Language Selection

English French German Italian Portuguese Spanish

Security

Tails OS Will Keep You Anonymous Online and Offline

Filed under
Security
Debian

There are many Linux distributions available right now that claim to protect the privacy of their users, but very few actually do it properly. Tails is definitively among the top ones, if not the best. Now, a new version has been made available, but it's just an RC for an upcoming release...

Read more

Adobe Digital Editions 4 Spies on Users - Because of DRM

Filed under
Security

This column has written many times about the deep flaws of Digital Rights Management (DRM) - or "Digital Restrictions Management" as Richard Stallman rightly calls it - and the ridiculous laws that have been passed to "protect" it. What these effectively do is place copyright above basic rights - not just in the realm of copyright, but even in areas like privacy. Yesterday, another example of the folly of using DRM'd products came to light.

Read more

The Source of Vulnerabilities, How Red Hat finds out about vulnerabilities.

Filed under
Red Hat
Security

Red Hat Product Security track lots of data about every vulnerability affecting every Red Hat product. We make all this data available on our Measurement page and from time to time write various blog posts and reports about interesting metrics or trends.

One metric we’ve not written about since 2009 is the source of the vulnerabilities we fix. We want to answer the question of how did Red Hat Product Security first hear about each vulnerability?

Every vulnerability that affects a Red Hat product is given a master tracking bug in Red Hat bugzilla. This bug contains a whiteboard field with a comma separated list of metadata including the dates we found out about the issue, and the source. You can get a file containing all this information already gathered for every CVE. A few months ago we updated our ‘daysofrisk’ command line tool to parse the source information allowing anyone to quickly create reports like this one.

Read more

USB Sees Many Changes For Linux 3.18 Kernel

Filed under
Linux
Hardware
Security

Greg Kroah-Hartman sent in pull requests on Tuesday for the various kernel subsystems he maintains. The USB changes as he put it are "lots of little changes in here, all over the place", per his mailing list post.

Read more

Ten Year Old "Critical" Bug Discovered In OpenBSD

Filed under
Security
BSD

While OpenBSD generally prides itself on being a secure, open-source operating system and focusing more on code corectness and security rather than flashy features, it turns out a potential security bug has been living within OpenBSD for the past decade.

Phoronix German ready "FRIGN" wrote in to Phoronix this afternoon with a subject entitled, "10 year old critical bug in OpenBSD discovered." He pointed out a post today about a bug discovered in OpenBSD's polling subsystem that could allow DDoS-style attacks on servers, "a critical bug in the polling-subsystem in OpenBSD has been uncovered which allows DDoS-attacks on servers using a non-standard derivation from the POSIX-standard in marking file descriptors non-readable when they should return EOF."

Read more

Open source's "shallow bugs" theory hasn't been Shellshocked

Filed under
OSS
Security

It hasn't been a good year for open source. Not for its generally golden reputation for software quality and security, anyway. But in a rush to lay blame for the Bash Shellshock vulnerability (and previously for Heartbleed) some, like Roger Grimes, want to dismantle some of the cardinal tenets of open source, like the suggestion that "given enough eyeballs, all bugs are shallow."

Read more

Tor executive director hints at Firefox integration

Filed under
Moz/FF
Security

Tor, which is capable of of all that and more, crucially blocks websites from learning any identifying information about you and circumvents censorship. It also stymies eavesdroppers from discovering what you’re doing on the Web. For those reasons, it would be a powerful addition to the arsenal of privacy tools Firefox already possesses.

The Tor Browser is already a modified version of Firefox, developed over the last decade with close communication between the Tor developers and Mozilla on issues such as security and usability.

Read more

LibreSSL: More Than 30 Days Later

Filed under
Security
BSD

Instead, libressl is here because of a tragic comedy of other errors. Let's start with the obvious. Why were heartbeats, a feature only useful for the DTLS protocol over UDP, built into the TLS protocol that runs over TCP? And why was this entirely useless feature enabled by default? Then there's some nonsense with the buffer allocator and freelists and exploit mitigation countermeasures, and we keep on digging and we keep on not liking what we're seeing. Bob's talk has all the gory details.
But why fork? Why not start from scratch? Why not start with some other contender? We did look around a bit, but sadly the state of affairs is that the other contenders aren't so great themselves. Not long before Heartbleed, you may recall Apple dealing with goto fail, aka the worst bug ever, but actually about par for the course.

Read more

Secure Linux Systems Require Savvy Users

Filed under
Linux
Security

Patches are available to fix the bash vulnerability known as Shellshock, along with three additional security issues recently found in the bash shell. The patches are available for all major Linux distros as well as for Solaris, with the patches being distributed through the various distros.

Read more

Free Software Foundation statement on the GNU Bash "shellshock" vulnerability

Filed under
GNU
Security

Proprietary, (aka nonfree) software relies on an unjust development model that denies users the basic freedom to control their computers. When software's code is kept hidden, it is vulnerable not only to bugs that go undetected, but to the easier deliberate addition and maintenance of malicious features. Companies can use the obscurity of their code to hide serious problems, and it has been documented that Microsoft provides intelligence agencies with information about security vulnerabilities before fixing them.

Read more

Syndicate content

More in Tux Machines

KWayland Server Component Coming For KDE Plasma 5.2

KWayland was introduced last month with the KDE Plasma 5.1 release but it lacked the server-side code. With the upcoming release of Plasma 5.2, that will change with the server component to KWayland having been merged. Readreactor'smore

Where is M13? Review – A Simple and Powerful Galactic Atlas

Where is M13? is a planetarium application that allows users to view details about distant objects in the sky, covering a very large number of items ranging from stars to other galaxies. There are not many apps that can do this, so most of the shortcomings could be forgotten. Read more

Raspberry Pi and Coder by Google for beginners and kids

Coder is a fantastic resource for learning programming. It simplifies the process of getting started, requires very inexpensive components, and provides fun and engaging activities. If you are planning on gettting a Raspberry Pi for the holidays, (or already have one), Coder is a great addition to get extra fun and learning from that little board. Read more

‘Where is the nearest?’: Spain shares code for web map-tool

The government of Spain is making available as open source the code for Ciudadania Europea, a web site that pointed citizens to the nearest embassies and consular services in European countries. That service was closed this summer, but the code is now freely available for other similar projects. Read more