- wlug - University of Waikato Mail Lists

World’s Top Three Most Powerful Supercomputers Are Non-Intel
by Lawrence D'Oliveiro 13 Nov '18

13 Nov '18

Machines based on IBM’s Power9 architecture have taken the top two spots in the list of the world’s most powerful (publicly-known) supercomputers <https://www.theregister.co.uk/2018/11/13/500_supercomputers_list/>. China’s Sunway TaihuLight machine, which is based on some derivative of MIPS, is in third place, with another Chinese machine, the highest-ranking Intel-based one, coming next. There is also the first ARM-based beastie, built by HP Enterprises, appearing on the list, at number 203.

1 0

Windows 10 Spontaneous Downgrade
by Lawrence D'Oliveiro 08 Nov '18

08 Nov '18

Some users of Windows 10 Pro are discovering that their machines are suddenly claiming to only have a Windows 10 Home licence <https://www.theregister.co.uk/2018/11/08/windows_10_activation/>. This isn’t confined to the “Insider” prereleases, but production releases as well (both upgrades and fresh installs). Seems some Microsoft support staff have confirmed that there is a “temporary issue” with the licence servers, which may take 1-2 days to fix.

2 1

WLinux, the First Paid-for Linux Distro for Windows 10, Goes On Sale on Microsoft Store
by Peter Reutemann 07 Nov '18

07 Nov '18

'WLinux is a $20 open-source, Debian-based distribution, designed to run on Windows 10's Windows Subsystem for Linux (WSL). The WSL allows Windows 10 to run various GNU/Linux distros inside Windows as Microsoft Store apps, providing access to Ubuntu, openSUSE, Debian, Fedora, Kali Linux, and others. The WSL has disadvantages over a running a dedicated GNU/Linux system. For example, there's no official support for desktop environments or graphical applications, and I/O performance bottlenecks, but it is being improved over time. The developers of WLinux describe it as a "fast Linux terminal environment for developers", saying it is the first distribution to be "pre-configured and optimized to run specifically on Windows Subsystem for Linux". Announcing WLinux's availability, Microsoft program manager Tara Raj, called out the wlinux-setup tool, "which allows users to easily set up common developer toolchains, and removes unsupported features like systemd."' -- source: https://linux.slashdot.org/story/18/11/07/1510223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

How New, Polite Linus Torvalds Points Out Bad Kernel Code
by Peter Reutemann 06 Nov '18

06 Nov '18

'Linus Torvalds "has shown already for the new Linux 4.20~5.0 cycle he isn't relaxing his standards but is communicating better when it comes to bringing up coding," reports Phoronix, adding "So far it looks like Linus' brief retreat is paying off with still addressing code quality issues -- and not blatantly accepting new code into the kernel as some feared -- but in doing so in a professional manner compared to his past manner of exclaiming himself over capitalized sentences and profanity that at time put him at odds with some in the Linux kernel community." AmiMoJo quotes their report: Last Saturday he took issue with the HID pull request and its introduction of the BigBen game controller driver that was introduced: the developer enabled this new driver by default. Linus Torvalds has always frowned upon random new drivers being enabled by default in the kernel configuration driver. [H]e still voiced his opinion over this driver's default "Y" build configuration, but did so in a more professional manner than he has done in the past: We do *not* enable new random drivers by default. And we most *definitely* don't do it when they are odd-ball ones that most people have never heard of. Yet the new "BigBen Interactive" driver that was added this merge window did exactly that. Just don't do it. Yes, yes, every developer always thinks that _their_ driver is so special and so magically important that it should be enabled by default. But no. When we have thousands of drivers, we don't randomly pick one new driver to be enabled by default just because some developer thinks it is special. It's not.... Please don't do things like this. Phoronix also describes another "kernel oops" testing Torvalds' patience, in which Linus responded tactfully that "What makes me *very* unhappy about this is that if I'm right, I think it means that code was literally not tested at all by anybody who didn't have one of the entries in that list."' -- source: https://linux.slashdot.org/story/18/11/03/1833213 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Explicating Neural Networks
by Lawrence D'Oliveiro 06 Nov '18

06 Nov '18

The usual problem with neural nets is, once you have trained them, you have no actual idea why they come to the decisions that they do. One classic example was a net that was being trained to distinguish between pictures of huskies and wolves, where it turned out it was actually assigning the highest weight to the area of snow in the background of the pictures. Enter LIME, which is a Python-based toolkit that tries to analyze the trained net to show you how each part of the dataset is being interpreted <https://www.theregister.co.uk/2018/11/05/hands_on_with_lime/>. The article shows example pictures where areas are colour-coded green or red to indicate whether they make a positive or negative contribution to a particular classification decision. This way, you can spot if any parts that should be ignored are being given an anomalously high weight. Or vice versa.

