Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
Security
  • 36C3: Open Source Is Insufficient To Solve Trust Problems In Hardware

    With open source software, we’ve grown accustomed to a certain level of trust that whatever we are running on our computers is what we expect it to actually be. Thanks to hashing and public key signatures in various parts in the development and deployment cycle, it’s hard for a third party to modify source code or executables without us being easily able to spot it, even if it travels through untrustworthy channels.

    Unfortunately, when it comes to open source hardware, the number of steps and parties involved that are out of our control until we have a final product — production, logistics, distribution, even the customer — makes it substantially more difficult to achieve the same peace of mind. To make things worse, to actually validate the hardware on chip level, you’d ultimately have to destroy it.

    On his talk this year at the 36C3, [bunnie] showed a detailed insight of several attack vectors we could face during manufacturing. Skipping the obvious ones like adding or substituting components, he’s focusing on highly ambitious and hard to detect modifications inside an IC’s package with wirebonded or through-silicon via (TSV) implants, down to modifying the netlist or mask of the integrated circuit itself. And these aren’t any theoretical or “what if” scenarios, but actual possible options — of course, some of them come with a certain price tag, but in the end, with the right motivation, money is only a detail.

  • Election security, ransomware dominate cyber concerns for 2020 [iophk: Windows TCO]

    Senate Democrats have repeatedly tried to force Senate Majority Leader Mitch McConnell (R-Ky.) to schedule votes on a raft of various election security bills. The House has passed three major pieces of election security legislation this year that have stalled amid Republican objections in the Senate.

  • There’s Money To Be Made In Taming Open Source Software Code

    “We’re trying to create order out of chaos,” said CEO Wayne Jackson of his company, Sonatype.

    [...]

    “We are building the world’s critical infrastructure on software somebody else wrote, a stranger with unknown skills, motivations and desires, but the desire to innovate is so high, we’re willing to accept the risk of using some random person’s software invention,” Jackson said.

    Sometimes developers understand the practical use of the open source code they’re creating, and sometimes they don’t, according to Jackson. 

  • Medley India Infosolution helps Indian Railways build crew management software system

    The system design is end-to-end UNIX and Linux thereby immunising the systems against malicious threats. The solution has with immense power to control the client locations from central location by way of maintenance tasks, time synchronisation, patch updates and variety of user access requirements thus speeding up the service request handling from a remote location. Service requests can be lodged into the CMS system and are automated through SMS call lodging and reminder mechanisms. At the client side the users are authenticated via a biometric device (thumb impression reader) for logging onto the applications via a kiosk which ensures an audit trail and logging of activities for transparency and accountability.

More in Tux Machines

Android Leftovers

3 charts that show how open source developers think

Each year, the team at Tidelift asks developers to update us on how they are managing their use of open source dependencies for application development. In June 2019, almost 400 professional software developers responded to our survey with input on "how they use open source software today, what holds them back, and what tools and strategies would help them use it even more effectively." As we roll out the 2020 survey, we'd like to share some of the fascinating things we learned in 2019's survey results. Where are things going well? And where are they not going so well? Here are three examples. You can take the 2020 survey right now, and then continue on to some of the most interesting 2019 findings. Read more

Linux Mint 20 “Ulyana” Release Date : How To Download

Linux Mint 20 “Ulyana” Release Date: Features & How To Download Though we don’t know when Linux Mint 20 “Ulyana” will be released as Linux Mint tends to release when they are ready to go. Linux Mint 20 will be available in 3 editions (Cinnamon, MATE, and Xfce) but only in 64-bit. It will be based on Ubuntu 20.04 LTS and use a Linux 5.4 kernel. Read more Also: Ubuntu 20.04 LTS Vs Linux Mint 20 : Which One To Install?

Linux LTS Kernel 4.19 And 5.4 Will Now Be Supported For 6 Years, Instead Of 2

Greg Kroah-Hartman, a lead Linux Kernel developer and maintainer, has officially extended end-of-life (EOL) support for the LTS (Long-term Support) Linux kernel 4.19 and 5.4 from two to six years. He recently made changes to the official Linux Kernel long-term release page and increased the projected EOL by four years. This means Linux kernel 4.19 will now get backporting bugs and important security fixes until December 2024 and kernel 5.4 until Dec 2025. Read more