- wlug - University of Waikato Mail Lists

Huawei Says Hongmeng OS Isn't Designed as an Android Replacement
by Peter Reutemann 19 Jul '19

19 Jul '19

'Huawei reportedly wants to keep using Google's Android operating system in its phones instead of jumping to its self-developed Hongmeng system. From a report: Company senior vice president Catherine Chen told reporters in Brussels this week that the Hongmeng OS isn't even designed for phones, according to Chinese state news agency Xinhua. Chen apparently said Hongmeng is for industrial use, noting that it contains far fewer lines of code than a phone OS, and has much lower latency than a phone, meaning it can process a very high volume of data messages with little delay. Latest episode in a confusing narrative about what Huawei even intends to do. The company's executives have previously said on record that its homegrown operating system is designed to replace Android on its handsets. One executive said the operating system would be released by last month -- a target that Huawei has missed.' -- source: https://tech.slashdot.org/story/19/07/19/1524253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Rust-Based TLS Library Outperformed OpenSSL in Almost Every Category
by Peter Reutemann 19 Jul '19

19 Jul '19

'A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. From a report: The findings are the result of a recent four-part series of benchmarks carried out by Joseph Birr-Pixton, the developer behind the Rustls library. The findings showed that Rustls was 10% faster when setting up and negotiating a new server connection, and between 20 and 40% faster when setting up a client connection. But while handshake speeds for new TLS connections are important, most TLS traffic relies on resuming previously negotiated handshakes. Here, too, Rustls outperformed the aging OpenSSL, being between 10 and 20% in resuming a connection on the server-side, and being between 30 and 70% quicker to resume a client connection. Furthermore, Rustls also fared better in sheer bulk performance -- or the speed at which data is transferred over the TLS connection. Birr-Pixton said Rustls could send data 15% faster than OpenSSL, and receive it 5% faster as well.' -- source: https://tech.slashdot.org/story/19/07/19/1546224 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

My browser, the spy: How extensions slurped up browsing histories from 4M users
by Peter Reutemann 18 Jul '19

18 Jul '19

'When we use browsers to make medical appointments, share tax returns with accountants, or access corporate intranets, we usually trust that the pages we access will remain private. DataSpii, a newly documented privacy issue in which millions of people’s browsing histories have been collected and exposed, shows just how much about us is revealed when that assumption is turned on its head. DataSpii begins with browser extensions—available mostly for Chrome but in more limited cases for Firefox as well—that, by Google's account, had as many as 4.1 million users. These extensions collected the URLs, webpage titles, and in some cases the embedded hyperlinks of every page that the browser user visited. Most of these collected Web histories were then published by a fee-based service called Nacho Analytics, which markets itself as “God mode for the Internet” and uses the tag line “See Anyone’s Analytics Account.” Web histories may not sound especially sensitive, but a subset of the published links led to pages that are not protected by passwords—but only by a hard-to-guess sequence of characters (called tokens) included in the URL. Thus, the published links could allow viewers to access the content at these pages. (Security practitioners have long discouraged the publishing of sensitive information on pages that aren't password protected, but the practice remains widespread.)' -- source: https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slack Resets Passwords For 1% of Its Users Because of 2015 Hack
by Peter Reutemann 18 Jul '19

18 Jul '19

'Slack published more details about a password reset operation that ZDNet reported earlier today. According to a statement the company published on its website, the password reset operation is related to the company's 2015 security breach. In March 2015, Slack said hackers gained access to some Slack infrastructure, including databases storing user credentials. Hackers stole hashed passwords, but they also planted code on the company's site to capture plaintext passwords that users entered when logging in. At the time, Slack reset passwords for users who it believed were impacted, and also added support for two-factor authentication for all accounts. But as ZDNet reported earlier today, the company recently received a batch of Slack users credentials, which prompted the company to start an investigation into its source and prepare a password reset procedure. "We immediately confirmed that a portion of the email addresses and password combinations were valid, reset those passwords, and explained our actions to the affected users," Slack said. In a message on its website, Slack said this batch of credentials came via its bug bounty program. The company said it initially believed the data came from users who had their PCs infected with malware, or users who reused passwords across different services.' -- source: https://tech.slashdot.org/story/19/07/18/1610221 Yep, been one of them... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft To Explore Using Rust
by Peter Reutemann 18 Jul '19

18 Jul '19

'Microsoft plans to explore using the Rust programming language as an alternative to C, C++, and others, as a way to improve the security posture of its and everyone else's apps. From a report: The announcement was made yesterday by Gavin Thomas, Principal Security Engineering Manager for the Microsoft Security Response Center (MSRC). "You're probably used to thinking about the Microsoft Security Response Center as a group that responds to incidents and vulnerabilities," Thomas said. "We are a response organization, but we also have a proactive role, and in a new blog series we will highlight Microsoft's exploration of safer system programming languages, starting with Rust." The end game is to find a way to move developers from the aging C and C++ programming language to so-called "memory-safe languages." Memory-safe languages, such as Rust, are designed from the ground up with protections against memory corruption vulnerabilities, such as buffer overflows, race conditions, memory leaks, use-after free and memory pointer-related bug' -- source: https://developers.slashdot.org/story/19/07/17/1630241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Warn When Saved Logins are Found in Data Breaches
by Peter Reutemann 18 Jul '19

