Security Leftovers

• Security updates for Thursday

  Security updates have been issued by CentOS (firefox and nss-softokn), Fedora (samba), Oracle (nss, nss-softokn, nss-util, nss-softokn, and thunderbird), Scientific Linux (thunderbird), SUSE (firefox), and Ubuntu (librabbitmq and samba).

• Reproducible Builds in November 2019

  As a summary of our project, whilst anyone can inspect the source code of free software for malicious flaws almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is therefore to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.

• Hex Five Announces General Availability of MultiZone Security for Linux - Commercial Enclave for RISC-V processors

  Hex Five Security Inc., provider of policy-based hardware-enforced separation for a number of security domains, announces the general availability of MultiZone Security for Linux, designed to bring security through separation to embedded systems. MultiZone Security is available for the Microchip PolarFire system-on-chip, the hardened real-time, Linux capable, RISC-V-based microprocessor subsystem. Support for additional RISC-V processors to be announced later in 2020.

Red Hat and Fedora; OpenShift, Satellite, Fedora Women’s Day and More

• The Rise Of Open-Source Software

  Open-source software powers nearly all the world’s major companies. This software is freely available, and is developed collaboratively, maintained by a broad network that includes everyone from unpaid volunteers to employees at competing tech companies. Here’s how giving away software for free has proven to be a viable business model.

• Red Hat Wins 2019 Ford IT Innovation Award

  Red Hat, Inc., the world's leading provider of open source solutions, today announced that it has been awarded the prestigious Ford IT Innovation award. In its fourth year, the award showcases Ford’s technology partners that have helped it launch new capabilities and services or enhance existing operations. The Ford IT Innovation Award emphasizes Red Hat’s work related to the digital transformation of stateful applications across Ford’s hybrid cloud environment, spanning dispersed datacenters and multiple public clouds, as well as Red Hat’s leadership in enterprise Kubernetes innovation and its collaboration with Ford Motor Company’s technical leaders.

• Introduction to DevSecOps by John Willis (Red Hat) – OpenShift Commons Briefing

  In this briefing, DevSecOps expert, John Willis, Senior Director, Global Transformation Office at Red Hat gives an introduction to DevSecOps and a brief history of the origins of the topics.

• Announcing Speaker Line-Up for Openshift Commons Gathering in London January 29th 2020

• OpenShift 4.x Installation – A Quick Overview

  In this video we will look at the options to install an OpenShift 4.x cluster and will see a fully automated quick installation with minor customizations on a cloud provider.

• RHEL package updates and live kernel patching with Red Hat Satellite

  In many environments, scheduling downtime to patch and reboot Red Hat Enterprise Linux (RHEL) systems is difficult, which can lead to systems being left vulnerable for weeks or months on end. Some of these security vulnerabilities are critical in nature. RHEL versions 7.7 and 8.1 introduced live kernel patching functionality via kpatch for all subscriptions, which allows for select critical and important security kernel patches to be applied without a reboot. There are several considerations to take into account when using kpatch, so please review the relevant RHEL 7 and RHEL 8 documentation which covers kpatch in depth, including its limitations, before proceeding further. If the goal is to live patch a system for security vulnerabilities, we need more than kpatch, as it only handles kernel patches. We also need to consider other packages that might need to be updated on the system for security issues. One frequent mistake system administrators make is updating a system, but not restarting processes on the system that have had their libraries updated, which can lead to processes remaining vulnerable.

• FWD’19 Mexico City

  Fedora Women’s Day (FWD) is a day to celebrate and bring visibility to female contributors in open source projects, including Fedora. Fedora’s Diversity and Inclusion team lead the initiative. The number of women in tech has been increasing year over year, further highlighting the importance of a more inclusive culture in tech. On October 10, We had our second Fedora Women’s Day in Mexico City, this time hosted by UNAM, one of the greatest Universities of Mexico and we loved to do it again.

Mozilla: Analysis Maturation Plan, Content Security Policy and Firefox Reality

• Analysis Maturation Plan

  To summarize the problem, I need to be able to share analyses with my peers at Mozilla (often HTML documents generated by Rmarkdown). Currently, we effectively dump documents onto an FTP server tied to a webserver (called Hala). This works pretty well, but it makes it almost impossible to search and discover other people's analyses and makes getting review difficult. To address these two problems, we put together mozilla.report and mozilla-private.report. These are effectively lightweight blog indexes for public and private analyses. This works OK, but it still requires analysts to take the time to check in their results and get review. It's a little heavy weight and isn't getting as much use as I would like. Hell, I don't even use it all the time just because I'm busy.

• Test the new Content Security Policy for Content Scripts

  As part of our efforts to make add-ons safer for users, and to support evolving manifest v3 features, we are making changes to apply the Content Security Policy (CSP) to content scripts used in extensions. These changes will make it easier to enforce our long-standing policy of disallowing execution of remote code. When this feature is completed and enabled, remotely hosted code will not run, and attempts to run them will result in a network error. We have taken our time implementing this change to decrease the likelihood of breaking extensions and to maintain compatibility. Programmatically limiting the execution of remotely hosted code is an important aspect of manifest v3, and we feel it is a good time to move forward with these changes now. We have landed a new content script CSP, the first part of these changes, behind preferences in Firefox 72. We’d love for developers to test it out to see how their extensions will be affected.

• Discover on desktop or mobile. Enjoy in VR, only with Firefox Reality.

  A special update for Firefox Reality is available today -- just in time for the holidays! Now you can send tabs from your phone or computer straight to your VR headset. Say you’re waiting in line for your festive peppermint mocha, killing time on your phone. You stumble on an epic 3D roller coaster video that would be great to watch in VR. Since you’ve already signed in to your Firefox Account on Firefox Reality, you can send that video right to your headset, where it will be ready to watch next time you open the app. You can also send tabs from VR over to your phone or desktop, for when you eventually take your headset off. When you use Firefox on multiple devices, you can sync your history and bookmarks too. No more waving the laser pointer around to type wonky URLs or trying retrace your steps back to that super funny site from yesterday. Stay tuned in the new year for more features like these that make using VR a more seamless part of your everyday life.