- wlug - University of Waikato Mail Lists

Why Computing Devices Slow Down Over Time
by Lawrence D'Oliveiro 23 Oct '17

23 Oct '17

Entertaining opinion piece <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11935838>: To make their apps run faster, some designers make them store copies of things in RAM ... Known as cacheing, this makes things work much faster - until your system starts to run out of memory. For cacheing to be effective, the amount of space devoted to it must be carefully managed by the application and the device's operating system. Some app developers don't put the effort that they should into doing this well, and their applications not only slow down over time, but can drag the rest of the system down with them too. So trying to speed things up can make things slower??

1 0

Android getting “DNS over TLS” support to stop ISPs from knowing what websites you visit
by Peter Reutemann 23 Oct '17

23 Oct '17

'DNS (Domain Name Server) is what translates a website address from a URL that you enter to an IP address which your computer actually connects to. For example, when you type “www.xda-developers.com” into your browser, your computer queries a DNS which looks up and returns the IP address “209.58.128.90” to the client. This process is hidden from the user, but every website you visit (so long as it has a human-readable URL) will go through this same process. The problem for those security conscious out there is that these requests are done in plain text through UDP or TCP protocols which are readable by anyone that can see your connection, including your ISP. This is where DNS over TLS comes in.' -- source: https://www.xda-developers.com/android-dns-over-tls-website-privacy/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

Microsoft Chastises Google Over Chrome Security
by Peter Reutemann 22 Oct '17

22 Oct '17

'In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser. The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it." In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.' -- source: https://it.slashdot.org/story/17/10/22/010235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Security Upgraded For NetBSD-amd64 with Kernel ASLR Support
by Peter Reutemann 22 Oct '17

22 Oct '17

'24 years after its release, NetBSD is getting a security upgrade -- specifically, Address Space Layout Randomization (ASLR). An anonymous reader writes: Support for Kernel ASLR was added on NetBSD-amd64 a few weeks ago. KASLR basically randomizes the address of the kernel, and makes it harder to exploit several classes of vulnerabilities [including privilege escalations and remote code execution]. It is still a work-in-progress, but it's already fully functional, and can be used following the instructions on this post from the NetBSD blog. It will be available starting from NetBSD 9, but may be backported to NetBSD 8 once it is stabilized. NetBSD says they're the first BSD system to support ASLR.' -- source: https://bsd.slashdot.org/story/17/10/21/0118226 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bloody Stupid Linux
by Lawrence D'Oliveiro 21 Oct '17

21 Oct '17

That’s the name of the distro <http://bloodystupid.clockwatching.org/>: Why go to all this trouble? The BSL kernel is basically a life support system for ram and network cards, since it wget's support for everything else on the machine the kernel is very small. The initial aim was to fit it on a single floppy, then PXE booting became attractive, and really, since the kernel doesn't need to support whatever it just booted from in order to have its root filesystem, its very flexible. Yeah, I know an initrd can do the same thing, but its more fun this way. As it stands, BSL makes for an excellent repair system, the framework for a bulk installer, a neat toy, and an alright thin client ( as long as you've got a gob of RAM handy.) OK, so it hasn’t been updated in over a decade. But the mascot image is cute. ;)

1 0

The Ultimate In Terminal Emulators?
by Lawrence D'Oliveiro 20 Oct '17

20 Oct '17

Brian Lunduke continues his Command-Line Week with a look at a couple of quite amazing terminal emulators: <https://www.youtube.com/watch?v=-vm7B6bLbLg>. So you think “command line” and “eye candy” can’t go together?

1 0

Yet another distro - Q4OS - meeting topic
by Ian Young 20 Oct '17

20 Oct '17

Some may be surprised to learn that a few diehards are still running a fork of KDE 3.5 on a Debian Base. The Trinity desktop. Could give it a quick run through on Monday night if there is time. May be of interest to those who wonder sometimes why KDE 3 was dropped once it actually became usable.

3 2

Meet CudaText: A Cross-Platform Open Source Code Editor
by Peter Reutemann 20 Oct '17

20 Oct '17

'CudaText is a cross-platform open source code editor based on Lazarus. It has extensive support for most of the popular programming languages. I cannot call it one of the best open source code editors because it is too early for that. I cannot even call it Notepad++ alternative for Linux because it’s more like a lightweight IDE like Geany. Though the default interface reminds me of Eclipse IDE.' -- source: https://itsfoss.com/cudatext-code-editor/ Great to see that Object Pascal is still thriving, though I haven't programmed in Pascal for years. Lazarus is an IDE for Object Pascal, a free alternative to (originally Borland's) Delphi. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Desktop Recorder App Green Recorder 3.0 Released
by Peter Reutemann 19 Oct '17

19 Oct '17

'Green Recorder is a simple desktop recorder for Linux distributions. You can use it to record audio and video on almost every Linux interface. Released under GPL 3, it now also supports Wayland. Green Recorder 3.0 supports avi, mkv, mp4 nut and gif. Wayland’s GNOME session supports only WebM. The user can choose the audio input source from a list as well as can set default values from the preference window.' -- source: https://itsfoss.com/green-recorder-3/ Just tried it and it works! Previously, I had used recordMyDesktop (GTK UI), which only supported Ogg Video. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canada's 'Super Secret Spy Agency' Is Releasing a Malware-Fighting Tool To the Public
by Peter Reutemann 19 Oct '17

19 Oct '17

'Canada's electronic spy agency says it is taking the "unprecedented step" of releasing one of its own cyber defence tools to the public, in a bid to help companies and organizations better defend their computers and networks against malicious threats. The Communications Security Establishment (CSE) rarely goes into detail about its activities -- both offensive and defensive -- and much of what is known about the agency's activities have come from leaked documents obtained by U.S. National Security Agency whistleblower Edward Snowden and published in recent years. But as of late, CSE has acknowledged it needs to do a better job of explaining to Canadians exactly what it does. Today, it is pulling back the curtain on an open-source malware analysis tool called Assemblyline that CSE says is used to protect the Canadian government's sprawling infrastructure each day. "It's a tool that helps our analysts know what to look at, because it's overwhelming for the number of people we have to be able to protect things," Scott Jones, who heads the agency's IT security efforts, said in an interview with CBC News. On the one hand, open sourcing Assemblyline's code is a savvy act of public relations, and Jones readily admits the agency is trying to shed its "super secret spy agency" reputation in the interest of greater transparency.' -- source: https://news.slashdot.org/story/17/10/19/1837236 Let's see, whether anybody finds bits in the code that report home to the agency... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1