- wlug - University of Waikato Mail Lists

TLS Proxies: Insecure By Design
by Lawrence D'Oliveiro 06 May '16

06 May '16

A “TLS Proxy” short-circuits the security of TLS/SSL connections so it can do deep-packet inspection on encrypted connections. This kind of thing always seemed dodgy. And now it turns out that is so for good reason: these devices are full of holes <http://www.theregister.co.uk/2016/05/05/tls_proxies_are_insecure/>. The paper mentioned there concentrated on consumer/retail devices. But it’s unlikely ones designed for business/enterprise use are going to fare any better...

1 0

Unity 8 And Snaps Are Conquering The Ubuntu Desktop After Ubuntu 16.10
by Peter Reutemann 05 May '16

05 May '16

"Today is the last day of the Ubuntu Online Summit 2016, and the Ubuntu developers discussed the future of the Ubuntu Desktop for Ubuntu 16.10 (Yakkety Yak) and beyond. It looks like Snaps (Snappy) and Unity 8 with Mir are slowly conquering the Ubuntu Desktop, at least according to Canonical's Will Cooke, Ubuntu Desktop Manager. Work has already begun on pushing these new and modern technologies to the Ubuntu Desktop, as Ubuntu 16.04 LTS has just received support for installing Snaps from the Ubuntu Snappy Store. Canonical's Will Cooke has mentioned the fact that the Unity 7 desktop enters its twilight years, which means that it gets fewer features and it's being reduced to only critical and OEM work. This is because Unity 8 desktop is getting all the attention now, and it will become the default desktop session somewhere after Ubuntu 16.10 (Yakkety Yak)." -- source: https://news.slashdot.org/story/16/05/05/2038256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft unveils new effort to make its documentation great again ... or does it?
by Lawrence D'Oliveiro 05 May '16

05 May '16

<http://arstechnica.com/information-technology/2016/05/microsoft-unveils-new…>: Some teams within Microsoft, such as those developing ASP.NET and .NET Core, had already open sourced their documentation. On the new site, all documentation will be handled similarly. Every article will have an "edit" button enabling changes and fixes to be proposed. These changes will be handled as pull requests on GitHub, with the documentation itself using the popular Markdown markup language. Just one problem: while Microsoft itself uses the term “open sourced” <https://docs.microsoft.com/teamblog/introducing-docs-microsoft-com/>: All documentation on docs.microsoft.com is open sourced and designed to allow community contributions. Nowhere does it actually spell out what the copyright licence is. Clicking on the “Terms of Use” link takes you here <https://www.microsoft.com/en-us/legal/intellectualproperty/copyright/defaul…>, where it says Personal and Non-Commercial Use Limitation Unless otherwise specified, the Services are for your personal and non-commercial use. You may not modify, copy, distribute, transmit, display, perform, reproduce, publish, license, create derivative works from, transfer, or sell any information, software, products or services obtained from the Services.

1 0

Proprietary Software Riddled With Old Open-Source Vulnerabilities
by Lawrence D'Oliveiro 04 May '16

04 May '16

No big news, really: closed-source software, even if it is built on open-source components, will inevitably accumulate long-standing bugs that never get fixed. And sometimes the bugs have security implications. This report from Black Duck uses the term “commercial” software, but it’s quite clear they mean “proprietary” software, i.e. closed-source <http://www.theregister.co.uk/2016/05/04/commercial_software_chokkas_with_an…>. The telling phrase in the report is “visibility into the components that are included in their code base is required”. How would you *not* have such visibility, if the source of your product is open? A lot of companies may hate copyleft licences, but at least they force a level of transparency that makes this kind of thing much harder to cover up.

1 0

Hard Drive Warranties Are Now Specifying Data-Write Limits?
by Lawrence D'Oliveiro 04 May '16

04 May '16

It used to be that warranties for hard drives were for some specified number of years, it didn’t matter how much load they were under (compare SSDs). But it seems that is now changing, as capacities are pushed to the point where ever more creative strategies are needed to get the devices to work at all <http://www.theregister.co.uk/2016/05/03/when_did_hard_drives_get_workload_r…>.

3 2

The Tao Of Programming
by Lawrence D'Oliveiro 04 May '16

04 May '16

<http://www.mit.edu/~xela/tao.html>: 4.3 The Master was explaining the nature of Tao to one of his novices. "The Tao is embodied in all software -- regardless of how insignificant," said the Master. "Is the Tao in a hand-held calculator?" asked the novice. "It is," came the reply. "Is the Tao in a video game?" asked the novice. "It is even in a video game," said the Master. "Is the Tao in the DOS for a personal computer?" asked the novice. The Master coughed and shifted his position slightly. "The lesson is over for today," he said.

1 0

Aging and bloated OpenSSL is purged of 2 high-severity bugs
by Peter Reutemann 03 May '16

03 May '16

"Maintainers of the OpenSSL cryptographic library have patched high-severity holes that could make it possible for attackers to decrypt login credentials or execute malicious code on Web servers. The updates were released Tuesday morning for both versions 1.0.1 and 1.0.2 of OpenSSL, which a large portion of the Internet relies on to cryptographically protect sensitive Web and e-mail traffic using the transport layer security protocol. OpenSSL advisories labeled the severity of both vulnerabilities "high," meaning the updates fixing them should be installed as soon as possible. The fixes bring the latest supported versions to 1.0.1t and 1.0.2h." -- source: http://arstechnica.com/security/2016/05/aging-and-bloated-openssl-is-purged… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Huge number of sites imperiled by critical image-processing vulnerability
by Peter Reutemann 03 May '16

03 May '16

"A large number of websites are vulnerable to a simple attack that allows hackers to execute malicious code hidden inside booby-trapped images. The vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users." -- source: http://arstechnica.com/security/2016/05/easily-exploited-bug-exposes-huge-n… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fast good unlimited internet
by Ian Young 03 May '16

03 May '16

As per the subject it sounds great. Alas this is New Zealand, home of the rapacious duopoly, and one cable outwards. So you won't be looking at 'Spark' (aka former monoply Telecom) or global corp Vodafone. The fast thing has got a bit better since the powers that be finally fibred up at taxayer expense at least in part. Or so I hear. Ultra fast is probably an exaggeration compared with benchmark nations. Long white cloud has some issues with population density and geography. However it sounds like there may be a local option. Tauranga is an opulent region so there must be some money in it for small providers. Until a bigger fish appears bent on acquisition.

1 0

Art Or Spam?
by Lawrence D'Oliveiro 03 May '16

03 May '16

A bot has been hanging around 3D-printing site Thingiverse, generating random and bizarre/surreal remixes of objects posted to the site by others <http://arstechnica.com/gadgets/2016/05/that-time-a-bot-invaded-thingiverse-…>. The creators of the bot recently showed some of the results at an exhibition. Is “confrontational art” just another term for “trolling”? Opinions about the bot’s contribution to the community seem mixed...

1 0