- wlug - University of Waikato Mail Lists

Firefox Will Give You a Fake Browsing History To Fool Advertisers
by Peter Reutemann 26 Jun '19

26 Jun '19

'Security through obscurity is out, security through tomfoolery is in. >From a report: That's the basic philosophy sold by Track THIS, "a new kind of incognito" browsing project, which opens up 100 tabs crafted to fit a specific character -- a hypebeast, a filthy rich person, a doomsday prepper, or an influencer. The idea is that your browsing history will be depersonalized and poisoned, so advertisers won't know how to target ads to you. It was developed as a collaboration between mschf (pronounced "mischief") internet studios and Mozilla's Firefox as a way of promoting Firefox Quantum, the newest Firefox browser. [...] Just a warning -- if you use Track THIS it may take several minutes for all 100 tabs to load. (I used Chrome as my browser.) But when as it gradually loads, it's like taking a first-person journey through someone else's consciousness.' -- source: https://yro.slashdot.org/story/19/06/26/192258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Discovers The Command Line
by Lawrence D'Oliveiro 26 Jun '19

26 Jun '19

A review <https://www.theregister.co.uk/2019/06/25/microsofts_new_terminal_put_throug…> of Microsoft’s revamped Windows Terminal app. Features like session tabs and customizable profiles should be familiar to users of Linux terminal apps. The biggest downside seems to be that this is a UWP app, which means it only works with specific versions of Window 10. Actually, Windows had a sort-of-remotable/virtualizable-command-line support before. The difference is, all the *nix-type systems implement this using “PTY” (“pseudo-terminal”) devices, which one process (like an SSH server or GUI terminal emulator) can open and use to drive other processes on the other side, which act as though they are connecting to a real terminal. All the fancy screen stuff (e.g. direct addressing, coloured text) is done by sending in-band “escape sequences”, which real terminals (which are all museum pieces now) used to respond to, and which the terminal emulators nowadays faithfully mimic. However, Microsoft didn’t like the whole escape-sequence idea; instead, it implemented a whole API it called “ConHost”, where the application had to make special calls to affect the display in special ways. This sounds more advanced than the crude-sounding escape-sequence idea from the 1970s, yet it turns out that the Microsoft approach makes it awkward to implement those same SSH servers and GUI terminal emulators that we take for granted in the Linux world. So now the company is back-pedalling away from that, and towards good old PTYs and escape sequences, in its new “ConPTY” architecture. There is still one issue I don’t think they’ve addressed yet, though <https://forums.theregister.co.uk/forum/all/2019/06/25/microsofts_new_termin…>: ... a working select() would be nice. MS's function cannot wait across a set of fd's of different types (such as a serial port and a network socket). In the end I gave up and used the cygwin platform, which has a working select(), which was enough to do the job of talking to a telehone exchange via RS232 and fielding network requests at the same time. The unix philosophy that at the end of the day, everything is a file, pays huge dividends. Using cygwin also gave me a nice simple tcgetattr()/tcsetattr() which allowed serial port setup in a tiny amount of code, compared to the sheer lovecraftian horror that is the windows API for such things. I still find it remarkable that the Cygwin folks were able to implement a function on top of Windows that Microsoft itself seems unable to figure out.

