- Talk - lists.gtalug.org

"Golden Age for Computer Architecture"
by D. Hugh Redelmeier 14 Aug '18

14 Aug '18

This Turing Award Winners talk is quite insigtful. Full title: "A New Golden Age for Computer Architecture: Domain-Specific Hardware/Software Co-Design, Enhanced Security, Open Instruction Sets, and Agile Chip Development" The speakers are key figures in the RISC revolution. John L. Hennessy and David A. Patterson <https://www.acm.org/hennessy-patterson-turing-lecture> Note: they mean that it is a golden age for researchers. Not so good for users.

3 3

browsers
by o1bigtenor 09 Aug '18

09 Aug '18

Greetings I am not asking about how to solve Firefox issues (IMO the best way would be to get rid of the garbage) but am looking for some input. Firefox dies on me - - - and often. Am running a Debian testing box with 2 gpus and 4 monitors (and more than 20 GM of RAM) so I run the proprietary drivers (nouveau devs still seem to only use one monitor so they don't have any way that I know of to set up a four monitor 2 gpu setup). To have some privacy I run Noscript and only give limited approval for access. Firefox seems to be only set up to run on M$ systems. The sometimes 5 and more deaths (FF) per day are getting quite old. Are there any options for browsers that work? I'd use Chromium but I'm quite tired of google using me to get rich (especially when their search engine isn't near as good as they want me to think it is (I generally use Duckduckgo)) - - - so any ideas? I've tried Min, Opera, Vivaldi doesn't really work well (imo). Ideas/suggestions welcome! Regards Dee

4 5

ret2spec: Speculative Execution Using Return Stack Buffers
by Russell Reiter 09 Aug '18

09 Aug '18

More Intel woes. http://www.digitaljournal.com/tech-and-science/technology/new-security-flaw… Quote from the whitepaper link in the article. 3 GENERAL ATTACK OVERVIEW Before detailing specific attack scenarios, in this section, we introduce the basics of how RSB-based speculative execution can be achieved and be abused. We explore whether and how attackers may manipulate the RSB entries in order to leak sensitive data using speculative execution that they could not access otherwise. Similar to recent microarchitectural attacks [8, 10, 22, 26, 29], we trick the CPU to execute instructions that would not have been executed in a sequential execution. The goal is to leak sensitive information in speculation, e.g., by caching a certain memory area that can be detected in a normal (non-speculative) execution. The general idea of our attack can be divided into three steps: (A1) trigger misspeculations in the return address predictor, i.e., enforce that returns mispredict (A2) divert the speculative execution to a known/controlled code sequence with the required context (A3) modify the architectural state in speculation, such that it can be detected from outside (A1) Triggering Misspeculation: From an attacker’s perspective, enforcing that the return predictor misspeculates upon function return is essential to reliably divert speculative execution to attacker-controlled code (see A2 for how to control the speculated code). Misspeculations can be achieved in several ways, depending on the RSBs underflow behavior (as discussed in Section 2.3).

2 3

OpenWRT 18.06 Released
by Scott Sullivan 06 Aug '18

06 Aug '18

https://openwrt.org/ To Quote: The OpenWrt Community is proud to present the OpenWrt 18.06 stable version series. It is the first stable version after the OpenWrt/LEDE project merger and the successor to the previous stable LEDE 17.01 and OpenWrt 15.05 major releases. The OpenWrt 18.06 series focuses on modernizing many parts of the system, on backporting network offload support for eligible targets and on laying the groundwork for regular future release updates. === I personally had switched to LEDE a very early in 2017. It was fresh and they met their goal of regularly updating the router distro. I've done periodic updates from 17.01.1 to 17.01.4. 17.01.5 is out, but I'm going to jump to 18.06. OpenWRT / LEDE has been keeping my D-Link DIR-825 in service for almost a decade now. Originally my home router for a several years, and then an upgrade (replacing a WRT54G) at my boyfriends home (until earlier this year, when an Archer C7 went in). It now sits as my test router, and humming happily away with 18.06. I'll start rolling this out to my fleet of TP-Link Archer C7 routers soon. -- Scott Sullivan

2 1

Re: [GTALUG] blackmail
by D. Hugh Redelmeier 06 Aug '18

06 Aug '18

| From: ac via talk <talk(a)gtalug.org> | no, not really. by the time you receive the type of email you have, it is way too late. Probably. But the information that a site was hacked should still be useful to the site. | How sure are you that it was Canada Computers? Are you saying that that | was the only place you used that password? Yes. (I said that in my original posting.) | And, is it a current | password (dollars to donuts says: no...) It was. No longer. | and with Google hacked, Yahoo | hacked, Microsoft hacked, it matters very little anyway... Change your | passwords every 30 days (or less) I find that too much bother. Experts have waffled on this policy. | and never use the same password | twice (or even anywhere else) - If they sent me my google/yahoo/etc | password - I would even be able to tell you from which week it came :) For real security, use something other than passwords. But that doesn't seem to be in place for most sites. Single-sign-on makes multi-factor authentication more feasible. I don't trust the monopoly power of single-sign-on providers. And I don't trust the resulting "one compromise to rule them all" ecosystem. And I'm not attached at the hip to a mobile phone (SMS is the usual second factor for consumers). I can imagine that client certificates for TLS could help, and I assume that the TLS supports this feature. But I don't know that any important sites expoit them. And the certificate hierarchy provides for monopoly abuse.

1 1

"Nobody" Problem
by Stephen 06 Aug '18

06 Aug '18

I have a share on Ubuntu Linux. From Windows copy files to the share. Files have owner of "Nobody" How do I have them default to the owner of the Public directory? Thanks -- Stephen

3 2

An LibreOffice question.
by Alvin Starr 05 Aug '18

05 Aug '18

Does anybody know how to display and work with SI numbers like 10k or 20M or 40G within LIbreOffice? I have had little luck searching with google et al. While I am at it how about engineering notation? -- Alvin Starr || land: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

5 5

blackmail
by D. Hugh Redelmeier 05 Aug '18

05 Aug '18

I received a blackmail message by email. It claimed that they hacked my system and had compromising videos from my computer's camera. As proof, they gave me what they claimed was my password. But I only used that password on two sites: canadacomputers.com and xpresscanada.com (a long-dead Canada Computers site). So I'm not worried. I informed CC about three weeks ago. They seemed to ignore the report. I phoned again two weeks ago, and they were interested. I told them if I didn't hear that they'd informed their customers that I'd publicize this security breach. I've heard nothing else. So I presume that they have not announced it to their customers. Today I got another blackmail message with the same password. What do you think that I should do? PS: my password is a random string generated by mkpasswd(1) so it would not have been discovered by an online exhaustive search. They most likely filched the password file from CC. PPS: I'm glad that I don't reuse passwords!

9 12

Re: [GTALUG] blackmail
by D. Hugh Redelmeier 04 Aug '18

04 Aug '18

| From: ac via talk <talk(a)gtalug.org> | essentially : Spam is dead. (So, you do not have to receive these | 'blackmail' emails) Thanks for the hints on spam. This particular email contained valuable information: that Canada Computers had been hacked. So I'm glad that it got through to me. I don't want it filtered out.

2 1

Name of gtalug wiki?
by William Park 02 Aug '18

02 Aug '18

Hi, What is the name of wiki app for our gtalug.org? I want to try it at work, for me, at least. -- William Park <opengeometry(a)yahoo.ca>

2 1