18 Jul '19

'Starting in Firefox 70, Mozilla aims to have the browser report when any of your saved logins were found in data breaches. This will be done through their partnership with the Have I Been Pwned data breach site. From a report: Mozilla is slowly integrating their independent Firefox Monitor service and the new Firefox Lockwise password manager directly into Firefox. Mozilla is also considering premium services based around these features in the future. As part of this integration, Firefox will scan the saved login names and passwords and see if they were exposed in a data breach listed on Have I been Pwned. If one is found, Firefox will alert the user and prompt them to change their password. This new feature will only work, though, for data breaches that exposed passwords and when the password was saved prior to an associated data breach.' -- source: https://news.slashdot.org/story/19/07/17/1933231 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: Join us at the Red Hat & Ingram Micro Partner Day!
by Roger Hardy 17 Jul '19

17 Jul '19

Below was the source of that. In my experience, this is usually more sales than technical, but can be interesting all the same. Sorry for the spam..... What’s new with Red Hat?To make sure our emails get to your inbox, add imnz_ms(a)ingrammicro.co.nz to your address book.Email not displaying correctly? View it in your browser.Dear Rodger, You’re invited to join Ingram Micro and Red Hat as we bring you the very first Red Hat Partner Day. We’ll be presenting updates and insights on the newest technologies and architectures in hybrid multi-cloud solutions to help you: Learn how Red Hat's latest technologies can help you and your customers break down the barriers to true hybrid and multi-cloud environments.Understand how to use automation and intelligent management of cloud technologies to reduce security risks and exposures.Find out what’s new and happening at Red Hat.LOCATIONSAucklandRydges Hotel Hobson Room Tuesday, 23 July 2019 8:30 am - 11:40 am WellingtonThe Intercontinental Wellington Room Thursday, 25 July 2019 8:30 am - 11:40 amAGENDA8:30 - 9:30Breakfast9:30 - 9:35Welcome9:30 - 10:15Red Hat Enterprise Linux 8 with Insights and Ansible Automation10:15 - 10:55Red Hat OpenShift Container Platform 4: Enterprise Kubernetes & the Future of Open Hybrid Cloud10:55 - 11:10Industry Trends11:10 - 11:40Panel Discussion on Strategic portfolio Hybrid Cloud Register Now For more information, please contact: helen.chan(a)ingrammicro.com.Ingram Micro (N.Z.) Ltd 78 Apollo Drive, Rosedale, Auckland 0632nz.ingrammicro.com Follow on Twitter Follow on Linkedin Like on Facebook Copyright © 2019, All rights reserved. Our mailing address is: Ingram Micro New Zealand 78 Apollo Drive Rosedale Auckland, 0632 New Zealand Standard terms and conditions apply View our privacy policy Update preferences Unsubscribe

1 0

Red Hat Tech Talk: Hybrid Cloud New Zealand
by Peter Reutemann 17 Jul '19

17 Jul '19

Just saw the following (free, I believe) event come through on the NZOSS mailing list and thought people on here might be interested as well: Red Hat Tech Talk: Hybrid Cloud New Zealand At this afternoon event, meet our experts, hear what's new at Red Hat and get the latest insights on: - How to deliver innovative apps through containers - Security, compliance and governance for apps and workloads that run on a mix of public and private clouds - Automation and management capabilities for genuine portability of workloads into public cloud - How Red Hat Enterprise Linux 8 and Red Hat OpenShift 4 are transformational for hybrid clouds Select from two cities: Auckland - 23 July Wellington - 25 July Event registration: https://events.redhat.com/profile/form/index.cfm?PKformID=0x69788abcd# Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Giving Greylisting A Try
by Lawrence D'Oliveiro 15 Jul '19

15 Jul '19

I have decided to try installing sqlgrey on my VPS to see if that cuts down on the volume of spam. The basic idea is more than a decade old, and I can’t find much in the way of newer testimonials as to how wonderful it continues to be. On the other hand, I can’t see anyone saying it is now a terrible idea that should have a stake put through its heart and buried in an unmarked grave at midnight and forgotten. (Actually I’m posting this message just to see how legitimate mail makes it through the greylist obstacle course; it’s only been running less than an hour, and has already blocked 10 spam messages so far.)

2 7

meeting next Monday
by Peter Reutemann 15 Jul '19

15 Jul '19

Hi everyone We have a WLUG meeting next Monday: "Ben Radburnd will showcase GalliumOS (https://galliumos.org/) on his Chromebook." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884291/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0