Language Selection

English French German Italian Portuguese Spanish

Opera on Handling Security

Filed under
Security

Recently, some of our users have asked why we chose to disclose a potential security issue only after the release of Opera 9.10. Let me try to give a short overview on how security issues get reported and disclosed - and not only at Opera, but in most applications: it might help some people to understand how this works.

When somebody discovers a vulnerability in an application, they should report it to the vendor. It can happen that the reporters give a deadline by when they want to make full disclosure of the vulnerability, but usually the reporter and the vendor work out a disclosure date that makes both happy. If the exploit is not clear, both work on details and a PoC (proof of concept). When a fix has been made and a public release is available, both the reporter and the vendor publish an advisory. The vendor usually credits the reporter in the advisory for the discovery of the vulnerability.

It is important that both parties do respect each other: if a fix is included also in development snapshot builds that reach a public audience (like the weekly builds on this blog), fixes for the vulnerability are not announced: this is a form of respect both for the reporter and for all the users that only upgrade to stable releases. Making the vulnerability public knowledge before a stable version fixes the issue would leave lots of users vulnerable. Serious reporters do not announce vulnerabilities before vendors have a fix in public builds - and vendors do not announce vulnerabilities before the reporters makes their discovery public, in order to properly credit them.

Full Story.

More in Tux Machines

more of today's howtos

Leftovers: OSS and Sharing

Microsoft Begs, Bugs, and Bug Doors

  • Don't install our buggy Windows 10 Creators Update, begs Microsoft
    Microsoft has urged non-tech-savvy people – or anyone who just wants a stable computer – to not download and install this year's biggest revision to Windows by hand. And that's because it may well bork your machine. It's been two weeks since Microsoft made its Creators Update available, and we were previously warned it will be a trickle-out rather than a massive rollout. Now, Redmond has urged users to stop manually fetching and installing the code, and instead wait for it to be automatically offered to your computer when it's ready.
  • Microsoft Word flaw took so long to fix that hackers used it to send fraud software to millions of computers
    A flaw in Microsoft Word took the tech giant so long to fix that hackers were able to use it to send fraud software to millions of computers, it has been revealed. The security flaw, officially known as CVE-2017-0199, could allow a hacker to seize control of a personal computer with little trace, and was fixed on April 11 in Microsoft's regular monthly security update - nine months after it was discovered.

FOSS Licensing (and Lack Thereof)

  • Portugal to harmonise usability of govt portals
    All of the code, information and tools are made available for reuse.
  • JRC: ‘Releasing code without a licence hinders reuse’
    Projects that publish source code without a licence weaken the reusability of their code, warns Stefano Gentile, a copyright and trademark specialist working for the European Commission’s Joint Research Centre (JRC). Currently just 20 % of all projects published on GitHub, one of the most popular source code sharing platforms, have selected a licence for their work - down from about 60% in 2008, Gentile said, quoting numbers published in 2015 by GitHub.
  • React to React
    The Additional Grant of Patent Rights is a patent license grant that includes certain termination criteria. These termination criteria are not entirely unprecedented when you look at the history of patent license provisions in OSI-approved licenses, but they are certainly broader than the termination criteria [or the equivalent] in several familiar modern licenses (the Apache License 2.0, EPL, MPL 2.0, and GPLv3).
  • BetConstruct declares the source code for its front-end as open source
    The project is distributed under MIT license.