Dr. Bill | The Computer Curmudgeon

You know I love LibreOffice, the completely FREE Open Source, Microsoft Office compatible office productivity suite! Well, a new version is out, and YOU should down it. Down both the .msi install file located here: https://www.libreoffice.org/download/libreoffice-fresh/ (Version 5.2.4 as of this writing.) AND the Help File .msi (which will be on the page, that the first page directs you to.) Install both, and enjoy FREE office suite-ing!

Our ol’ buddy, Steven J. Vaughan-Nichols has a great report on this fix!

Serious Ubuntu Linux desktop bugs found and fixed

ZDNet – By: Steven J. Vaughan-Nichols – “If you, like me, use Ubuntu desktop, or one of its relatives such as Linux Mint, you have a bug to patch.

Donncha O’Cearbhaill, an Irish security researcher, found a remote execution bug in Ubuntu. This security hole, which first appeared in Ubuntu 12.10, makes it possible for malicious code to be injected into your system when you open a booby-trapped file. This can be used to crash your system or run malware. It does not — a small blessing — enable attackers to become the root user.

O’Cearbhaill found that Ubuntu will open any unknown file with Apport if it begins with ‘ProblemType: ‘. Apport is Ubuntu’s default crash handler and crash reporting program. So far, so good.

Apport in turn generates a crash file with the unusual ‘.crash’ extension and a magic byte sequence. Magic bytes are the unique sequences meant to identify a file. For example, a PDF document without a PDF extension can still be identified as PDF by its hexadecimal magic byte sequence: ’25 50 44 46.’

Magic bytes, of course, can be abused and that’s in part what’s happened here. When Ubuntu is presented with an unknown file it will first try to match its Multipurpose Internet Mail Extensions (MIME) extension. If that fails, it will fallback to matching the magic bytes.

So, an attacker can create a file with the Apport magic bytes indentification. Now you would not nomally open a file with the extension ‘.crash’, but you might open a file without an extension. If you do, Apport will open it and then displays a minimal crash report prompt. If you elect to ‘Show Details’, you’ve just opened yourself up for an attack.

That’s because within the bogus Apport crash file, a hacker can use the Apport Crash Report Format to hide a demand to run a Python program listed in the CrashDB field. This command will then be parsed and executed without any further user interaction.

In short, Apport doesn’t properly sanitize the Package and SourcePackage fields in crash files before processing them.

Adding insult to injury, another bug, of the Path Traversal family, enables an attacker to run Python files to cause even more trouble. In practice this means that: ‘An attacker could serve plant a malicious .py file and a crash file in the users Download directory to get code execution.’

Worse still, if the user has a user ID (UID) of 500 or less, Apport will use Polkit (formerly PolicyKit) to prompt the desktop user for root privileges with a generic ‘System program problem detected’ message. If you do so, congratulations. You’ve just granted the attacker the ability to run commands as root.

The good news is that the problems have been patched. So, now that you’re almost done reading this, patch your system already.

The bad news is there still aren’t enough eyes looking at older open-source code for overlooked security vulnerabilities.

Worst still, as O’Cearbhaill points out, ‘The computer security industry has a serious conflict of interest right now. There is major financial motivation for researchers to find and disclose vulnerability to exploit brokers. Many of the brokers are in the business of keeping problems unfixed. Code execution bugs are valuable. As a data point, I received an offer of more than 10,000 USD from an exploit vendor for these Apport bugs. These financial motivators are only increasing as software gets more secure and bugs become more difficult to find.’

The answer? Don’t simply hope programmers will work for the common good. Instead, O’Cearbhaill believes companies should support vulnerability reward programs such as The Internet Bug Bounty project.”

Need a web browser at the command line for Linux? Here are three for you to consider.

3 web browsers for the Linux command line

OpenSource.com – Scott Nesbitt – “Let’s take a trip back in time to the early, simpler days of the web. A time when most of us used low-powered PCs or dumb terminals, often over slow dial-up connections. We generally visited web pages using command-line, text-only browsers like the venerable Lynx.

Jump forward to these days of web browsers like Firefox, Chrome, and Safari. You’d think that browsing the web at the command line would have gone the way of the tag. You’d be wrong. Web browsers that run in a terminal window are alive and kicking. They’re niche, but still get the job done.

Why browse the web from the command line?

There are any number of reasons for browsing the web from the command line. You might be a command line junkie who wants to do everything from the terminal or you might have a slow internet connection. You might want to test a website’s accessibility, avoid tracking scripts and annoying advertising. Or, you might just want to read an article or blog post without distractions.

With that out of the way, let’s take a look at three browsers for the command line.

