- wlug - University of Waikato Mail Lists

Red Hat Acquires Data-Cleaning Company Permabit
by Peter Reutemann 06 Aug '17

06 Aug '17

'Business software company Red Hat said on Monday that it is acquiring the technology assets of Permabit, a small company that specializes in cleaning up corporate data to make storage more efficient and data access faster. Terms of the deal were not disclosed but a Red Hat spokesman said 16 people from Permabit will be joining that company... While the conventional wisdom is that data storage is cheap, it is not free. And with companies turning to more expensive flash storage, it saves money to remove redundant data, said Richard Fichera, vice president and principal analyst at Forrester Research... Red Hat, which sells a version of the Linux operating system used by many Fortune 500 companies, also offers its own storage software. And, it wants to become a more formidable challenger in data storage, a goal that can be furthered by buying Permabit's technology, Fichera said. Slashdot reader See Attached points out that this week Red Hat also released RHEL 7.4, which introduces support for Network Bound Disk Encryption (NBDE) and system protection against intrusive USB devices.' -- source: https://linux.slashdot.org/story/17/08/05/0453223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linux Kernel Hardeners Grsecurity Sue Open Source's Bruce Perens
by Peter Reutemann 06 Aug '17

06 Aug '17

'In late June, noted open-source programmer Bruce Perens [a longtime Slashdot reader] warned that using Grsecurity's Linux kernel security could invite legal trouble. "As a customer, it's my opinion that you would be subject to both contributory infringement and breach of contract by employing this product in conjunction with the Linux kernel under the no-redistribution policy currently employed by Grsecurity," Perens wrote on his blog. The following month, Perens was invited to court. Grsecurity sued the open-source doyen, his web host, and as-yet-unidentified defendants who may have helped him draft that post, for defamation and business interference. Grsecurity offers Linux kernel security patches on a paid-for subscription basis. The software hardens kernel defenses through checks for common errors like memory overflows. Perens, meanwhile, is known for using the Debian Free Software Guidelines to draft the Open Source Definition, with the help of others. Grsecurity used to allow others to redistribute its patches, but the biz ended that practice for stable releases two years ago and for test patches in April this year. It offers its GPLv2 licensed software through a subscription agreement. The agreement says that customers who redistribute the code -- a right under the GPLv2 license -- will no longer be customers and will lose the right to distribute subsequent versions of the software. According to Perens, "GPL version 2 section 6 explicitly prohibits the addition of terms such as this redistribution prohibition." A legal complaint (PDF) filed on behalf of Grsecurity in San Francisco, California, insists the company's software complies with the GPLv2. Grsecurity's agreement, the lawsuit states, only applies to future patches, which have yet to be developed. Perens isn't arguing that the GPLv2 applies to unreleased software. Rather, he asserts the GPLv2, under section 6, specifically forbids the addition of contractual terms.' -- source: https://yro.slashdot.org/story/17/08/04/2233239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Browser Extensions Are Undermining Privacy
by Peter Reutemann 06 Aug '17

06 Aug '17

'pizzutz writes: Chrome's popular Web Developer plugin was briefly hijacked on Wednesday when an attacker gained control of the author's Google account and released a new version (0.49) which injected ads into web pages of more than a million users who downloaded the update. The version was quickly replaced with an uncompromised version (0.5) and all users are urged to update immediately. Lauren Weinstein has a broader warning: While the browser firms work extensively to build top-notch security and privacy controls into the browsers themselves, the unfortunate fact is that these can be undermined by add-ons, some of which are downright crooked, many more of which are sloppily written and poorly maintained. Ironically, some of these add-on extensions and apps claim to be providing more security, while actually undermining the intrinsic security of the browsers themselves. Others (and this is an extremely common scenario) claim to be providing additional search or shopping functionalities, while actually only existing to silently collect and sell user browsing activity data of all sorts. Lauren also warns about sites that "push users very hard to install these privacy-invasive, data sucking extensions" -- and believes requests for permissions aren't a sufficient safeguard for most users. "Expecting them to really understand what these permissions mean is ludicrous. We're the software engineers and computer scientists -- most users aren't either of these. They have busy lives -- they expect our stuff to just work, and not to screw them over."' -- source: https://yro.slashdot.org/story/17/08/05/2122210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Windows console is getting a new, easier to read color scheme
by Lawrence D'Oliveiro 03 Aug '17

03 Aug '17

“Even with this work, the Windows console is still weak compared to its counterparts in macOS and Linux. In Windows, the operating systems-supplied console windows are closely tied to the command-line applications that use them; it's impossible to create a command-line application that isn't attached to a Windows console window. Linux and macOS offer a separation between the software that's displaying the console apps and the console apps themselves. Those operating systems have a built-in default console, but unlike Windows, they don't have to use it; third-party software can fill the same role. “Attractive, modern terminal applications like iTerm on macOS and Unix stalwarts such as screen (which enables multiple command-line shells to share a single console window) take advantage of this extensibility. Neither kind of application can be readily developed for command-line apps on Windows, and while people have tried to work around Windows' limitations (for example, by hiding the Windows built-in console windows off-screen somewhere), the results are imperfect. We're told that there are plans in store to finally address this weakness of Windows, though what the solution will be is at present unknown.” <https://arstechnica.com/gadgets/2017/08/the-windows-console-is-getting-a-ne…>

