SHA-1 is dead

SHA1, the old secure hashing algorithm is now broken in practice. See the Google Security blog post on the first SHA1 collision.

SHA1 was already theoretically broken 2005, when Prof. Xiaoyun Wang announced a differential attack. By 2010 the NIST decided to announce SHA-1 as deprecated.

SHA1 is still in use in BitTorrent and on some https sites. As far as I know, Chrome is currently the only Browser, who considers SHA-1 signed certificates as not secure. Firefox is about to phase it out as well and Edge wants to do this in mid of this year.

BitTorrent uses SHA-1 as well. Since we now have the first proven collisions, this could become interesting in lawsuits coming from the content industry ...


SHA-1 is proven broken and must not be used anymore.

Privilege escalation bug in Linux Kernel

... and how to deal with it right:

Bug filed and fixed on February 17, patches are already in circulation. Exploit will be made available in some days to allow the administrators to update.

The fix was just a two-liner but still: Fixed-on-the-same-day-as-filed. That's how it should work 🙂

And in the Windows world we still have unpatched Zero-day exploits, after three months of responsible disclosure. THREE MONTHS!! STILL UNPATCHED!!

LineageOS - My first builds

I just compiled my first LineageOS system for my Nexus 5. Works like charm!

The required steps are well documented on the LineageOS Wiki page. I just followed the steps on my Ubuntu Mate 16.04. The process itself was straight-forward but took some time. Including downloading all the repos and building it took me something like 3 hours.

I've created builds for hammerhead (Nexus 5) and manta (Nexus 10). I would also like to build for n8000, but since that device is not officially supported, I still need to figure some things out. But thanks to lirokoa who provides the necessary device files it should be still possible to build it, although Samsung has terminated the Software support for the Galaxy Tab 10.1.

In the first attempt I forgot to extract the proprietary blobs. Surprisingly the build succeeded, but was useless. After flashing the phone was stuck in the Google screen. Not cool.
In the second attempt I just extracted the binaries, and rebuild the process. With enabled CCache, this was done within 20 Minutes.

Stability

I read some good stories about the usability and stability of the current LineageOS builds (Nougat 7.1). I've tested it now for several days on a spare Nexus 5 (but without Sim card) and didn't noticed any issues in the usability.

It seems that the current available build on the download pages is already ready to use for your daily device. But not too hasty, it's still a nightly build, you should be able to recover the phone yourself, if you're jumping into that adventure 🙂

 

I'm honestly considering updating my major phone to Lineage soon.

Download my builds

I uploaded the builds to ftp://feldspaten.org/LineageOS/ into the folder hammerhead/ on my brand new configured ftp server.

I'm also interested to build LineageOS for the Nexus 10 (manta) and Galaxy Tab 10.1 (n8000) in order to support the project and some people who want to have it too 🙂

ICRC : Six ICRC staff members killed in an attack

Sad news: Six ICRC (International comitee of the red cross) staff members have been shot and killed in Afghanistan. Two staff members are unaccounted for.

The team was in a logistical mission on the way to deliver livestock supplies when they were attacked by unknown armed forces.

RIP Brothers and sisters. Thanks your your service and dedication 🙁

Why I think, that SteamOS should become more popular

In a nutshell

  • You can build your own hardware
  • You have the freedom to choose between a high-end gaming PC or a low budget living room console, even cheaper than a PS4
  • Microsoft's UWP is bad for the consumer, since it want's to destroy competitors instead of competing with them
  • Since Vulkan more Games will be available on Linux, this will bring some freedom to the games to chose the operating system that works better for them.

SteamOS is a Linux-based platform for Steam. I think that's a great step forward in order to bring the gaming market closer to the Linux platform than any approach before. And let me explain to you, why this is important.

Advantages of SteamOS

I'm running Linux on a daily basis. And for that I would be more convenient for me to have more native games running in my Linux Steam, than to force me to reboot Windows.

Apart from that, you can build or order your own Steam Machines. They allow you to build your own consoles and media centres based on real PC hardware. They might be more expensive than a PS4 or XBox, but they can be also MUCH MORE powerful in terms of performance. In other words - You gain the freedom to choose the hardware that you want. Wanna go for a complete 4k 60 FPS machine? Go ahead! Or just wanna have a casual machine, even cheaper than a PS4? Also that's possible.

Why Microsoft's UWP is bad

This is not a rant or MS bashing. Microsoft has done a lot of good things and empowers new technologies. But their strategy in building up their own monopole with UWP is bad for the consumers and their partners.

Universal Windows Platform is a new Runtime for Windows, that claims to unify programs for all Windows platforms. Sounds good up to now, but it intrinsically also binds every program to the Windows Store. This is a new form of the Trusted Computing platform, that has failed already several times in the past. So if programs are not "trusted" by the Windows store, you cannot run them. That is bad, since other Platforms, like Steam, then cannot install Games without the "permission" of the Windows Store. That is terrible! You just lost control over your computer.

"The risk here is that, if Microsoft convinces everybody to use UWP, then they phase out Win32 apps. If they can succeed in doing that then it’s a small leap to forcing all apps and games to be distributed through the Windows Store. Once we reach that point, the PC has become a closed platform. It won’t be that one day they flip a switch that will break your Steam library – what they’re trying to do is a series of sneaky manoeuvres. They make it more and more inconvenient to use the old apps, and, simultaneously, they try to become the only source for the new ones."

Tim Sweeney, PC Gamer

I don't like the approach here - It's not that Microsoft brings something new out that just works better. No, they did a major screwup with DirectX 12, where they focused on the Marketing and not on the actual Technology. This is why Vulkan gained so much popularity and may outpower DirectX 12. At least I hope so, because that would be a game-changer in the battle of the operating systems. And the winner in this case is the consumer, because he can chose between two different platforms, what suits him better.

If Microsoft would really bring something totally revolutionary and big on the table, that outperforms all of the competitors the case would be different. But they are not. They are trying to destroy better technologies to bring make their own product shine brighter.

 

Of course, this is just my humble opinion, and I could be wrong.

Looking at Venus and Mars

Maybe some of you have noticed a bright spot in the morning and evening hours at the sky - That's Venus.
Venus has a fixed position in human culture, often referred as "morning star" and "evening star".

A friend of mine noticed, that there is as well a second bright spot, like a "shadow" visible from Innsbruck - Interesting! Let's have a look in Stellarium:

Venus and Mars are currently visible

That's actually Mars. They both are in a fortunate constellation, so that one can observe both of them at the same time in the morning and evening hours.

So people, go outside and have a look. And when you see two bright spots at the morning and evening sky you look at two planets of our solar system.