Links2

Links2 bills itself as the graphical version of the venerable Links. It’s a lot like its predecessor in that it gives you the option to run either in text-only mode or graphical mode.

When you start it by typing links2 at the command line and go to a website, the result is something like this:

Reading an Opensource.com article with Links2.

But when you run links2 -g then visit a site, the result is something like this:

Reading an Opensource.com article with Links2 in graphical mode.

That’s not the only trick that Links2 can do. The browser can display frames and tables, and supports basic JavaScript. You can also use your mouse to follow hyperlinks whether you’re in text or graphical mode.

ELinks

Like Links2, ELinks is a fork of the Links browser. And like Links2, ELinks can display tables and frames. While it supports using a mouse to follow hyperlinks, ELinks lacks support for Javascript.

One feature that makes ELinks stand out from other command line browsers is its menu system. Press ESC on your keyboard display a set of menus that let you enter and save URLs, add bookmarks, set up the browser, and more.

Using the menus in ELinks.

ELinks lacks a graphical mode, but it does have a nifty feature that lets you view images on a web page. Either click the placeholder for the image or highlight it and press v on your keyboard. ELinks opens the image with an application like ImageMagick or GraphicsMagick.

Displaying an image from a web page.

w3m

When I first fired up w3m, it reminded me of a cross between the classic text-based browser Lynx and the UNIX/Linux text viewer more. While it might not have as many features as the other browsers I discuss in this article, w3m gets the job done.

You can navigate web pages using a mouse, and the browser will render tables and even accept cookies. Like ELinks2, w3m lets you view images on a page using an external program. The browser doesn’t do JavaScript, though.

As far as the important job of rendering web pages, w3m does a better job than Links2 or ELinks even with complex pages. The rendering is clean and colorful.

Viewing a web page with w3m.

w3m doesn’t use the same keyboard shortcuts as other command line browsers, so get ready to learn some new ones. You can do that by pressing H while running w3m.”

Image: Microsoft

Here’s a cool use for the new Microsoft Hololens!

HoloLens, MD: Why this medical school will teach doctors anatomy with Microsoft’s augmented reality, not cadavers

ZDNet – By Jo Best – “Every doctor, no matter how long they’ve been out of medical school, will remember the first time they walked into a dissection lab. They’ll remember the smell of the embalming fluid, the feeling of peeling back the cover to reveal the cadaver underneath, and being handed a scalpel and asked to make their first incision.

It’s a rite of passage for many aspiring doctors: some will cry or faint at the sight of the cadaver, some will understand for the first time how different systems work together, or that medicine goes hand in hand with mortality, and all will feel profoundly grateful to the person whose donated body lies in front of them.

Dissection labs are often cramped, with too many students per cadaver to afford everyone a good view. The chemicals used to preserve the bodies are harsh and can provoke allergies in some people, and the labs are difficult and expensive to maintain.

Could there be a better way for medical students to learn anatomy? One university thinks so: when Case Western opens its new health education campus in collaboration with the Cleveland Clinic in 2019, students won’t learn anatomy from cadavers, they’ll learn it from virtual reality.

‘In 2013, I was part of a team that was asked to teach anatomy completely digitally — not having any cadaver lab in this new building. Obviously, this is a pretty big challenge. We’ve had many hundreds of years of teaching anatomy the same way, but we also thought the time was right to think about doing it in a new way… it’s very difficult to maintain a cadaver lab, the cost and infrastructure required to maintain that is very difficult. Not only is there the challenge of having people’s bodies donated, but there’s a lot of challenge around all the environmental concerns,’ Mark Griswold, a professor in the department of radiology at Case Western, told ZDNet.

With that all-digital teaching in mind, the university had tried out using large touchscreens as a way of attempting to replicate the anatomy lab, but found the vital 3D element missing from the touchscreens meant they weren’t quite right. Now, they’re planning to use Microsoft’s HoloLens system — what Redmond calls a ‘mixed reality’ device which layers virtual projections on top of the user’s real-world view.

The university’s collaboration with Microsoft came about as Toby Cosgrove, president of the Cleveland Clinic, knew Craig Mundie, then head of Microsoft Research, and was invited to come and see the technology in action back in 2014. Though it was still early days for HoloLens, the staff were convinced of the technology’s potential for anatomy teaching.

‘From one minute to the next, we realised our lives had changed and this would revolutionise the way we teach,’ Griswold said.

