Security Leftovers
-
LWN ☛ Security updates for Wednesday
Security updates have been issued by AlmaLinux (firefox, kernel, kernel-rt, tbb, and thunderbird), Debian (bind9, cacti, pam-pkcs11, and ruby2.7), Fedora (bind, bind-dyndb-ldap, chromium, crun, and java-21-openjdk), Mageia (calibre, nginx, python-ansible-core, python-jinja2, python-pip, python-setuptools, python-twisted, and python-waitress), Red Hat (doxygen, firefox, gcc, gcc-toolset-13-gcc, gcc-toolset-14-gcc, tbb, and thunderbird), SUSE (go1.24, govulncheck-vulndb, java-1_8_0-openj9, kernel, openssl-3, ovmf, python3-numpy, python311, python36, qemu, and skopeo), and Ubuntu (bluez and openssl).
-
Techdirt ☛ Subaru Software Hacked, Allowing Remote Control And Access To The Location Histories Of Millions Of Drivers
Last year Mozilla released a report showcasing how the auto industry has some of the worst privacy practices of any tech industry in America (no small feat). Massive amounts of driver behavior is collected by your car, and even more is hoovered up from your smartphone every time you connect. This data isn’t secured, often isn’t encrypted, and is sold to a long list of dodgy, unregulated middlemen.
Given the fact the U.S. is simply too corrupt to pass even a baseline privacy law, automakers and executives are never incentivized to really try very hard.
-
Hacker Noon ☛ Security's Moving Parts 01: Linux Access Control Mechanisms
We all use software and hardware with many security mechanisms inside and don't notice them. But these mechanisms are not magical: they still live somewhere in code or schematics and trigger just when needed.
I've always been interested in how things work, which is one of the main reasons I've been passionate about Engineering, especially Security.
-
ADTmag ☛ Linux Foundation and OpenSSF to Help Developers Navigate EU Cyber Resilience Act [Ed: The Microsoft sites treat OpenSSF like it's a Microsoft thing (because to a great degree it is)]