Security in FOSS: ‘Badsecrets’, Nmap, Anti-Interdiction, and CentOS
-
‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
Black Lantern Security introduces Badsecrets, an open source tool for identifying known or weak cryptographic secrets across multiple platforms.
-
Nessus vs. Nmap Vulnerability Scans: Which is Best for You?
Nessus and Nmap are both well-respected vulnerability scanning solutions. These highly specialized software tools can proactively scan your business environment and also identify and address security vulnerabilities. Nessus is developed by Tenable and offers visibility into your internet-connected attack surface. Nmap, or Network Mapper, is also widely used for network discovery and security auditing.
-
Bootstrapping Trust with Anti-Interdiction
How do you bootstrap trust when you have to order a trusted computer from an untrusted one? One way is with our anti-interdiction services and in this article I will talk through how that works.
There are many different reasons why customers add our anti-interdiction services to their phone or laptop orders. When you sign up for anti-interdiction, I work with you personally to identify your threats and talk you through the different measures we can put in place. As a result I have seen a full spectrum of reasons for anti-interdiction. Some (arguably most) customers aren’t facing a particular threat, but instead just want some peace of mind that their device hasn’t been tampered with in shipping so they can start with a clean, secure computer. On the other end of the spectrum are customers who have past experience with tampering and reason to believe that their new computer will be tampered with in transit either by local governments, couriers, neighbors, stalkers, or even family members.
Yet one of the most challenging threat models is when a customer has reason to believe their current computer, email, and other devices are compromised. Even more challenging, their devices have been compromised by someone with some level of physical access, whether as a family member, an abusive ex, or a stalker. Interdiction is a real concern, and they are ordering Purism devices so they can start with a clean slate.
-
Google discloses CentOS Linux kernel vulnerabilities following failure to issue timely fixes - Neowin
Google's Project Zero security team has publicly disclosed multiple flaws in certain Linux kernels and distros following Red Hat's inability to fix them within the 90-day deadline assigned by Google.