2 1

Steam and Ubuntu clash over 32-bit libs
by Peter Reutemann 26 Jun '19

26 Jun '19

'It has been a tumultuous week for gaming on Linux. Last Tuesday afternoon, Canonical's Steve Langasek announced that 32-bit libs would be frozen (kept as-is, with no new builds or updates) as of this October's interim 19.10 release, codenamed "Eoan Ermine." Langasek was pretty clear that this did not mean abandoning support for running 32-bit applications, however. "While this means we will not provide 32-bit builds of new upstream versions of libraries, there are a number of ways that 32-bit applications can continue to be made available to users of later Ubuntu releases, as detailed in [4]. We will be working to polish the 32-bit support story over the course of the 19.10 development cycle. To follow the evolution of this support, you can participate in the discourse thread at [5]." Unfortunately, that part of the announcement may not have been entirely clear to all who read it. This group may include Steam lead Pierre-Loup Griffais, who responded by breaking up with Ubuntu in a tweet. "Ubuntu 19.10 and future releases will not be officially supported by Steam or recommended to our users. We will evaluate ways to minimize breakage for existing users, but will also switch our focus to a different distribution, currently TBD." Two days later, Canonical issued another public statement making it very explicit that support for commonly used 32-bit libs would be continued. That statement has been widely reported as an "about-face" from Canonical, but it appears to be more of a clarification of the original statement. The heart of the issue is that 32-bit computing represents an incredibly wide attack surface, with lessening amounts of active maintenance to discover, analyze, and patch flaws and exploits. Canonical, like any company, needs to apply its developer resources intelligently, so it looks for ways to remove unnecessary cruft where possible. The vast majority of 32-bit code is cruft. "We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed... We do think it’s reasonable to expect the community to participate and to find the right balance between enabling the next wave of capabilities and maintaining the long tail," Canonical said in a statement. "Nevertheless, in this case it’s relatively easy for us to change plan and enable natively in Ubuntu 20.04 LTS the applications for which there is a specific need." Canonical also promised it would work with "the WINE, Ubuntu Studio and gaming communities to use container technology to address the ultimate end of life of 32-bit libraries; it should stay possible to run old applications on newer versions of Ubuntu. Snaps and LXD enable us both to have complete 32-bit environments, and bundled libraries, to solve these issues in the long term."' -- source: https://arstechnica.com/gaming/2019/06/steam-and-ubuntu-clash-over-32-bit-l… The article mentions "Solus", which I've only come across once before in 2017. Anybody keen on giving that a swirl at the next meeting? -- project page: https://getsol.us/home/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle Dyn DNS Services Shutting Down in 2020
by Peter Reutemann 25 Jun '19

25 Jun '19

'Oracle has sent the following email to customers of DYN service: Since Oracle acquired Dyn in 2016 (and subsequently acquired Zenedge), the engineering teams have been working diligently to integrate Dyn;s products and network into the Oracle Cloud Infrastructure. With the completion of this upgrade to Oracle Cloud Infrastructure. Oracle is announcing the end-of-life for the free Standard DNS service in favor of the enhanced, paid subscription version on the Oracle Cloud Infrastructure platform. On May 31, 2020, the 'EOL Date', the Standard DNS will be retired and will no longer be available. The following capabilities are not currently supported in Oracle Cloud Infrastructure DNS: Webhop (HTTP redirect), Dynamic DNS, Zone transfer to external nameservers, and DNSSEC. ' -- source: https://developers.slashdot.org/story/19/06/25/1920223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New Silex Malware is Bricking IoT Devices, Has Scary Plans
by Peter Reutemann 25 Jun '19

25 Jun '19

'A new strain of malware is wiping the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017. From a report: Named Silex, this malware began operating earlier today, about three-four hours before this article's publication. The malware had bricked around 350 devices when this reporter began investigating its operations, and the number quickly spiked to 2,000 wiped devices by the time we published, an hour later. Attacks are still ongoing, and according to an interview with the malware's creator, they are about to intensify in the coming days. According to Akamai researcher Larry Cashdollar, who first spotted the malware earlier today, Silex works by trashing an IoT device's storage, dropping firewall rules, removing the network configuration, and then halting the device. It's as destructive as it can get without actually frying the IoT device's circuits. To recover, victims must manually reinstall the device's firmware, a task too complicated for the majority of device owners' -- source: https://tech.slashdot.org/story/19/06/25/2018218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Reverses Decision, Says It Will Continue To Support 32-bit Packages
by Peter Reutemann 25 Jun '19

25 Jun '19

'Canonical has issued a statement on Ubuntu's 32-bit future, saying it will continue to build and maintain a 32-bit archive going forward. >From a report: Of course, there was some negativity surrounding the decision -- as is common with everything in the world today. In particular, developers of WINE were upset, since their Windows compatibility layer depends on 32-bit, apparently. In a statement, Canonical said: "Thanks to the huge amount of feedback this weekend from gamers, Ubuntu Studio, and the WINE community, we will change our plan and build selected 32-bit i386 packages for Ubuntu 19.10 and 20.04 LTS. We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed. Community discussions can sometimes take unexpected turns, and this is one of those. The question of support for 32-bit x86 has been raised and seriously discussed in Ubuntu developer and community forums since 2014. That's how we make decisions."' -- source: https://linux.slashdot.org/story/19/06/24/1826241 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Raspberry Pi 4 Featuring Faster CPU, Up To 4GB of RAM Launched
by Peter Reutemann 25 Jun '19