1 0

Microsoft Microsoft Working on Porting Sysinternals To Linux
by Peter Reutemann 05 Nov '18

05 Nov '18

'A Microsoft exec has confirmed yesterday that the company's engineers are working on porting the highly popular Sysinternals software package to Linux. Microsoft engineers have already ported the ProcDump utility and are currently working on porting ProcMon as well. More tools to follow. Microsoft's decision to port this highly popular debugging utility to Linux comes after two months ago, in September, Scott Guthrie, Microsoft's executive vice president of the cloud and enterprise group, revealed that "sometimes slightly over half of Azure VMs are Linux." With Linux's growing adoption as the preferred OS for running Azure VMs, it's only natural that Azure engineers are now looking into porting their favorite debugging utilities to Linux, for both themselves but also for the company's customers.' -- source: https://linux.slashdot.org/story/18/11/05/157226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Flaws in Self-Encrypting SSDs Let Attackers Bypass Disk Encryption
by Peter Reutemann 05 Nov '18

05 Nov '18

'Researchers have found flaws that can be exploited to bypass hardware encryption in well known and popular SSD drives. Master passwords and faulty standards implementations allow attackers access to encrypted data without needing to know the user-chosen password. SSDs from Micron (Crucial) and Samsung are affected. These are SSDs that support hardware-level encryption via a local built-in chip, separate from the main CPU. Some of these devices have a factory-set master password that bypasses the user-set password, while other SSDs store the encryption key on the hard drive, from where it can be retrieved. The issue is worse on Windows, where BitLocker defers software-level encryption to hardware encryption-capable SSDs, meaning user data is vulnerable to attacks without the user's knowledge. More in the research paper.' -- source: https://it.slashdot.org/story/18/11/05/213255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Slashdot poll: What do you make of programming languages and open source organizations adopting a code of conduct?
by Peter Reutemann 05 Nov '18

05 Nov '18

See this link for poll: https://slashdot.org/poll/3103 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Old School 'Sniffing' Attacks Can Still Reveal Your Browsing History
by Peter Reutemann 04 Nov '18

04 Nov '18

'Most modern browsers -- such as Chrome, Firefox, and Edge, and even browsers such as FuzzyFox and DeterFox (different, security-focused versions of Firefox) -- have vulnerabilities that allow hosts of malicious websites to extract hundreds to thousands of URLs in a user's web history, per new research from the University of California San Diego. What's worse, the vulnerabilities are built into the way they structure links, meaning that major structural changes will have to take place in these browsers in order to protect user privacy. The only browser that was immune to the attacks was Tor Browser, as the browser does not keep track of a user's internet history. The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."' -- source: https://it.slashdot.org/story/18/11/04/0426252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel CPUs fall to new hyperthreading exploit that pilfers crypto keys
by Peter Reutemann 04 Nov '18

04 Nov '18

'Over the past 11 months, the processors running our computers, and in some cases phones, have succumbed to a host of attacks. Bearing names such as Meltdown and Spectre, BranchScope, TLBleed, and Foreshadow, the exploits threaten to siphon some of our most sensitive secrets—say passwords or cryptographic keys—out of the silicon microarchitecture in ways that can’t be detected or stopped by traditional security defenses. On Friday, researchers disclosed yet another leak that has already been shown to exist on a wide range of Intel chips and may also affect other makers, too. PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. A proprietary implementation of simultaneous multithreading, hyperthreading reduces the amount of time needed to carry out parallel computing tasks, in which large numbers of calculations or executions are carried out simultaneously. The performance boost is the result of two logical processor cores sharing the hardware of a single physical processor. The added logical cores make it easier to divide large tasks into smaller ones that can be completed more quickly.' -- source: https://arstechnica.com/information-technology/2018/11/intel-cpus-fall-to-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0