Security Leftovers

-
Security updates for Monday [LWN.net]
Security updates have been issued by Debian (chromium, golang-1.7, golang-1.8, pillow, qtsvg-opensource-src, util-linux, and wordpress), Fedora (expat, harfbuzz, kernel, qt5-qtsvg, vim, webkit2gtk3, and zabbix), Mageia (glibc, kernel, and kernel-linus), openSUSE (bind, chromium, and zxing-cpp), Oracle (kernel), Red Hat (java-11-openjdk and kpatch-patch), Scientific Linux (java-11-openjdk), SUSE (bind, clamav, zsh, and zxing-cpp), and Ubuntu (aide, dbus, and thunderbird).
-
LogJ4 Security Inquiry – Response Required
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy.
The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows?
My guess is that they do this for some compliance reasons and they “forgot” that their open source components are not automatically provided by “partners” they can just demand this information from.
I answered the email very briefly and said I will be happy to answer with details as soon as we have a support contract signed.
I think maybe this serves as a good example of the open source pyramid and users in the upper layers not at all thinking of how the lower layers are maintained. Building a house without a care about the ground the house stands on.
I believe this email is genuine and my reply was directed to a big-company .com email address domain that did not bounce. In my tweet and here in my blog post I redact the name of the company. I most probably have the right to tell you who they are, but I still prefer to not. (Especially if I manage to land a profitable business contract with them.) I suspect we can find this level of entitlement in many companies.
-
Trend Micro : Analysis and Impact of LockBit Ransomware's First Linux and VMware ESXi Variant [Ed: Ransomware is predominantly a Windows issue, but there are attempts to shift attention and manipulate perceptions]
The release of this variant is in line with how modern ransomware groups have been shifting their efforts to target and encrypt Linux hosts such as ESXi servers. An ESXi server typically hosts multiple VMs, which in turn hold important data or services for an organization. The successful encryption by ransomware of ESXi servers could therefore have a large impact on targeted companies. This trend was spearheaded by ransomware families like REvil and DarkSide.
-
- Login or register to post comments
Printer-friendly version
- 1530 reads
PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
Openwashing and Linux Foundation
| Android Leftovers
|
Stay Organized With These 7 Calendar Apps for Linux
Keep track of time and events while working on your desktop using these must-have calendar apps for Linux.
Calendar apps are a necessity for keeping track of events and your to-do tasks in this hectic modern work life. These apps can help you never forget anything again.
The calendar apps available for Linux have a lot of handy productivity features that will help you remember stuff, suggest important dates, and help build good habits.
| Games: 3000 Games On The Steam Deck, The Legend of Zelda: Ocarina of Time, 5 Best 3D Games for GNU/Linux
|
Recent comments
1 hour 26 min ago
1 hour 45 min ago
6 hours 59 min ago
7 hours 23 min ago
10 hours 31 min ago
10 hours 42 min ago
10 hours 44 min ago
18 hours 28 min ago
20 hours 13 min ago
21 hours 55 min ago