Language Selection

English French German Italian Portuguese Spanish

What you need to know about the SSLv3 “POODLE” flaw (CVE-2014-3566)

Filed under
Red Hat

So, the bottom line is: on servers and clients, disable SSLv3 (and, of course, older). Updates to Fedora packages which make this the default will be forthcoming, but in the meantime, you can do it manually. Red Hat is working on a security blog article explaining the steps to take for different software; we’ll link to that when it becomes available.

Read more

More in Tux Machines

Android Leftovers

Hardware: Embedded, Graphics, and Raspberry Pi

  • Tiny module and dev kit can run with Mini or Nano

    Beacon EmbeddedWorks’ tiny “i.MX 8M Mini/Nano SOM” runs Linux or Android on the Mini or Nano with up to 8GB LPDDR4, eMMC, WiFi/BT, and an optional “Zoom” dev kit. Eden Prairie, Minn. Based Beacon EmbeddedWorks, which was formerly Logic PD and is now a subsidiary of electronics manufacturing services firm Compass Electronics Solutions, has announced a compute module that supports either the NXP i.MX8M Mini or similar, but slightly stripped down i.MX8M Nano. The i.MX 8M Mini/Nano SOM offers up to 8GB LPDDR4 with the Mini and 4GB with the Nano.

  • Nvidia launches TAO software for easier AI model training

    Nvidia unveiled a GUI-based “TAO” framework that eases AI model training for GPU-equipped platforms such as Jetson. There is also an upcoming “Grace” CPU plus improvements to Nvidia’s Jarvis voice agent, Maxine video SDK, and other AI tools. At GTC 2021 today, Nvidia unleashed a torrent of announcements including the unveiling of an Nvidia TAO (Train, Adapt, and Optimize) framework for speeding AI development. Here we will focus on TAO along with brief examinations of improvements to Nvidia’s Jarvis voice technology, Maxine video SDK, DeepStream video analytics, and Merlin deep learning recommender system. The main event at GTC was the unveiling of an AI-enhanced, server-oriented Grace CPU based on next-gen Arm Neoverse IP. By the time it arrives in 2023, Nvidia should have completed its pending, $40 billion acquisition of Arm.

  • Low-cost WiFi and LoRa gateway add-on offers flexible configuration options

    On Kickstarter: a $21-and-up “Axon” board with 4x DI that can act as a standalone ESP8266-based WiFi gateway with optional LoRa and/or connect via USB Type-C to a Pi or other system. A Barcelona-based startup called Qortex is close to reaching its $1,189 Kickstarter goal for a flexible, ESP8266-based “Axon” WiFi and/or LoRa gateway. The device can double as a sensor add-on to a Raspberry Pi, Arduino, or any other board that supports serial communications. A free Axon Cloud service with storage and an online serial monitor is also available, enabling you to set up a low-cost WiFi or LoRa based sensor network.

  • Mini-PCIe adapter enables M.2-based 5G on Gateworks SBCs

    Gateworks’ “5G Cellular M.2 Adapter” is a mini-PCIe card for its Ventana, Venice, and Newport SBCs equipped with an M.2 B-key slot that supports 5G modems plus dual nano-SIM slots. Gateworks offers a variety of mini-PCIe modules for its Arm/Linux SBCs, including last year’s Sub-1GHz and BLE-equipped GW16122 IoT Radio. Now, to keep its customers up to date with the latest M.2-form factor 5G cellular modems, the company has launched a 5G Cellular M.2 Adapter that supports modem modules up to 52mm in length.

  • Raspberry Pi: a versatile tool for biological sciences

Security Leftovers

  • How the NAME:WRECK Bugs Impact Consumers, Businesses [Ed: Now they go ALL CAPS to increase the SHOCK FACTOR]

    How this class of vulnerabilities will impact millions connected devices and potentially wreck the day of IT security professionals.

  • Linux Foundation sigstore finds ‘origins’ in software supply chains [Ed: Companies connected to the Pentagon trying to centralise "trust" and over time control what people can and cannot install and run on their own GNU/Linux systems]

    The Linux Foundation announced the sigstore project this spring. Designed to improves the security of the software supply chain, sigstore is said to enable the adoption of cryptographic software signing backed by transparency log technologies. Software application development professionals will be able to securely sign software artifacts such as release files, container images and binaries. Signing materials are then stored in a tamper-proof public log. The service will be free to use for all developers and software providers, with the sigstore code and operation tooling developed by the sigstore community.

  • NSA uncovers new "critical" flaws in Microsoft Exchange Server [Ed: It sort of misses the point that there are NSA back doors in everything from Microsoft]

    Microsoft released three new patches for its Exchange Server software on Tuesday after the National Security Agency (NSA) alerted the company to a fresh batch of critical vulnerabilities. The new fixes are for three versions of Exchange Server - 2013, 2016 and 2019 - and the flaws are said to be different vulnerabilities to the ones disclosed in March. However, US agencies continue to find and remove vulnerabilities in their systems a month after the previous flaws were first discovered.

  • Not even the best antivirus could have shielded you from this Linux and macOS malware [Ed: Misinformation. It neglects to say that Microsoft delivers this malware. Instead it blames the recipients of Microsoft (NPM)]

    Researchers have identified a new strain of Linux and macOS malware capable of eluding even the most reputable antivirus services. According to security company Sonatype, the malicious program was discovered on the npm registry, a developer resource that catalogues various open source JavaScript packages.

Top 6 Web Server Performance Testing Tools

Web server benchmarking is a way of determining the performance of a web server with the aim of establishing how well it copes under a sufficiently high workload. Performance testing is important to help maintain continuous system performance. The performance of a web server can be expressed in a number of different ways including the number of requests served within a certain time, the latency response time for each new connection or request, or the throughput. The open source Linux benchmarking tools featured in this article enable the performance of a web server to be tested prior to releasing it in a production environment. Accurately testing a web server is quite a challenging activity. This is, in part, because a web system is a distributed system. Further, Hypertext Transfer Protocol, the application protocol for hypermedia information systems, can cause connection usage patterns that the Transmission Control Protocol was not designed for. Moreover, problems are generated in testing the performance because of the sheer dynamism of a web server. Read more