devices have some decidedly flashy finishes that change color when you view them at different angles -- a sea green that shifts to yellow and blue, for example. An Essential spokesperson confirmed to the The Verge that this is the company's new phone, adding: "We've been working on a new device that's now in early testing with our team outside the lab. We look forward to sharing more in the near future." A couple hours later, Essential tweeted some slightly more official images of the new phone, which it's calling Project Gem. XDA-Developers also spotted some leaked code that mentions the divot on the rear of the device may activate its voice assistant when you tap your finger to it. They also suggest it runs Android and packs a Qualcomm Snapdragon 730 processor. ' -- source: https://mobile.slashdot.org/story/19/10/09/0519214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Kills Kaby Lake G, Vows To Offer Drivers For Five Years
by Peter Reutemann 09 Oct '19

09 Oct '19

'When Kaby Lake G debuted at CES 2018, it made a big bang. No one expected sworn rivals Intel and AMD to collaborate on a CPU package, marrying a 7th-gen Kaby Lake CPU with a unique AMD Radeon RX Vega GPU. But what began with a bang ended Monday with an unceremonious memo. From a report: The Product Change Notification published by Intel on Monday confirmed that pretty much every single Kaby Lake G, including the Core i7-8706G, the Core i7-8705G, and the Core i5-8305G, would be discontinued. Last call for orders will be on January 17, 2020, and the final shipments are scheduled for July 31, 2020. While the end of life of a processor isn't typically a big deal to consumers who own them, one sticking point could have been driver support. Specifically, Kaby Lake G drivers for the custom AMD Radeon RX Vega M graphics come only from Intel. With a normal discrete GPU, the consumer would download drivers from the original company, such as Nvidia or AMD. With Kaby Lake G kaput, where does that leave Kaby Lake G-owners? Intel said the company will follow its standard policy and provide driver support for Kaby Lake G for five years from the launch of the product. All told, that probably means another 3.5 years of driver updates.' -- source: https://slashdot.org/story/19/10/09/142229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fedora Drops 32-Bit Linux
by Peter Reutemann 09 Oct '19

09 Oct '19

'Brian Fagioli, writing for BetaNews: Beginning with the upcoming version 31 of the operating system, i686 32-bit processor support is being dropped by the Fedora Project. "The i686 architecture essentially entered community support with the Fedora 27 release. Unfortunately, there are not enough members of the community willing to do the work to maintain the architecture. Don't worry, though -- Fedora is not dropping all 32-bit packages. Many i686 packages are still being built to ensure things like multilib, wine, and Steam will continue to work," says Justin Forbes of Fedora Project. Forbes further explains, "While the repositories are no longer being composed and mirrored out, there is a koji i686 repository which works with mock for building 32-bit packages, and in a pinch to install 32-bit versions which are not part of the x86_64 multilib repository. Of course, maintainers expect this will see limited use. Users who simply need to run a 32-bit application should be able to do so with multilib on a 64-bit system."' -- source: https://tech.slashdot.org/story/19/10/09/154256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Internal Email Shows GitHub Plans To Renew ICE Contract
by Peter Reutemann 09 Oct '19

09 Oct '19

'GitHub CEO Nat Friedman explained why the company plans to renew a contract with U.S. Immigration and Customs Enforcement (ICE), even though he and others at GitHub oppose ICE's policy of separating children from parents at the border, Motherboard reported on Wednesday, citing an internal GitHub email. From a report: The email shows the continuing debate within the tech industry about whether companies should work specifically with ICE, and comes as a host of other companies have dealt with employee protests over corporate involvement with ICE. "In August, the GitHub leadership team learned about a pending renewal of our product by the U.S. Immigration & Customs Enforcement (ICE) agency. Since then, we have been talking with people throughout the company, based on our own personal concerns and those raised by Hubbers," Friedman's email reads, referring to GitHub employees. Evan Greer, deputy director at activism group Fight for the Future tweeted a copy of the email on Tuesday. Motherboard also separately obtained a copy of the email from a source inside GitHub. The product up for renewal is a license of GitHub Enterprise Server, an on-premises deployment of GitHub that customers can run on their own server, according to the email. ICE originally bought a license in April, 2016.' -- source: https://developers.slashdot.org/story/19/10/09/1557245 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Twitter transgression proves why its flawed 2FA system is such a privacy trap
by Peter Reutemann 09 Oct '19

09 Oct '19

'If ever there was a surefire way to sour users against a two-factor authentication system that was already highly flawed, Twitter has found it. On Tuesday, the social media site said that it used phone numbers and email addresses provided for 2FA protection to tailor ads to users. Twitter requires users to provide a valid phone number to be eligible for 2FA protection. A working cell phone number is mandatory even when users' 2FA protection is based solely on security keys or authenticator apps, which don't rely on phone numbers to work. Deleting a phone number from a user's Twitter settings immediately withdraws account from Twitter 2FA, as I confirmed just prior to publishing this post.' -- sources: https://arstechnica.com/information-technology/2019/10/twitter-used-phone-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

'Collapse OS' Is An Open-Source Operating System For the Post-Apocalypse
by Peter Reutemann 09 Oct '19

09 Oct '19

'Collapse OS is a new open-source operating system built specifically for use during humanity's darkest days. According to its creator, software developer Virgil Dupras, Collapse OS is what the people of the future will need to reconfigure their scavenged iPhones. For now, though, he's hosting the project on GitHub and looking for contributors. Motherboard reports: According to the Collapse OS site, Dupras envisions a world where the global supply chain collapses by 2030. In this possible future -- kind of a medium-apocalypse -- populations won't be able to mass produce electronics anymore, but they'll still be an enormous source of political and social power. Anyone who can scavenge electronics and reprogram them will gain a huge advantage over those who don't. Dupras believes that the biggest problem for tech savvy post-apocalyptic people will be microcontrollers -- tiny computers embedded in circuit boards that control the functions of computer systems. Collapse OS will work with Z80 8-bit microprocessors. Though less common today than 16- and 32-bit components, the 8-bit Z80 can be found in desktop computers, cash registers, musical instruments, graphing calculators, and everything in between. In a Reddit Q&A, Dupras explained that the Z80 was chosen "because it's been in production for so long and because it's been used in so many machines, scavenger have good chances of getting their hands on it." According to the product page, Collapse OS currently can run on a homebrew Z80-based computer called the RC2014, and on Reddit Dupras said it could theoretically run on a Sega Genesis console.' -- source: https://news.slashdot.org/story/19/10/08/2036204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Now Overclock a Raspberry Pi 4 For Some Nice Performance Gains
by Peter Reutemann 08 Oct '19

08 Oct '19

'The Raspberry Pi 4 is one of the cheapest single-board computers around. The new 4th generation is a solid performance lift over its predecessor and good bang for the buck if you're interested in learning Linux, working with embedded computing, or just want to kick back and play some retro games on an emulator. In addition, the latest version of the Raspberry Pi Foundation's Linux distribution, Raspbian Buster, comes with a new firmware revision for the tiny DIY PC that removes its 2GHz clock speed limit and allows voltage adjustments to wring out additional performance, with proper cooling of course. In testing, while there are no guarantees in overclocking, HotHardware was able to realize more than a 40% lift in their Raspberry Pi 4's processor clock speed, and a 50% boost to the GPU with an air-cooled mini case kit. Combined, they're not enough to turn the Pi 4 into your every day PC, but the performance gains are measurable and valuable. All it takes is a quick firmware update and a couple of Linux commands to dial things in.' -- source: https://hardware.slashdot.org/story/19/10/08/0312213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0