Language Selection

English French German Italian Portuguese Spanish

'Severe' OpenSSL vuln busts public key crypto

Filed under
Security

Computer scientists say they've discovered a "severe vulnerability" in the world's most widely used software encryption package that allows them to retrieve a machine's secret cryptographic key.

The bug in the OpenSSL cryptographic library is significant because the open-source package is used to protect sensitive data in countless applications and operating systems throughout the world. Although the attack technique is difficult to carry out, it could eventually be applied to a wide variety of devices, particularly media players and smartphones with anti-copying mechanisms.

An OpenSSL official, who asked that his name not be published, said engineers are in the process of pushing out a patch and stressed the attack is difficult to carry out in real-world settings.

More details here




More in Tux Machines

Outsourcing your webapp maintenance to Debian

It turns out that I'm not the only one who thought about this approach, which has been named "debops". The same day that my talk was announced on the DebConf website, someone emailed me saying that he had instituted the exact same rules at his company, which operates a large Django-based web application in the US and Russia. It was pretty impressive to read about a real business coming to the same conclusions and using the same approach (i.e. system libraries, deployment packages) as Libravatar. Regardless of this though, I think there is a class of applications that are particularly well-suited for the approach we've just described. If a web application is not your full-time job and you want to minimize the amount of work required to keep it running, then it's a good investment to restrict your options and leverage the work of the Debian community to simplify your maintenance burden. The second criterion I would look at is framework maturity. Given the 2-3 year release cycle of stable distributions, this approach is more likely to work with a mature framework like Django. After all, you probably wouldn't compile Apache from source, but until recently building Node.js from source was the preferred option as it was changing so quickly. While it goes against conventional wisdom, relying on system libraries is a sustainable approach you should at least consider in your next project. After all, there is a real cost in bundling and keeping up with external dependencies. Read more

How Intel HD Graphics On Linux Compare To Open-Source AMD/NVIDIA Drivers With Steam On Linux

As earlier this week I did a 20-way AMD Radeon open-source comparison, looked at the most energy efficient Radeon GPUs for Linux gaming, and then yesterday provided a look at the fastest NVIDIA GPUs for open-source gaming with Nouveau, in this article is a culmination of all the open-source graphics tests this week while seeing how Intel Haswell HD Graphics fall into the mix against the open-source Radeon R600/RadeonSI and Nouveau NV50/NVC0 graphics drivers. Read more

Leftovers: Gaming

today's howtos