Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Submitted by Roy Schestowitz on Wednesday 28th of August 2019 03:16:36 PM Filed under
Security
  • Groups push lawmakers for hearings on voting machine security [iophk: Windows TCO]

    Voting rights and election security groups on Monday urged two House and Senate committees to hold hearings on the security of voting machines.

    The groups, which include the National Election Defense Coalition, Electronic Privacy Information Center, R Street Institute and Public Citizen, asked the House Administration Committee and the Senate Rules and Administration Committee in a letter to schedule election security hearings that include testimony from voting machine vendors and election security experts.

  • Asruex Malware Exploits Old vulnerabilities to Infect PDF, Word Docs

    A recently observed variant of the Asruex backdoor acts as an infector by targeting old vulnerabilities in Microsoft Office and Adobe Reader and Acrobat 9.x, Trend Micro reports.

    Asruex was initially discovered in 2015 and was previously associated with the spyware DarkHotel. In addition to backdoor capabilities, the malware also appears to be able to inject code into Word and PDF files by targeting two old vulnerabilities tracked as CVE-2012-0158 and CVE-2010-2883.

  • First-ever worm that attacked the internet : Morris Worm

    Colombo (News 1st): Our connected world comes with countless risks. Viruses, worms, spyware, ransomware, backdoors, trojans: The language of cybersecurity is relatively new, but we have quickly become fluent. The misuse of technology has become the darkest danger of the digital age. Bad actors, emboldened by our inability to properly secure crucial systems and networks, are launching increasingly sophisticated attacks. No system is safe.

    But in the beginning, the very, very beginning computers inspired utopian visions of a better future, a world in which we were all digitally connected to one another and living in harmony.

  • Security updates for Wednesday

    Security updates have been issued by Debian (dovecot), Fedora (docker and nghttp2), Oracle (pango), SUSE (apache2, fontforge, ghostscript-library, libreoffice, libvirt, podman, slirp4netns and libcontainers-common, postgresql10, and slurm), and Ubuntu (dovecot).

  • Josh Bressers: Backdoors in open source are here to stay

    Unless you’ve been living under a rock for the past few … forever, you may have noticed that open source is taking took over the world. If software ate the world, open source is the dessert course. As of late there have been an uptick in stories about backdoors in open source software. These backdoors were put there by what is assumed to be “bad people” which is probably accurate since everyone is a villain in some way.

    The reactions I’ve seen to these backdoors range from “who cares I don’t use that” to “we should rewrite everything in house and in assembler and go back to using CVS on a private network”. Of course both of those extremes are silly, it’s far better to land somewhere in the middle. And as much fun as writing assembler can be, the linker is probably an open source project.

    This brings us to the question what do all these backdoors really mean for open source? It isn’t going to mean anything in most instances. There’s a lot happening that’s not well understood yet, and no doubt we’ll see more changes in the future as we understand the problem better. I think there’s a tendency to try to overcorrect when something new happens, in this case I’m not sure we can overcorrect even if we want to.

    The first and most important point is to understand that a huge number of open source projects are a couple of people who are doing this for fun. They’re not security experts, they will never be security experts. They’re also not going to adopt some complex security process. If they get a nice looking pull request they’ll probably merge it. Security isn’t on the top of their list when working on the project. The whole point of their project is to solve some sort of problem. While I’m sure many would love getting a few donations, it’s a steep climb to being able to work on your open source library full time. The reality is these project will always be hobbies.

»

More in Tux Machines

digiKam 7.7.0 is released

After three months of active maintenance and another bug triage, the digiKam team is proud to present version 7.7.0 of its open source digital photo manager. See below the list of most important features coming with this release. Read more

Dilution and Misuse of the "Linux" Brand

Samsung, Red Hat to Work on Linux Drivers for Future Tech

The metaverse is expected to uproot system design as we know it, and Samsung is one of many hardware vendors re-imagining data center infrastructure in preparation for a parallel 3D world. Samsung is working on new memory technologies that provide faster bandwidth inside hardware for data to travel between CPUs, storage and other computing resources. The company also announced it was partnering with Red Hat to ensure these technologies have Linux compatibility. Read more

today's howtos

  • How to install go1.19beta on Ubuntu 22.04 – NextGenTips

    In this tutorial, we are going to explore how to install go on Ubuntu 22.04 Golang is an open-source programming language that is easy to learn and use. It is built-in concurrency and has a robust standard library. It is reliable, builds fast, and efficient software that scales fast. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel-type systems enable flexible and modular program constructions. Go compiles quickly to machine code and has the convenience of garbage collection and the power of run-time reflection. In this guide, we are going to learn how to install golang 1.19beta on Ubuntu 22.04. Go 1.19beta1 is not yet released. There is so much work in progress with all the documentation.

  • molecule test: failed to connect to bus in systemd container - openQA bites

    Ansible Molecule is a project to help you test your ansible roles. I’m using molecule for automatically testing the ansible roles of geekoops.

  • How To Install MongoDB on AlmaLinux 9 - idroot

    In this tutorial, we will show you how to install MongoDB on AlmaLinux 9. For those of you who didn’t know, MongoDB is a high-performance, highly scalable document-oriented NoSQL database. Unlike in SQL databases where data is stored in rows and columns inside tables, in MongoDB, data is structured in JSON-like format inside records which are referred to as documents. The open-source attribute of MongoDB as a database software makes it an ideal candidate for almost any database-related project. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the MongoDB NoSQL database on AlmaLinux 9. You can follow the same instructions for CentOS and Rocky Linux.

  • An introduction (and how-to) to Plugin Loader for the Steam Deck. - Invidious
  • Self-host a Ghost Blog With Traefik

    Ghost is a very popular open-source content management system. Started as an alternative to WordPress and it went on to become an alternative to Substack by focusing on membership and newsletter. The creators of Ghost offer managed Pro hosting but it may not fit everyone's budget. Alternatively, you can self-host it on your own cloud servers. On Linux handbook, we already have a guide on deploying Ghost with Docker in a reverse proxy setup. Instead of Ngnix reverse proxy, you can also use another software called Traefik with Docker. It is a popular open-source cloud-native application proxy, API Gateway, Edge-router, and more. I use Traefik to secure my websites using an SSL certificate obtained from Let's Encrypt. Once deployed, Traefik can automatically manage your certificates and their renewals. In this tutorial, I'll share the necessary steps for deploying a Ghost blog with Docker and Traefik.

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6