- luv-talk - luv.asn.au

Re: [luv-talk] Facebook.. Privacy? What privacy?
by Rick Moen 26 Jul '13

26 Jul '13

Strongly concur with recent comments, here, that the embedded market tends to be a completely different mentality, where the notion of anyone being selective about what one is willing to run is simply an alien concept. Back when I was working at Cadence Design Systems (a big EDA-industry company), I found myself being told by my new boss that he would like me to install various bits of proprietary software on my home laptop for company purposes. I very politely informed him that (1) my laptop ran Debian and not MS-Windows or Mac OS X, but also (2) for reasons of local privacy and security policy, only software I had approved and selected would be installed and run there. However, I said, if he wanted to issue me a company machine to run company-specified software, that would perhaps work. And I remember the look of intense surprise. The 'I installed [foo] because a Web site told me I needed to' population is, actually, almost everyone except us freaks. It's well to remember that, because it's easy to forget. Date: Thu, 25 Jul 2013 13:12:24 -0700 From: Rick Moen <rick(a)linuxmafia.com> To: skeptic(a)lists.johnshopkins.edu Subject: Re: nukemap Quoting Leonard R. Cleavelin (leonard(a)cleavelin.net) > Quoting Lawrence Crowell (goldenfieldquaternions(a)gmail.com) > > > This little morbid program http://54.213.55.143/nukemap3d/ is interesting. > > You can enter in any city in the world set the yield of a nuclear bomb and > > let 'er rip. You need Google Earth 3-D to run this. > > I used it to "nuke" the FedEx Forum in Memphis with a "Davy Crockett" > (smallest nuke the US forces have ever fielded; IIRC it has a 20 > ton--not mega-, not kilo-, not even hecto, just ton--yield). It felt > good. ;-) I'm delighted that people enjoy cool Internet-enabled applications like this, and under no circumstances would tell a devotee he/she shouldn't run them.[0] At the same time, I keep being bemused by the security and privacy implications of such things -- by which I don't mean the little morbid program so much as I do the Google Earth engine needed to run it. Google Earth in either its browser plugin or standalone form isn't just a proprietary opaque (by which I mean unauditable by anyone outside Google, Inc.) binary program but also such an offering _specifically_ from one of the most prying, nosy, large Internet corporations on Earth, a corporation whose entire business model is based on data-mining computer users to glean data valuable to them and to their customers. The Google Earth program[1] must be installed with root (for Unixes) or administrator (for Windows) privilege, hence will have total access to everything on your machine, and hooks directly into the video software layers (for 3D imaging) and sends real-time data (into which you have no visibility) from your computer back to Google. And you're being told you can do this as a non-customer of Google: Google's _actual_ customers (the people who pay them money for services) are entitled by law to an implied warranty of good faith and fair dealing. Users who elect to download their 'free' proprietary programs or use their 'free' Web services have no such entitlment, and are (as the saying goes) not customers but rather product. tl;dr: Google Earth is a huge 'trust me' from the most prominent data-mining enterprise in existence, one that for quite a few years has made quite clear that it will intrude on user privacy whenever and wherever it wants.[2] And _that_, Ben Avery, is one of the things one avoids by sticking to open source offerings from trustworthy (and cross-checked) sources, even if you don't get to see dancing hamsters, animated birthday cards, and nuclear explosions requiring one to download and run an 'app' from nowhere-in-particular (or worse, from someone you know whom you have _no_ reason to trust). _Or_ one can just not bother being careful, and good luck with that. [0] Not because you shouldn't, but just because I don't want to waste time arguing with people who enjoy the benefits of being careless about software and are effectively treating Internet and software security as Someone Else's Problem. [1] The standalone version, at least. The browser plugin version can presumably be installed with only user-level authorisation -- which is quite bad enough. [2] http://wendy.seltzer.org/blog/archives/2009/12/08/personalized-search-opaci… http://joeyh.name/blog/entry/adieu_google/

1 0

Unlocked android phones with LTE support
by Jason White 26 Jul '13

26 Jul '13

I was planning to buy one of these devices: https://play.google.com/store/devices/details/Samsung_Galaxy_S_4?id=samsung… but discovered that (1) they are available in the U.S. only, and (2) not surprisingly, they are designed for North American frequencies, i.e., 1700 MHz rather than the 1800 MHz bands used in Australia by the major carriers. The advantage, of course, is that the Google devices have unlocked boot loaders so you can replace the firmware yourself, if needed - and I might need it, for various reasons. So if one is looking for an LTE-capable phone with an unlocked boot loader that supports Australian frequency bands, am I right that there are no options on the market at the moment? I can afford to wait a little longer - the equivalent of the above device with the right frequencies supported would be ideal of course.

