Language Selection

English French German Italian Portuguese Spanish

Security: Updates, Browsers, Red Hat and Routers

Filed under
Security
  • Security updates for Friday
  • Ryzom falling: Remote code execution via the in-game browser

    Ryzom’s in-game browser is there so that you can open links sent to you without leaving the game. It is also used to display the game’s forum as well as various other web apps. The game even allows installing web apps that are created by third parties. This web browser is very rudimentary, it supports only a bunch of HTML tags and nothing fancy like JavaScript. But it compensates for that lack of functionality by running Lua code.

    You have to consider that the Lua programming language is what powers the game’s user interface. So letting the browser download and run Lua code allows for perfect integration between websites and the user interface, in many cases users won’t even be able to tell the difference. The game even uses this functionality to hot-patch the user interface and add missing features to older clients.

  • For Red Hat, security is a lifestyle, not a product

    Red Hat has a sterling reputation in Linux security circles. That means the company has a workable process for preventing problems and responding to them. Even if you don't use Linux, the Red Hat security approach has a lot going for it, and some of its practices might be worth adopting in your own shop.

  • How insecure is your router?

    Your router is your first point of contact with the internet. How much is it increasing your risk?

    [...]

    I'd love to pretend that once you've improved the security of your router, all's well and good on your home network, but it's not. What about IoT devices in your home (Alexa, Nest, Ring doorbells, smart lightbulbs, etc.?) What about VPNs to other networks? Malicious hosts via WiFi, malicious apps on your children's phones…?

    No, you won't be safe. But, as we've discussed before, although there is no such thing as "secure," it doesn't mean we shouldn't raise the bar and make it harder for the Bad Folks.™

More in Tux Machines

Debian GNU/Linux 10 "Buster" Installer Updated with Linux Kernel 4.16 Support

Developed under the Debian Testing umbrella, the forthcoming Debian GNU/Linux 10 "Buster" operating system series just received today the third alpha milestone of its installer, which lets people install the Linux-based operating system on their personal computers, servers, and IoT devices, such as the Raspberry Pi. One of the most interesting changes that caught out eyes is the bump of the kernel support from Linux kernel 4.13, which was used in the second alpha build, to Linux kernel 4.16. Of course, this means that there's better hardware support, so chances are you'll be able to install the development version of Debian GNU/Linux 10 "Buster" on newer machines or if you have some exotic components on your PC. Read more

The New Microsoft

  • Microsoft ICE Contract Draws Fire

    “ICE’s decision to accelerate IT modernization using Azure Government will help them innovate faster while reducing the burden of legacy IT. The agency is currently implementing transformative technologies for homeland security and public safety, and we’re proud to support this work with our mission-critical cloud,” he wrote.

  • Microsoft faces outrage for blog post touting ICE contract

    As outrage grew online, a Microsoft employee quietly removed mention of ICE from the January press release this morning. Social media users noticed that, too. The company has since restored the press release's original language, and called its removal a "mistake."

  • Microsoft Removes Mention of ICE Cloud Work After Protests

    Microsoft Corp. scrubbed an online reference to its work for U.S. Immigration and Customs Enforcement as the agency faces criticism for its role in separating families at the U.S.-Mexican border.

  • Microsoft briefly removes blog post mentioning ICE contract after backlash
  • Microsoft's Ethical Reckoning Is Here

    Tech Workers Coalition, a labor group for tech industry employees, urged Microsoft employees to coordinate their opposition. “If you are a worker building these tools or others at Microsoft, decide now that you will not be complicit,” the group tweeted.

Android Leftovers

First Ubuntu Touch OTA-4 Release Candidate Based on Ubuntu 16.04 LTS Is Here

The latest Ubuntu Touch update from UBports, OTA-3, was released last year near the Christmas holidays, but it was still based on Ubuntu 15.04 (Vivid Vervet), so if you though Ubuntu Phones are dead, think again, because the UBports team has been hard at work to bring you the OTA-4, which will be the first to rebase the operating system on Ubuntu 16.04 LTS (Xenial Xerus). "The main reason why the arrival of OTA-4 seemed to take so long is because Ubuntu Touch switched its base to Ubuntu 16.04 LTS Xenial Xerus. This is a mammoth milestone for the project, because it allowed us to transition from the unsupported Ubuntu 15.04 Vivid Vervet to a Long Term Support (LTS) base," reads today's announcement. Read more Also: UBports' Ubuntu Touch OTA-4 RC Released, Upgrades To Ubuntu 16.04 LTS