- wlug - University of Waikato Mail Lists

Richard Stallman’s Last Interview As FSF President
by Lawrence D'Oliveiro 17 Sep '19

17 Sep '19

Seems the great prophet has bumbled into matters where perhaps he should have kept his mouth shut, and is now stepping down from the FSF. But leaving that aside, this interview <https://www.theregister.co.uk/2019/09/17/richard_stallman_interview/> has the usual choice nuggets on subjects he does know something about: One thing that has changed is that nowadays, a non-free program is typically malware as well. That was not the case in 1983. In 1983, when a proprietary software product was discovered to be malware, it was scandalous. It was shocking. It made the news, sort of at least in the tech press, because this wasn't the usual case. It there was a certain level of scruples, even among proprietary software developers. But over the years, those scruples have evaporated, as companies raced each other to the bottom in terms of mistreating their own users. And now, almost any non free program you run is mistreating you somehow.

1 0

Password-exposing bug purged from LastPass extensions
by Peter Reutemann 16 Sep '19

16 Sep '19

'Developers of the LastPass password manager have patched a vulnerability that made it possible for websites to steal credentials for the last account the user logged into using the Chrome or Opera extension. The vulnerability was discovered late last month by Google Project Zero researcher Tavis Ormandy, who privately reported it to LastPass. In a write-up that became public on Sunday, Ormandy said the flaw stemmed from the way the extension generated popup windows. In certain situations, websites could produce a popup by creating an HTML iframe that linked to the Lastpass popupfilltab.html window rather than through the expected procedure of calling a function called do_popupregister(). In some cases, this unexpected method caused the popups to open with a password of the most recently visited site.' -- source: https://arstechnica.com/information-technology/2019/09/lastpass-fixes-bug-t… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Say hello to 802.11ax: Wi-Fi 6 device certification begins today
by Peter Reutemann 16 Sep '19

16 Sep '19

'Today, the Wi-Fi Alliance launched its Wi-Fi Certified 6 program, which means that the standard has been completely finalized, and device manufacturers and OEMs can begin the process of having the organization certify their products to carry the Wi-Fi 6 branding. If you need a bit of a catch-up, Wi-Fi 6—aka 802.11ax—is the next generation of Wi-Fi. 802.11ax will, at least in theory, allow many more nearby devices to use the same Wi-Fi channels and frequencies without causing as much congestion and lag as Wi-Fi 5 (better known as 802.11ac) and Wi-Fi 4 (802.11n) do. That's the good news. The bad news is that very few of these benefits can be seen just from buying a Wi-Fi 6 router—you need most, if not all, of the devices in range (both yours and, ideally, any neighbors') to also support Wi-Fi 6 before you see the improvements. 802.11ax also mandates support for the WPA3 encryption and authentication protocol. WPA3 provides considerably better security for your Wi-Fi network than WPA2 did, and due to its adoption of Simultaneous Authentication of Equals (SAE), it will hopefully prove more robust toward future attacks as well.' -- source: https://arstechnica.com/gadgets/2019/09/say-hello-to-802-11ax-wi-fi-6-devic… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Pine64 Confirms $25 'PineTime' Smartwatch for Linux Smartphones
by Peter Reutemann 16 Sep '19

16 Sep '19

'Besides their Linux laptops, single-board computers, and tablets, Pine64 is now also working on "PineTime," a new $25 smartwatch for Linux smartphones running open source software (and based on either ARM Mbed or FreeRTOS), reports Liliputing.com: The company describes the PineTime watch as a companion for Linux smartphones... you know, like the company's upcoming $150 PinePhone. For either or both of those reasons, it could appeal to folks who may not have wanted in on the smartphone space until now... The PineTime uses an existing watch body that's used by other device makers, but Pine64 is choosing custom internal hardware. The PineTime will support Bluetooth 5.0, a heart rate monitor, and multi-day battery life and the watch features a zinc alloy & plastic case and comes with a charging dock... At this point the PineTime is described as a side project, which means it's not a top priority for Pine64. While the company says the picture above is an actual photo of a prototype, Pine64 is still seeking software developers interested in contributing to the project, and the company's primary focus at this point will still be other upcoming devices like the PineBook Pro laptop and PinePhone smartphone.' -- source: https://news.slashdot.org/story/19/09/15/2345229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 5.3 Released
by Peter Reutemann 16 Sep '19