9 16

Andrioid stores WLAN passwords unencrypted - and sends it to Google
by Petros 23 Jul '13

23 Jul '13

https://code.google.com/p/android/issues/detail?id=57560 So, your smartphone/tablet will have a list of all the WLAns you connected to. Stored unencrypted. And sends it to Google (according to heise.de this is the Default on all the Android systems they tested it). Well - means, Google has a very very large database of WLAN passwords. Not using it yourself is just half of the solution. There is a friend coming with his Android, "Can I use your WLAN?" - and Google knows your WLAN password. Google will know your company's WLAN passwords too. Regards Peter

3 3

Australian Computer Museum Society needs members
by Patrick Webster 17 Jul '13

17 Jul '13

Hello all, I posted this to the AusNOG list and someone suggested I cross post here as well... This is a once off email to notify you of the Australian Computer Museum Society Incorporated (ACMS). The ACMS is an Australian charity (donations are tax deductible) solely funded by membership and donations incorporated in the early 90's. The current President of ACMS is John Deane (of CSIRO / WiFi fame). The purpose of the Society is to preserve and maintain computer artefacts (particularly, but not limited to, Australian inventions), such as hardware, operation manuals and source code etc. Some years ago they provided a tape drive to try and restore Moon landing data! The ACMS has collections distributed throughout Australia, mostly in warehouses which can be viewed upon arrangement. The primary goal is to open a public exhibit to show things like disk platters that are the size of a coffee table and blocks of RAM housed in wood and Perspex. They have many working systems that are older than most of us. I wouldn't be surprised if many of you on this list used some of the artefacts in the 50s - 90s etc (pre Apple and Microsoft years). There are many ways you can help (and they do need help): * Join the public mailing list by sending a blank email to acms-list+subscribe(a)googlegroups.com. To post messages, email acms-list(a)googlegroups.com * Like on Facebook (https://www.facebook.com/AustralianComputerMuseumSociety ) * Follow on Twitter (https://twitter.com/ACMS_org_au) * Join on LinkedIn ( http://www.linkedin.com/groups/Australian-Computer-Museum-Society-4511577?g… ) * Become a financial member $35/year tax deductible ( http://www.acms.org.au/become-a-member) * Make a tax deductible donation of any amount ( http://www.acms.org.au/contribute) * Volunteer by maintaining, donating or repairing artefacts. Engineers needed. * Forwarding to friends and associates who may also be interested in Australian computing history and preservation * Help with the new website (http://www.acms.org.au) Interested to hear your thoughts... I'm considering organising a kickstarter style crowdfunding project for them as well. Many other countries have computer heritage exhibits (UK and US are obvious)... Check out the website Timeline - .au should have one as well, before all is forgotten from living memory. Cheers, -Patrick

1 0

OSDC 2013, Auckland, NZ, Call for Papers ends Monday
by jarich＠perltraining.com.au 12 Jul '13

12 Jul '13

Dear LUV committee/list owner, Thankyou for your support over the years for the Open Source Developers' Conference. We would love to invite your group members to submit to this year's call for presentations, and would be delighted if you'd pass this message on for us. ------------------------ The Open Source Developers' Conference is running in Auckland this year on 21st - 23rd October. Save this date now! Once again it'll be a conference not to be missed. The Call for Proposals is just about over, it closes next Monday 15th July. Make sure that you get your submission in as soon as possible so that you can be involved in this awesome event. We have had some high calibre submissions so far covering a diverse range of topics including * web server security * disaster management * documentation * anonymity * security in the Cloud. Areas we are currently lacking contributions include * development tools and Best Practices * open source hardware * identity management for the open internet * working with open source databases such as MySQL, MariaDB and PostgreSQL * mobile platforms and open source * the next great thing in Open Source focused languages We'd also love to hear about those companies who have managed to create Business solutions with Open Source tech. Open Source is a viable, cost-effective tool for Business solutions. We want to hear from those of you who have created your own solution using this technology. What were the advantages/disadvantages of using Open Source? How did your solution hold up in the long run? Visit the Call For Papers page http://osdc.org.nz/cfp/ for more information and get in touch! Please, also tell your friends! With thanks, Jacinta, on behalf of the 2013 OSDC Auckland team.

