- wlug - University of Waikato Mail Lists

Over 47,000 Supermicro Servers Are Exposing BMC Ports on the Internet
by Peter Reutemann 03 Sep '19

03 Sep '19

'Catalin Cimpanu, writing for ZDNet: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Patches are available to fix the USBAnywhere vulnerabilities, but Supermicro and security experts recommend restricting access to BMC management interfaces from the internet, as a precaution and industry best practice.' -- source: https://tech.slashdot.org/story/19/09/03/2029210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Android Exploits Are Now Worth More Than iOS Exploits for the First Time
by Peter Reutemann 03 Sep '19

03 Sep '19

'Zerodium, a company which claims it buys and then resells software exploits to government and law enforcement agencies, has updated its price list today, and Android exploits are worth more than iOS exploits for the first time ever. From a report: According to the company, starting today, a zero-click (no user interaction) exploit chain for Android can get hackers and security researchers up to $2.5 million in rewards. A similar exploit chain impacting iOS is worth only $2 million. Zerodium's new price for Android exploits is almost twelve times more when compared to the maximum of $200,000 the company was willing to offer a year ago, and even 100 times more than Zerodium was paying for some of the lower-impact Android exploits. Zerodium has timed its announcement with Google's official release for Android 10, scheduled for late' -- source: https://tech.slashdot.org/story/19/09/03/164253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 69 Ratchets Up Tracking Protection, Switching it On by Default
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.' -- source: https://news.slashdot.org/story/19/09/03/1322212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Upcoming Firefox Update Will Decrease Power Usage on macOS by Up To Three Times
by Peter Reutemann 03 Sep '19

03 Sep '19

'Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.' -- source: https://news.slashdot.org/story/19/09/03/0654202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

mailman server upgrade
by Peter Reutemann 03 Sep '19

03 Sep '19

Hi everyone The university will be upgrading the mailman server on Monday Sept 2nd, which also hosts the WLUG mailing list. Unfortunately, the email I received notifying me about the upgrade did not state when or how long the outage will be, only that the new admin interface will be available after 5pm (NZ time). Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

Greg Kroah-Hartman Reveals His New Favorite Linux Distro
by Peter Reutemann 02 Sep '19

02 Sep '19

'Top Linux kernel developer Greg Kroah-Hartman gave a new 30-minute interview with TFIR during the Open Source Summit, 2019. He discusses security in the post-Spectre world, remembers when Microsoft joined the Linux distros mailing list, and acknowledges good-naturedly that he and Richard Stallman "approach things from a different standpoint". An anonymous reader writes: In the interview Kroah-Hartman talks about downsides of living in the Hague. "My son's school actually mandates that they all have MacBooks. So he has a MacBook, my wife has a MacBook, and that's about it." But of course, Kroah-Hartman himself is always using Linux. So what distro does he use? "I don't use openSUSE any more, I use Arch. And my build system I think is actually running Fedora. I have a number of virtual machines still running Gentoo, Dubya, and Fedora to do some testing on some userspace tools. But yeah, all my laptops and everything is switched over to Arch these days... I have a Chromebook that I play around with, and you can run Linux applications, and you can of course SSH into anything..." Why Arch? "At the moment it had something that I needed. I don't remember what it was, the latest development version, what not -- and I've known a number of the Arch developers over the years. Their idea of a constantly rolling, forward-moving system is the way to go... It's neutral, it's community-based, it has everything I need. It works really really well. I've actually converted my cloud instances that I have all to Arch... It's nice." And in addition, "Their Wiki is amazing. The documentation -- it's like one of the best resources out there these days... If you look up any userspace program and how to configure it and use it. Actually, the systemd Arch Wiki pages are one of the most amazing resources out there... "One of the main policies of Arch, or philosophies, is you stay as close to the upstream as possible. And as a developer, I want that... They're really good in feedback to the community. Because I want that testing -- I want to make sure that things are fixed. And if it is broken, I learn about it quickly and I fix it and push the stuff out. So that's actually a really good feedback loop. And that's some of the reasons I need it."' -- source: https://linux.slashdot.org/story/19/09/02/0018252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Engineer Launches Working Group To Bring Rust 'Full Parity With C'
by Peter Reutemann 01 Sep '19

