Language Selection

English French German Italian Portuguese Spanish

Security: EFAIL Hype, Kubernetes, 'Smart' Things and More

Filed under
Security
  • Serious vulnerabilities with OpenPGP and S/MIME

    The efail.de site describes a set of vulnerabilities in the implementation of PGP and MIME that can cause the disclosure of encrypted communications, including old messages. "In a nutshell, EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs."

  • How the Kubernetes Security Response Team Works

    The open-source Kubernetes container orchestration is an increasingly deployed platform that is now supported across all three major public cloud providers (Google, AWS and Azure) as well as enterprise private clouds.

    Container security is a big issue these days, and keeping Kubernetes secure involves multiple aspects. One of those aspects is the security of the Kubernetes code itself, which has had its share of vulnerabilities that have been reported in the past year. Among those vulnerabilities is CVE-2017-1002101, which was patched in the Kubernetes 1.10 release that became generally available on March 26.

  • Ring doorbell flaw lets others watch after password changes (updated)

    The issue, as you might guess, is that the window exists in the first place. Someone with a still-valid login could not only spy on whatever's happening, but download videos. The same incident that prompted the change also included phantom rings in the middle of the night.

  • Security Innovation Supports Open Source Community with Free Security Tools to Identify and Mitigate Software Vulnerabilities

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

It Turns Out RISC-V Hardware So Far Isn't Entirely Open-Source

While they are trying to make it an open board, as it stands now Minnich just compares this RISC-V board as being no more open than an average ARM SoC and not as open as IBM POWER. Ron further commented that he is hoping for other RISC-V implementations from different vendors be more open. Read more

Perl 5.28.0 released

Version 5.28.0 of the Perl language has been released. "Perl 5.28.0 represents approximately 13 months of development since Perl 5.26.0 and contains approximately 730,000 lines of changes across 2,200 files from 77 authors". The full list of changes can be found over here; some highlights include Unicode 10.0 support, string- and number-specific bitwise operators, a change to more secure hash functions, and safer in-place editing. Read more

Today in Techrights

Will Microsoft’s Embrace Smother GitHub?

Microsoft has had an adversarial relationship with the open-source community. The company viewed the free Open Office software and the Linux operating system—which compete with Microsoft Office and Windows, respectively—as grave threats. In 2001 Windows chief Jim Allchin said: “Open source is an intellectual-property destroyer.” That same year CEO Steve Ballmer said “Linux is a cancer.” Microsoft attempted to use copyright law to crush open source in the courts. When these tactics failed, Microsoft decided if you can’t beat them, join them. It incorporated Linux and other open-source code into its servers in 2014. By 2016 Microsoft had more programmers contributing code to GitHub than any other company. The GitHub merger might reflect Microsoft’s “embrace, extend and extinguish” strategy for dominating its competitors. After all, GitHub hosts not only open-source software and Microsoft software but also the open-source projects of other companies, including Oracle, IBM, and Amazon Web Services. With GitHub, Microsoft could restrict a crucial platform for its rivals, mine data about competitors’ activities, target ads toward users, or restrict free services. Its control could lead to a sort of surveillance of innovative activity, giving it a unique, macro-scaled insight into software development. Read more