When Microsoft launched HoloLens earlier this year, one of the ways it has been demonstrating the system is with an anatomy app, where HoloLens wearers can see a representation of a human body in 3D, and navigate through the layers of skin, muscle, blood vessels, and organs to the skeleton below. HoloLens users can see the heart in the chest, how it pumps blood around the body, and how and where each of the veins and arteries feed into it. You can walk around it, see all the different structures in 3D dimensions from whatever view you choose: you can even stare down through the top of the head into the body below.

For those Case Western students starting at the new campus, this will be the main way they learn anatomy: by putting on a HoloLens headset and having their teacher guide them through a lesson on a virtual human subject.

The university has already held trial lessons on the upper thorax using the augmented reality technology, and compared how well students had taken to the material compared to those who undertook traditional, lab-based lessons. Of the students who tried the HoloLens system, 100 percent said they’d like to use it again. ‘A lot of students reported being able to see things in our class that they couldn’t see in the cadaver — that was the kind of thing we took away that was very positive,’ Griswold said.

Now the university is in the process of working out how HoloLens will be used across the curriculum from 2019. The HoloLens anatomy demos show static representations of the body, but the 3D effect means it’s hard for users not to try to reach out and touch the structures: rotate the heart a little to see the course of a vein, or attempt to move a muscle out of the way to see what artery lies beneath. Staff are now looking at what level of interactivity could be built into the system.

‘Maintaining the balance of interactivity is something we’re doing a lot of work trying to understand better — this is a new way of interacting with information and a new way of interacting with people. It’s not trivial to have multiple people looking at the same virtual data,’ Griswold said.

Case Western’s developers started work on the HoloLens in 2015, and the university is working on developing the content and the IT it needs to put in place to support it.

‘We’re continuing to develop the content of the models of the human body and how we would present that. We’ve also had to do a lot of work on basic infrastructure. The HoloLens is a very, very exciting piece of technology but it’s very, very early in its development and there are a lot of fundamental things that don’t exist for it. Over the next year to year-and-a-half we’re going to be mostly focused on testing that content with the students and making sure they can learn it in the same way they could on a conventional cadaver or learn similar information,’ Griswold said.

And it’s not just medical students that could potentially be using HoloLens on the new campus: pupils from other disciplines including art, history, engineering, and physics could too. A student could walk around a 3D representation of the Coliseum, for example, or wander through Gaugin’s Tahiti before discussing the works that his stay on the islands led to.

For an object lesson in how HoloLens could be used in engineering, students in the field could just look at the buildings around them, which are being designed in HoloLens.

‘We’re making the decision about the building that’s going to get built, the size of the rooms and so on, and we finally made the decision: ‘why don’t we look at it in HoloLens?’ Several of the rooms have been designed in HoloLens now. I can promise you when I walk into the room, I will already know what it looks like.’

For the first students to enter Case Western’s new campus, then, VR will be all around them. That already means they’ll have a very different experience to most medical students, but they will also be set apart by not having worked on a cadaver all term.

There’s no doubt they’ll have the same appreciation of anatomy as their cadaver-taught peers, but working in an anatomy lab teaches would-be doctors some other really important things: to appreciate that sometimes the human body is a treacherous, gruesome thing; that sometimes illness will overcome even the most talented of doctors’ work and what happens when it does; and perhaps the most important lesson of all — those anatomy lessons they learn, the beautiful physiology, biology, and chemistry they learn, it’s not abstract, it all comes together in a real-live human patient.

Will Case Western’s students have the same appreciation of the softer side of medicine by missing out on dissection?

‘Dissection is a rite of passage, but that’s not what the class is about — it’s about anatomy. For those other components — understanding real patients, understanding the grossness of what happens — let’s do dedicated courses to that end.’ The university is currently considering how to add those elements into the curriculum, and each student will still get a two-week ‘boot camp’ in another anatomy lab, giving them the appreciation of the elements of medicine that only a cadaver can give.

‘In 2025, students will have this when they show up [at university for the first time], they’re going to have in the same that they all have cellphones now… There are things you lose moving away from a cadaver lab, but there’s the potential for a huge amount of win especially as it applies to the way we practice medicine.'”

A very cool use for exoskeleton tech!

Paralyzed Connecticut Man Walks Thanks to High-Tech Exoskeleton

ABC 7 – By: Lauren Glassberg – PORT JEFFERSON, Long Island (WABC) – “Thirty-one-year-old Greg Durso usually needs a wheelchair to get around, but on Tuesday, the Connecticut man used cutting-edge technology to help him stand and walk at a facility on Long Island.

You may have heard of robotic suits before, but this one is just the second to be approved by the FDA. And now, it’s being put to work right here in our area.

Durso was paralyzed in a sledding accident eight years ago, but thanks to new technology, he can rise out of his wheelchair with some help and walk across the room.