01 Sep '19

'Someone from the Rust language governance team gave an interesting talk at this year's Open Source Technology Summit. Josh Triplett (who is also a principal engineer at Intel), discussed "what Intel is contributing to bring Rust to full parity with C," in a talk titled Intel and Rust: the Future of Systems Programming. An anonymous reader quotes Packt: Triplett believes that C is now becoming what Assembly was years ago. "C is the new Assembly," he concludes. Developers are looking for a high-level language that not only addresses the problems in C that can't be fixed but also leverage other exciting features that these languages provide. Such a language that aims to be compelling enough to make developers move from C should be memory safe, provide automatic memory management, security, and much more... "Achieving parity with C is exactly what got me involved in Rust," says Triplett. Triplett's first contribution to the Rust programming language was in the form of the 1444 RFC, which was started in 2015 and got accepted in 2016. This RFC proposed to bring native support for C-compatible unions in Rust that would be defined via a new "contextual keyword" union... He is starting a working group that will focus on achieving full parity with C. Under this group, he aims to collaborate with both the Rust community and other Intel developers to develop the specifications for the remaining features that need to be implemented in Rust for system programming. This group will also focus on bringing support for systems programming using the stable releases of Rust, not just experimental nightly releases of the compiler. Last week Triplett posted that the FFI/C Parity working group "is in the process of being launched, and hasn't quite kicked off yet" -- but he promised to share updates when it does.' -- source: https://developers.slashdot.org/story/19/08/31/1540225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Should the Linux Kernel Accept Drivers Written In Rust?
by Peter Reutemann 01 Sep '19

01 Sep '19

'Packt's recent story about Rust had the headline "Rust is the future of systems programming, C is the new Assembly." But there was an interesting discussion about the story on LWN.net. One reader suggested letting people write drivers for the Linux kernel in Rust. ("There's a good chance that encouraging people to submit their wacky drivers in Rust would improve the quality of the driver, partly because you can focus attention on the unsafe parts.") And that comment drew an interesting follow-up: "I spoke with Greg Kroah-Hartman, and he said he'd be willing to accept a framework in the kernel for writing drivers in Rust, as long as 1) for now it wasn't enabled by default (even if you did "make allyesconfig") so that people don't *need* Rust to build the kernel, and 2) it shows real benefits beyond writing C, such as safe wrappers for kernel APIs."' -- source: https://linux.slashdot.org/story/19/08/31/2138249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Office’s New “Save Experience”
by Lawrence D'Oliveiro 31 Aug '19

31 Aug '19

It should be so simple. Windows has a File Save dialog built in. Developers can call the API, with options to customise it if need be. Well, two APIs actually: the old Common File Dialog and the Common Item Dialog introduced in Windows Vista. But this was not good enough for the Office team and in Office 2010, Microsoft introduced the Backstage as a document management feature. ... If you are not so lucky and the location you want does not appear in the Backstage, you click Browse, and the old Windows Save dialog appears. In this case, instead of saving you time, the Backstage has added an extra step. There is a further wrinkle to the Backstage. In Options, you can set "Don't show the Backstage when opening or saving files with keyboard shortcut." As this option implies, this means you do not see the Backstage when invoking Save with Ctrl-S, but you do if you go to "File – Save As". However you do not if you go to "File – Save", even with an unsaved document. Consistency, who needs it? <https://www.theregister.co.uk/2019/08/30/saving_documents_in_microsoft_offi…>

1 0

Fwd: GovHack 2019
by Peter Reutemann 30 Aug '19

30 Aug '19

Please see attached flyer for details. The venue at uni is open to non-university people as well. Cheers, Peter -------- Original Message -------- From: David Nichols <david.nichols(a)waikato.ac.nz> Sent: August 30, 2019 1:23:09 PM GMT+10:00 To: cs-staff(a)waikato.ac.nz, cs-phd <cs-phd(a)waikato.ac.nz> Subject: GovHack 2019 Hi, could you advertise GovHack in your Moodle course instances and lectures? ========================================= Can you make something useful from government data sources? A weekend of protoptying, hacking and collaborative fun: https://govhack.org/events/hamilton/ The event is free and there are usually some cash prizes put forward by the sponsors: https://www.waikato.ac.nz/news-opinion/media/2016/govhack-nz-success-for-un… <https://elearn.waikato.ac.nz/%20https:/www.waikato.ac.nz/news-opinion/media…> ====================================== thanks Dave -- Dr David Nichols Department of Computer Science University of Waikato Hamilton 3240, New Zealand https://cs.waikato.ac.nz/~daven/ https://orcid.org/0000-0003-0321-7267 -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0