Language Selection

English French German Italian Portuguese Spanish

Security of open-source software again being scrutinized

Filed under
OSS

A recent round of flaws discovered in open-source software has reignited concerns that security is getting bypassed in the rush to continue expanding the large and extremely popular code base used by millions.

For instance, although the Java-based Spring Framework was criticized by security researchers in January as having a major flaw that allowed remote-code execution by attackers against applications built with it, the updates to Spring this week don't address this security problem.

"Unfortunately, this is the way a lot of open source vulnerabilities go," said Jeff Williams, CEO at Aspect Security, which pointed out two months ago that the "expression-language" feature in Spring should be disabled until the issue related to potential remote code execution is remediated. But the updates to Spring out this week don't address this problem, though they do expand Spring functionality. Spring Framework is managed under SpringSource, a division of VMware.

rest here




More in Tux Machines

Xubuntu 15.04 Vivid Vervet - Fabulous

I have to say, Xubuntu 15.04 Vivid Vervet shattered my expectations. Obliterated them. Overall, I was expecting a distro that would be about as good as its parent. Instead, I got this fine piece of digital machinery, which purrs and meows and growls like a turbo-charged tiger, if this silly metaphor makes any sense. Or is it an analogy? Now, one tiny software glitch, plus one big regression that affects the entire family. That's the sum of my complains. On the plus side, Xubuntu fully supports the hardware, including the tricky UEFI stuff, it's fast, robust, elegant, rich in software and features, simple and fun to use, and it works well with anything I've thrown at it. By far the best distro of this year. I don't give out 10/10 lightly, but I'm inclined to do that right now, even though the few tiny problems we've had prevent me from doing that. However, the whole package reminds me of Fuduntu, really. Pure and simple and just good. 9.99999/10. Try it, you won't be disappointed. We're done here. Read more

Akanda Pledges to Keep SDN Tech for OpenStack Open-Source

Rosendahl emphasized that Akanda was born as open-source software and will remain open-source. From a commercial perspective what Akanda provides to enterprises is support and professional services. Read more

A New Firefox OS phone

Last Monday, I bought the phone anyway. I must say that I am very pleased by its performance and very cheap price. One can swap the SIM card to use the phone with another carrier here, too. Read more

Yet Another Convergence Demo: Desktop, Phone And Tablet All Running Ubuntu

Canonical’s endgame is to create a full desktop-mobile convergent system, to run the same code-base on Ubuntu Desktop, Ubuntu Phone and Internet of Things devices. Also, the user interface is responsive, adjusting itself to fit best the screen. Read more