25 Jun '19

'Raspberry Pi today introduced a new version of its popular line of single-board computer. The Raspberry Pi 4 Model B is the fastest Raspberry Pi ever, with the company promising "desktop performance comparable to entry-level x86 PC systems." The specifications are: A 1.5GHz quad-core 64-bit ARM Cortex-A72 CPU (~3x performance); 1GB, 2GB, or 4GB of LPDDR4 SDRAM; full-throughput Gigabit; Ethernet; dual-band 802.11ac wireless networking; Bluetooth 5.0; two USB 3.0 and two USB 2.0 ports; dual monitor support, at resolutions up to 4K; VideoCore VI graphics, supporting OpenGL ES 3.x; 4Kp60 hardware decode of HEVC video; and complete compatibility with earlier Raspberry Pi products. It starts at $35.' -- source: https://hardware.slashdot.org/story/19/06/24/141229 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 3

Resilient?
by Ian Young 24 Jun '19

24 Jun '19

Alas several attempts to unzip the Resilient desktop file have failed - never got as far as trying to write a USB. Mostly failure was silent - Engampra and File Roller. Ark in KDE did condescend to say 'Failed to write data for entry'. ~ Ian Y

2 1

Potent Firefox 0-day used to install undetected backdoors on Macs
by Peter Reutemann 23 Jun '19

23 Jun '19

'Hackers exploited a pair of potent zero-day vulnerabilities in Firefox to infect Mac users with a largely undetected backdoor, according to accounts pieced together from multiple people. Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system. Interestingly, a researcher at Google's Project Zero had privately reported the code-execution flaw to Mozilla in mid April. On Monday, as Mozilla was readying a fix for the array.pop flaw, unknown hackers deployed an attack that combined working exploits for both vulnerabilities. The hackers then used the attack against employees of Coinbase, according to Philip Martin, chief information security officer for the digital currency exchange.' -- source: https://arstechnica.com/information-technology/2019/06/potent-firefox-0day-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Re: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch'
by mailinglist 23 Jun '19

23 Jun '19

I thought Chrome being an extension of Google was fairly obvious.The thing I don't understand is why duck duck go and Firefox are free.Sent from my Samsung Galaxy smartphone.-------- Original message --------From: Peter Reutemann <fracpete(a)waikato.ac.nz> Date: 23/06/2019 10:49 (GMT+12:00) To: wlug List <wlug(a)list.waikato.ac.nz> Subject: [wlug] Chrome 'Has Become Surveillance Software. It's Time to Switch' '"You open your browser to look at the Web. Do you know who is lookingback at you?" warns Washington Post technology columnist Geoffrey A.Fowler:Over a recent week of Web surfing, I peered under the hood of GoogleChrome and found it brought along a few thousand friends. Shopping,news and even government sites quietly tagged my browser to let ad anddata companies ride shotgun while I clicked around the Web. This wasmade possible by the Web's biggest snoop of all: Google. Seen from theinside, its Chrome browser looks a lot like surveillance software...My tests of Chrome vs. Firefox unearthed a personal data caper ofabsurd proportions. In a week of Web surfing on my desktop, Idiscovered 11,189 requests for tracker "cookies" that Chrome wouldhave ushered right onto my computer but were automatically blocked byFirefox. These little files are the hooks that data firms, includingGoogle itself, use to follow what websites you visit so they can buildprofiles of your interests, income and personality... And that's notthe half of it. Look in the upper right corner of your Chrome browser.See a picture or a name in the circle? If so, you're logged in to thebrowser, and Google might be tapping into your Web activity to targetads. Don't recall signing in? I didn't, either. Chrome recentlystarted doing that automatically when you use Gmail.Chrome is even sneakier on your phone. If you use Android, Chromesends Google your location every time you conduct a search. (If youturn off location sharing it still sends your coordinates out, justwith less accuracy.)The columnist concludes that "having the world's biggest advertisingcompany make the most popular Web browser was about as smart asletting kids run a candy shop," and argues that through itsDoubleclick and other ad businesses, Google "is the No. 1 cookie maker-- the Mrs. Fields of the web."He also reports that Firefox is now working on ways to block browser"fingerprintin'-- source: https://news.slashdot.org/story/19/06/21/1922233Cheers, Peter-- Peter ReutemannDept. of Computer ScienceUniversity of Waikato, NZ+64 (7) 858-5174http://www.cms.waikato.ac.nz/~fracpete/http://www.data-mining.co.nz/_______________________________________________wlug mailing list | wlug(a)list.waikato.ac.nzUnsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug

1 0