1 0

Systemd wins top gong for 'lamest vendor' in Pwnie security awards
by Bryan Baldwin 30 Jul '17

30 Jul '17

The lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement. Nomination Submission: Awarded to the vendor who mis-handled a security vulnerability most spectacularly. SystemD bugs 5998, 6225, 6214, 5144, 6237 Credit: Lennart Poettering Where you are dereferencing null pointers, or writing out of bounds, or not supporting fully qualified domain names, or giving root privileges to any user whose name begins with a number, there's no chance that the CVE number will referenced in either the change log or the commit message. But CVEs aren't really our currency any more, and only the lamest of vendors gets a Pwnie! https://pwnies.com/nominations/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/

3 2

Trust Me, I’m A Random-Number Generator
by Lawrence D'Oliveiro 30 Jul '17

30 Jul '17

SK Telecom has created a “quantum random number generator” chip <https://www.theregister.co.uk/2017/07/26/sk_telecom_makes_light_of_random_n…>. Seems like slapping the label “quantum” on anything is enough to make people believe you know what you are talking about. Random-number generators are notorious for being easily subverted. And hearing things like “SK Telecom hasn't specified what kind [of quantum noise source they are using]” is not exactly reassuring. You can never be sure your random numbers are truly random. But you try to stack the deck as much in your favour as you can. The Linux kernel mixes in several sources of entropy to feed /dev/random (and from there, /dev/urandom), in the hope that, as long as one of them remains unsubverted (intentionally or otherwise), the output can be trusted. This is also the principle behind the Fortuna PRNG <https://en.wikipedia.org/wiki/Fortuna_(PRNG)>, which well-known computer security guru Bruce Schneier had a hand in.

2 3

Anti-systemd Trolls
by Lawrence D'Oliveiro 27 Jul '17

27 Jul '17

I keep wondering about these random names who pop up with all the badmouthing every time somebody mentions something about systemd. I don’t recall any faces at WLUG meetings that go with them. Who are you and where do you come from? Do you people have any interest in the Waikato Linux User Group at all, or are you just here to shoot your mouths off?

4 9

Some Low-Cost Android Phones Come at a Price -- Your Privacy
by Peter Reutemann 27 Jul '17

27 Jul '17

'At $60, the BLU R1 HD is the top-selling phone on Amazon. Last November, researchers caught it secretly sending private data to China. Shanghai Adups Technology, the group behind the spying software on the BLU R1 HD, called it a mistake. But analysts at Kryptowire found the software provider is still making the same "mistake" on other phones. At the Black Hat security conference in Las Vegas on Wednesday, researchers from Kryptowire, a security firm, revealed that Adups' software is still sending a device's data to the company's server in Shanghai without alerting people. But now, it's being more secretive about it. "They replaced them with nicer versions," Ryan Johnson, a research engineer and co-founder at Kryptowire, said. "I have captured the network traffic of them using the Command and Control channel when they did it." An Adups spokeswoman said that it had resolved the issues in 2016 and that the issues "are not existing anymore." Kryptowire said it has observed the company sending data without telling users on at least three different phones.' -- source: https://it.slashdot.org/story/17/07/26/187258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Wellcome Trust Wants To Share
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

You’ve probably heard of the Wellcome Trust: they’re a UK-based nonprofit that funds scientific research, primarily into health. They’ve long had an open-access policy, meaning that “all original research articles and scholarly monographs resulting from our funding are made freely available”. Contrast this with what more commonly happens with scientific research, where the journal publishers get exclusive copyright over the papers, and charge an arm and a leg to everyone wanting a copy. Now the Wellcome Trust is going even further, and requiring open access in a timely manner to the raw research data (within reasonable limits, such as privacy concerns etc), material such as cell lines, antibodies and reagents, and also any software developed. No actual mention of “open source” or “Free software” licences as such, though; the news article only uses the word “freeware”, which I’m not sure is the word they should be using. <https://www.theregister.co.uk/2017/07/25/wellcome_trust_extends_research_da…> <https://wellcome.ac.uk/news/our-new-policy-sharing-research-data-what-it-me…>

1 0

Intel Abandons Consumer/Hobbyist IoT
by Lawrence D'Oliveiro 26 Jul '17

26 Jul '17

Intel is giving up on its consumer/hobbyist-oriented Internet of Things products <https://www.theregister.co.uk/2017/07/25/intel_arduino_board_curie_canceled/>. However, the “enterprise”-oriented efforts remain for now. Not sure what “enterprise” means in this space: are there companies building IoT-type devices for their own internal use? Or is this referring to companies selling readymade IoT products? In any case, I suspect this is the one area left where “Windows 10 IoT Edition” can be mentioned without raising hails of derisive laughter...

1 0