Security: Updates, 'Smart' Things, Android Proprietary Software and Firefox Woes on Windows

• Security updates for Friday

• How Do You Handle Security in Your Smart Devices?

  Look around your daily life and that of your friends and family, and you’ll see that smart devices are beginning to take over our lives. But this also means an increase in a need for security, though not everyone realizes it, as discussed in a recent article on our IoT-related site. Are you aware of the need for security even when it’s IoT-related? How do you handle security in your smart devices?

• A Vulnerability in ES File Explorer Exposes All of Your Files to Anyone on the Same Network

• 2018 Roundup: Q1

  One of our major pain points over the years of dealing with injected DLLs has been that the vendor of the DLL is not always apparent to us. In general, our crash reports and telemetry pings only include the leaf name of the various DLLs on a user’s system. This is intentional on our part: we want to preserve user privacy. On the other hand, this severely limits our ability to determine which party is responsible for a particular DLL. One avenue for obtaining this information is to look at any digital signature that is embedded in the DLL. By examining the certificate that was used to sign the binary, we can extract the organization of the cert’s owner and include that with our crash reports and telemetry. In bug 1430857 I wrote a bunch of code that enables us to extract that information from signed binaries using the Windows Authenticode APIs. Originally, in that bug, all of that signature extraction work happened from within the browser itself, while it was running: It would gather the cert information on a background thread while the browser was running, and include those annotations in a subsequent crash dump, should such a thing occur.

Red Hat Advances Container Technology With Podman 1.0

Red Hat announced the 1.0 release of its open-source Podman project on Jan. 17, which provides a fully featured container engine. In Podman 1.0, Red Hat has integrated multiple core security capabilities in an effort to help enable organizations run containers securely. Among the security features are rootless containers and enhanced user namespace support for better container isolation. Containers provide a way for organizations to run applications in a virtualized approach on top of an existing operating system. With the 1.0 release, Red Hat is now also positioning Podman as an alternative to the Docker Engine technology for application container deployment. "We felt the sum total of its features, as well as the project's performance, security and stability, made it reasonable to move to 1.0," Scott McCarty, product manager, Containers, Red Hat, told eWEEK. "Since Podman is set to be the default container engine for the single-node use case in Red Hat Enterprise Linux 8, we wanted to make some pledges about its supportability." Also: Update on Volume Snapshot Alpha for Kubernetes

Clear Linux's make-fmv-patch Eases The Creation Of GCC FMV-Enabled Code Paths

One of the GCC compiler features unfortunately not taken advantage of by most Linux distributions is FMV - Function Multi-Versioning. FMV is what allows for the compilation of different tuned code paths depending upon the processor and for the particular code-path to be chosen at run-time, i.e. optimizing to your heart's content with AVX, SSE4, and other instruction set extensions and compiling all of that into a single binary and for the preferred code path to be taken depending upon the CPU running the binary so it will still run on older CPUs as well as today's most powerful processors.