‘When you see this, I actually get up, I actually walk,’ he said. ‘I gave my sister a hug for the first time in eight years, face to face. It’s pretty emotional and empowering, and it’s just exciting to see where the future is really going to go with this type of technology.’

It’s an exoskeleton made by Indego, and Durso is participating at a clinical trial at St. Charles Hospital of Long Island in Port Jefferson. It’s one of only nine facilities in the country to have one, and weighing in at 26 pounds, this one in particular is much lighter than the other approved version.

‘While right now the device moves the legs for the patient, what will be in the next version of this device is electrical simulation built in,’ St. Charles medical director of rehabilitation Dr. Jennifer Semel said. ‘So that those patients, their own muscles will be able drive the machinery.’

Even though Durso has no use of his legs, he still wakeboards and skis. And staying in shape helped him qualify for the trial, which leaves him feeling hopeful and empowered.

‘I feel like a giant, even though I’m far from that,’ he said. ‘It’s just an incredible feeling to be up there and walking again and putting weight on your legs. Each step is kind of like a leap of faith. You put yourself out there, and I think it’s like that in life as well.’

Dr. Semel said the hospital had been interested in working with Indego for some time, and she is optimistic for the future as well.

‘We will be, in the next few weeks, starting with stroke patients, right now with spinal cord injury patients,’ she said. ‘But the future of this is really limitless.’

And that is hope for others just like Durso.”

This is what I love about Dropbox, it is everywhere! Now on Xbox!

Dropbox is now available on the Xbox One

Engadget – By: Nathan Ingraham – “Dropbox has long said it wants to be available on whichever platforms people use to get things done. That’s why it has done so much to integrate with Microsoft Office over the years, for example. But the latest place you’ll find Dropbox is nonetheless unexpected: The company just launched an app for the Xbox One.

Sure, the Xbox One is, at its core, a Windows 10 computer you hook up to your TV, but it’s still surprising to see a productivity app all about sharing your files show up there. However, Dropbox doesn’t think users will be collaborating on Office docs through their TVs. Dropbox has come up with a few features that make sense for the platform. ‘We wanted to solve an issue that we all have: making it easy to access and share your content from the biggest screen in your house,’ Dropbox staff engineer Rudy Huyn said in an email. ‘That meant giving users the ability to access files without the need to plug in an HDMI cord or connect to their laptop.’

Once logged in, you can upload screenshots and pictures taken with Kinect straight to your Dropbox. You can also stream any video files in your Dropbox to the Xbox One — something that’ll definitely be handy for those of us who have a large video library but no seamless way to play it on the big screen. You can also upload files from USB drives connected to the Xbox One or upload files from other universal Windows 10 apps you may be running on your console. And other applications (Dropbox specifically mentioned VLC) can see flies in your account and access them.

The rather unusual project was born at Dropbox’s annual hack week, when the entire company takes five days to build and show off a wide variety of projects. Some have nothing to do with actual shipping projects, but many others end up making their way into Dropbox in one way or another. ‘At this year’s event, one of our engineers decided to prototype the app, and demo’d it to other Dropboxers, showing how we can bring a new Dropbox user interface within Xbox that is optimized for TV screens and for gamepad navigation,’ Huyn said.

And it turns out this wasn’t just a random pet project but something users were asking for in Dropbox’s support channels and on social media. ‘Given what we heard from our users, we knew that there was demand for this app, and so we decided to make it available to everyone as a full-blown offering.’

As for the development process, the universal nature of Windows 10 made it fairly simple. ‘The simplicity of building this app is part of why we decided to transform the prototype into a real product,’ Huyn said. ‘A big reason that it was so easy to build is that Microsoft makes it easy to develop applications for Windows 10.’ But the Dropbox team still had to change a number of things to make this work, as the user interface naturally needs to be different when dealing with an Xbox controller and a TV 10 feet away. Specifically, Huyn noted that the difference in how TVs display colors compared to monitors necessitated a new, darker theme with more contrast ‘to make the app easier on our users’ eyes.’

There are benefits to having Dropbox on the Xbox One that should extend to app developers as well as your average console owner. ‘We heard from Xbox developers that they needed a file explorer on Xbox that allowed them to access their files for the cloud, because many of the apps that they were building were useless without having access to files,’ Huyn said. ‘Now developers can easily access files stored directly in Dropbox.’

Of course, Microsoft’s own OneDrive has been available on the Xbox One for some time now, but millions of people are using the service, so giving them an option to easily get their files on the Xbox is a smart move, even if it’ll likely be something of a niche app. If you want to give it a shot yourself, the app is live today in the Xbox Store.”