1 0

Re: [luv-talk] Facebook.. Privacy? What privacy?
by Petros 11 Jul '13

11 Jul '13

From: "Jason White" <jason(a)jasonjgw.net> > As I understand it from this discussion, > the current approach is to ask the user to grant all permissions > that might be > needed during installation, and then the app author can simply assume > throughout the code that security restrictions won't stand in the way of > the actual operations. There are still mystifying permission requests. E.g. the YouTube app: Camera - take pictures and videos Allows the app to take pictures and videos with the camera. This permission allows the app to use the camera at any time without your confirmation. I want to watch YouTube - not YouTube watching me! Why is nearly everyone asking for the permission to get the list of running applications, and the caller Ids of incoming calls? My solution is not using a smartphone at all - I don't consider the merging of phone and tablet as done in a reasonably safe way, and I don't like the idea of bugging my bedroom myself. If wanted, there would be practical simple solutions in place. E.g. a mechanical switch to connect microphone and camera to the system. Regards Peter

4 3

Re: [luv-talk] Facebook.. Privacy? What privacy?
by Petros 08 Jul '13

08 Jul '13

From: "Russell Coker" <russell(a)coker.com.au> > Lots of apps get access to all the mass storage of the phone when they really > only need one of the following: > > 1) Access to store their own data (a chroot would do in this case, but it's > only one situation). > > 2) Access to one particular data store - the most common case being an > application which only needs access to photos. A chroot wouldn't work for > this as it's a fairly standard feature to store photos in two locations. > > 3) Access to particular files, EG you view a picture in the gallery app and > then say that you want to share it via a particular application. Well, if the app has its own container, the sharing could be creating a hardlink for the file in question. Containers could cover limited network access too. If you have one running a firewall and a web-proxy, you really know what's sent. Regards Peter

1 0

Re: [luv-talk] Facebook.. Privacy? What privacy?
by Petros 08 Jul '13

08 Jul '13

Quoting"Trent W. Buck" <trentbuck(a)gmail.com> > Robin Humble wrote: >> or simpler, just don't install the facebook app! > > The last time I gave a full-on privacy rant to a bunch of normal > people, they looked at me and went "so what do we do?" And I said > "well a simple, easy and effective start is to boycott facebook." > Then there was an awkward silence and you could see them thinking > "facebook is worth more than my privacy." With Android we are back to Windows 98 if it comes to controlling the machine. We don't know what's there, and the system does not have usable security mechanisms. Well, Android is a Linux kernel.. Would be good to have a kernel which is running Linux containers, or Xen, and then you can install a "Facebook container" which gets access to the system as you wish. It is always better to start with a clean sandbox first and then open as you like, instead of closing holes everywhere. Regards Peter

1 0

Scratch, Snap! (BYOB 4.0) on Raspberry Pi and Android
by Rodney Brown 06 Jul '13

06 Jul '13

Alec mentioned Scratch and quickly demo-ed it on Raspberry Pi in his talk at the meeting. At LCA they mentioned that they're interested in optimizing Squeak, the underlying Smalltalk implementation for ARM for speeding up scratch on the Raspberry PI. The bug report is http://www.raspberrypi.org/phpBB3/viewtopic.php?f=77&t=12522 A google summer of code link for bootstrapping the Squeak JIT for ARM, I think all in Smalltalk. http://gsoc2012.esug.org/projects/arm-jitter Squeak underlies Etoys too. Looking at the Scratch website http://scratch.mit.edu/help/faq/ , the new Scratch 2.0 version will run in browsers with Adobe Flash 10.2. Will that run on the Pi? I'd guess not. http://byob.berkeley.edu/ Snap! (Build Your Own Blocks) 4.0 derived from Scratch has also moved off Squeak, but is implemented in Javascript. It ran for me in Firefox 22.0 on Ubuntu and Chrome and loaded at least in a colleagues Android phone. If it works ok in the browser on Raspberry Pi and Android tablets it would be good to demo at Software Freedom Day. Anyone want to give Snap! a try on a Pi or a tablet?

1 0

Re: [luv-talk] luv-talk] Facebook.. Privacy? What privacy?
by Petros 04 Jul '13

04 Jul '13

From: "Jason White" <jason(a)jasonjgw.net> > Yes, exactly. Probably the closest analogue in (non-Android) Linux > installations is PolicyKit under Gnome, and I'm not sure how that works in > this regard. I find Capsicum interesting. http://www.cl.cam.ac.uk/research/security/capsicum/ http://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201305-temporal-practi… Instead of giving all permissions to a whole application, you separate it in modules that get certain privileges when needed. Of course it is up to a programmer to use it - and there are companies that don't have any interest in that. Regards Peter

3 2