16 Sep '19

'This release includes support for AMD Navi GPUs; support for the umwait x86 instructions that let processes wait for short amounts of time without spinning loops; a 'utilization clamping' mechanism that is used to boost interactivity on power-asymmetric CPUs used in phones; a new pidfd_open(2) system call that completes the work done to let users deal with the PID reuse problem; 16 millions of new IPv4 addresses in the 0.0.0.0/8 range are made available; support for Zhaoxin x86 CPUs; support Intel Speed Select for easier power selection in Xeon servers; and support for the lightweight hypervisor ACRN, built for embedded IoT devices. As always, many other new drivers and improvements can be found in the changelog.' -- source: https://linux.slashdot.org/story/19/09/15/2319220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

meeting next Monday
by Peter Reutemann 16 Sep '19

16 Sep '19

Hi everyone We have a WLUG meeting coming up next week: "Lawrence D'Oliveiro will talk about how he set up greylisting (https://en.wikipedia.org/wiki/Greylisting) on his VPS to reduce the amount of spam, what lessons he learned and what pitfalls to avoid." -- details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884313 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Debian 10: Playing catch-up with the rest of the Linux world (that’s a good thing)
by Peter Reutemann 13 Sep '19

13 Sep '19

Ars Technica has a review of Debian 10 which got released in July: 'The Debian project, the upstream mother of countless Linux distributions, has released Debian 10, also known as "Buster." And yes, that's a reference to the character from Toy Story. All Debian releases are named after Toy Story characters. Over the years, Debian has built a well-deserved reputation as a rock-solid distro for those who don't want the latest and greatest and instead prefer the stability that comes from sticking with what works. Naturally, Debian gets security updates, bug fixes, and maintenance releases like any distro, but don't expect major updates to applications or desktop environments with this Linux flavor. Right now, as with every release, Debian is pretty close to up to date with what the rest of the Linux world is doing. But Buster will be supported for five years, and Debian 11 won't arrive for at least two years (Buster comes just 26 months after Debian 9, though it has been five years since the big tweaks of Debian 8). So as time goes on, Buster will look increasingly outdated.' -- source: https://arstechnica.com/information-technology/2019/09/debian-10-playing-ca… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Is Taking Over--For Better Or For Worse
by Lawrence D'Oliveiro 13 Sep '19

13 Sep '19

You’ve probably come across pictures of Windows crash screens in various entertaining places, like public signage. Well, Linux is now taking over there, too <https://www.theregister.co.uk/2019/09/12/inlinkuk_crashed_ubuntu/>. And yes, whereas it was hilariously out-of-date versions of Windows before (XP remained quite common, for example), now it’s out-of-date versions of Linux.

1 0

Arch Linux-based Manjaro 18.1.0 'Juhraya' Now Available With GNOME, KDE, or Xfce
by Peter Reutemann 13 Sep '19

13 Sep '19

'Manjaro may have lofty goals of becoming a successful company, but let's be honest -- users of the Linux-based operating system don't really care about that. Don't get me wrong, I am sure most members of the Linux community are rooting for the newly-formed company's success, but they are probably more interested in the excellent operating system itself. Today, Manjaro Linux 18.1.0 "Juhraya" finally becomes available for download, and it isn't without some controversy. You see, rather than just offer up LibreOffice like most distributions, Juhraya offers an alternative choice at installation -- FreeOffice. "After six months of development, version 18.1 of Manjaro Linux is now available. Juhraya offers numerous improvements, especially with regard to Office productivity applications and package management. Another significant innovation in Manjaro 18.1 is the integrated support for FlatPak and Snap packages. For this purpose, the graphical package management tool 'bauh' (formerly known as 'fpakman' ) is now available to users," says Philip Muller, Manjaro developer.' -- source: https://linux.slashdot.org/story/19/09/12/1947223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Simjacker Attack Exploited In the Wild To Track Users For At Least Two Years
by Peter Reutemann 13 Sep '19

13 Sep '19

'Security researchers have disclosed today a major SMS-based attack method being abused in the real world by a surveillance vendor to track and monitor individuals. An anonymous reader shares a report: "We are quite confident that this exploit has been developed by a specific private company that works with governments to monitor individuals," security researchers from AdaptiveMobile Security said in a report. "We believe this vulnerability has been exploited for at least the last 2 years by a highly sophisticated threat actor in multiple countries, primarily for the purposes of surveillance." The attack, named Simjacker, works by attackers sending SMS messages to victims' phones. The SMS messages contain STK instructions that are run by a victim's SIM card to gather location data and the IMEI code, which is then sent through an SMS message to a logging system. Researchers said they've seen Simjacker being abused to track hundreds of victims for two years, yet it is unclear if the victims are criminals tracked by law enforcement, or dissidents tracked by oppressive regimes. Over one billion smartphone users use SIM cards deemed vulnerable to this attack.' -- source: https://it.slashdot.org/story/19/09/12/1637232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0