- wlug - University of Waikato Mail Lists

Likely NSA Data-Collection Facilities
by Lawrence D'Oliveiro 25 Jun '18

25 Jun '18

Further to the mention last night of secret facilities operated by AT&T in the US where the NSA has access, this article <https://arstechnica.com/tech-policy/2018/06/meet-the-8-spooky-att-buildings…> reports on a list of eight likely places as detailed by The Intercept <https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/>. While the NSA is not technically allowed to spy on wholly “domestic” communications, there seem to be no limits on any “incidental collection” as a result of targetting some foreign communication. That means they can grab the contents of entire mailboxes just for the sake of one message. Then keep the lot for whatever use they like.

1 0

How Should Open Source Development Be Subsidized?
by Peter Reutemann 24 Jun '18

24 Jun '18

'"Open source maintainers are exhausted and rarely paid," writes TechCrunch's editorial manager. "A new generation wants to change the economics." An anonymous reader quotes their report: [Patreon] is increasingly being used by notable open source contributors as a way to connect with fans and sustain their work... For those who hit it big, the revenues can be outsized. Evan You, who created the popular JavaScript frontend library Vue.js, has reached $15,206 in monthly earnings ($182,472 a year) from 231 patrons... While Patreon is one direct approach for generating revenues from users, another one is to offer dual licenses, one free and one commercial... Companies care about proper licensing, and that becomes the leverage to gain revenue while still maintaining the openness and spirit of open source software... Tidelift is designed to offer assurances "around areas like security, licensing, and maintenance of software," CEO Donald Fischer explained... In addition, Tidelift handles the mundane tasks of setting up open source for commercialization such as handling licensing issues... Open Collective wants to open source the monetization of open source itself. Open Collective is a non-profit platform that provides tools to "collectives" to receive money while also offering mechanisms to allow the members of those collectives to spend their money in a democratic and transparent way. TechCrunch warns that "It's not just that people are free riding, it's often that they don't even realize it. Software engineers can easily forget just how much craftsmanship has gone into the open source code that powers the most basic of applications... "If you work at a for-profit company, take the lead in finding a way to support the code that allows you to do your job so efficiently. The decentralization and volunteer spirit of the open source community needs exactly the same kind of decentralized spirit in every financial contributor. Sustainability is each of our jobs, every day."' -- source: https://news.slashdot.org/story/18/06/23/2113222 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Birth Of PDF
by Lawrence D'Oliveiro 20 Jun '18

20 Jun '18

<http://www.theregister.co.uk/2018/06/21/how_a_tax_form_kludge_gave_us_25_ye…>: [In 1985] ... both Apple and Adobe wanted to show off the LaserWriter's abilities with some sample files. Warnock thought it would be great to have the printer producing something complex but familiar so he personally hand-programmed an IRS tax form in PostScript. ... all those boxes and form fields required Warnock to code in lots of subroutines and utilities. The page took 2 minutes 45 seconds to print. Jobs was horrified at how slow that was. ... His new version of the IRS tax form printed on the LaserWriter in 22 seconds. In other words, by abandoning all the programming-language constructs (subroutines, conditionals, looping etc) in PostScript and just writing out a straight sequence of imaging commands, the code ran a lot faster, even if it was bigger. The article mentions the release of PDF 2.0, which is now being managed by ISO. Unfortunately, unlike Adobe, ISO do not make their specs available for free.

1 0

OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns
by Peter Reutemann 20 Jun '18

20 Jun '18

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Peter Reutemann 20 Jun '18

20 Jun '18

'Malicious hackers are mass exploiting a critical vulnerability in D-Link DSL routers in an attempt to make them part of Satori, the potent Internet-of-things botnet that is used to take down websites and mine digital coins, researchers said. Since making its debut late last year, Satori has proven to be a particularly versatile and sophisticated botnet. It made a name for itself in December when it infected more than 100,000 Internet-connected devices in just 12 hours by exploiting remote code-execution vulnerabilities in Huawei and RealTek routers. A month later, Satori operators released a new version that infected devices used to mine digital coins, proving that the IoT botnet could also take control of more traditional computing devices. In February, Satori resurfaced when it infected tens of thousands of routers manufactured by Dasan Networks.' -- source: https://arstechnica.com/information-technology/2018/06/widely-used-d-link-m… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TPP Versus Free-Software Licensing
by Lawrence D'Oliveiro 19 Jun '18

19 Jun '18

Seems like the “CPTPP” aka “TPP-11” (TPP minus the USA) may not be entirely free of objectionable provisions. A submission to the Australian ratification process <https://www.techdirt.com/articles/20180615/09090440050/open-source-industry…> has pointed out the following problematic clause: No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory. As you may know, such an access requirement is an integral part of copyleft licences like the GPL. What this clause seems to be saying is that such a requirement is unenforceable under the TPP.

2 4

meeting next Monday?
by Peter Reutemann 19 Jun '18

19 Jun '18

Hi everyone Any suggestions for next week's meeting? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
by Peter Reutemann 18 Jun '18

18 Jun '18

'Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.' -- source: https://apple.slashdot.org/story/18/06/18/1336248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.18 Preparing Many New Features While Dropping 100k+ Lines of Code
by Peter Reutemann 18 Jun '18

18 Jun '18

'Linux 4.18 development is going strong with recent 4.18-rc1 release. This kernel cycle has dropped 107,210 lines of code so far but Linux 4.18 is adding many new features. The kernel is coming in lighter as a result of the LustreFS code being removed and other code cleanups. On the feature front, Phoronix reports, "ew AMDGPU support improvements, mainlining of the V3D DRM driver, initial open-source work on NVIDIA Volta GV100 hardware, merging of the Valve Steam Controller kernel driver, merging of the BPFILTER framework, ARM Spectre mitigation work, Speck file-system encryption support, removal of the Lustre file-system, the exciting restartable sequences system call was merged, the new DM writecache target, and much more."' -- source: https://linux.slashdot.org/story/18/06/18/1334205 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Another Reason To Move To GPLv3?
by Lawrence D'Oliveiro 18 Jun '18

18 Jun '18

Red Hat has decided <http://www.theregister.co.uk/2018/06/18/red_hat_gpl_violation/> that it prefers the more lenient remediation provisions in GPLv3 for licence violators. So as a matter of policy, it is going to adhere to them even for products it has licensed GPL/LGPLv2.x. [Licensing export Paul] Berg said the GPL and LGPL version 3 have more lenient termination clauses for good reason: Most people have no idea they've violated the terms and would comply if made aware of the problem. The article mentions the case of a Linux kernel developer who has been exploiting--some say abusing--his contributions to extract money from various firms. This has been a great annoyance to the kernel community--the same community that made it clear some years ago that they were against moving to GPLv3.

1 0