Language Selection

English French German Italian Portuguese Spanish

GnuTLS: Big internal bugs, few real-world problems

Filed under

According to some reports you'd think the security sky was falling. Yes, GnuTLS, an open-source "secure" communications library that implements \Secure-Socket Layer (SSL) and Transport Layer Security (TLS), has serious flaws. The good news? Almost no one uses it. OpenSSL has long been everyone's favorite open-source security library of choice.

Read more ►

More in Tux Machines


  • Managing OpenStack with Open Source Tools
    Day 2 operations are still dominated by manual and custom individual scripts devised by system administrators. Automation is needed by enterprises. Based on the above analysis, Ansible is a leading open source project with a high number contributions and a diverse community of contributions. Thus Ansible is a well supported and popular open source tool to orchestrate and manage OpenStack.
  • Databricks Weaves Deep Learning into Cloud-Based Spark Platform
    Databricks, a company founded by the creators of the popular open-source Big Data processing engine Apache Spark, is a firm that we've been paying close attention to here at OStatic. We're fans of the company's online courses on Spark, and we recently caught up with Kavitha Mariappan, who is Vice President of Marketing at the company, for a guest post on open source tools and data science. Now, Databricks has announced the addition of deep learning support to its cloud-based Apache Spark platform. The company says this enhancement adds GPU support and integrates popular deep learning libraries to the Databricks' big data platform, extending its capabilities to enable the rapid development of deep learning models. "Data scientists looking to combine deep learning with big data -- whether it's recognizing handwriting, translating speech between languages, or distinguishing between malignant and benign tumors -- can now utilize Databricks for every stage of their workflow, from data wrangling to model tuning," the company reports, adding "Databricks is the first to integrate these diverse workloads in a fast, secure, and easy-to-use Apache Spark platform in the cloud."
  • OpenStack Building the Cloud for the Next 50 Years (and Beyond)
    Two OpenStack Foundation executives talk about what has gone wrong, what has gone right and what's next for the open-source cloud. BARCELONA, Spain—When OpenStack got started in 2010, it was a relatively small effort with only two companies involved. Over the last six years, that situation has changed dramatically with OpenStack now powering telecom, retail and scientific cloud computing platforms for some of the largest organizations in the world.
  • The Myth of the Root Cause: How Complex Web Systems Fail
    Complex systems are intrinsically hazardous systems. While most web systems fortunately don’t put our lives at risk, failures can have serious consequences. Thus, we put countermeasures in place — backup systems, monitoring, DDoS protection, playbooks, GameDay exercises, etc. These measures are intended to provide a series of overlapping protections. Most failure trajectories are successfully blocked by these defenses, or by the system operators themselves.
  • How to assess the benefits of SDN in your network
    Software-defined networking has matured from a science experiment into deployable, enterprise-ready technology in the last several years, with vendors from Big Switch Networks and Pica8 to Hewlett Packard Enterprise and VMware offering services for different use cases. Still, Nemertes Research's 2016 Cloud and Data Center Benchmark survey found a little more than 9% of organizations now deploying SDN in production.

Security News

  • GNU Tar "Pointy Feather" Vulnerability Disclosed (CVE-2016-6321)
    Last week was the disclosure of the Linux kernel's Dirty COW vulnerability while the latest high-profile open-source project going public with a new security CVE is GNU's Tar. Tar CVE-2016-6321 is also called POINTYFEATHER according to the security researchers. The GNU Pointy Feather vulnerability comes down to a pathname bypass on the Tar extraction process. Regardless of the path-name(s) specified on the command-line, the attack allows for file and directory overwrite attacks using specially crafted tar archives.
  • Let’s Encrypt and The Ford Foundation Aim To Create a More Inclusive Web
    Let’s Encrypt was awarded a grant from The Ford Foundation as part of its efforts to financially support its growing operations. This is the first grant that has been awarded to the young nonprofit, a Linux Foundation project which provides free, automated and open SSL certificates to more than 13 million fully-qualified domain names (FQDNs). The grant will help Let’s Encrypt make several improvements, including increased capacity to issue and manage certificates. It also covers costs of work recently done to add support for Internationalized Domain Name certificates. “The people and organizations that Ford Foundation serves often find themselves on the short end of the stick when fighting for change using systems we take for granted, like the Internet,” Michael Brennan, Internet Freedom Program Officer at Ford Foundation, said. “Initiatives like Let’s Encrypt help ensure that all people have the opportunity to leverage the Internet as a force for change.”
  • How security flaws work: SQL injection
    Thirty-one-year-old Laurie Love is currently staring down the possibility of 99 years in prison. After being extradited to the US recently, he stands accused of attacking systems belonging to the US government. The attack was allegedly part of the #OpLastResort hack in 2013, which targeted the US Army, the US Federal Reserve, the FBI, NASA, and the Missile Defense Agency in retaliation over the tragic suicide of Aaron Swartz as the hacktivist infamously awaited trial.
  • How To Build A Strong Security Awareness Program
    At the Security Awareness Summit this August in San Francisco, a video clip was shown that highlights the need to develop holistic security awareness. The segment showed an employee being interviewed as a subject matter expert in his office cubicle. Unfortunately, all his usernames and passwords were on sticky notes behind him, facing the camera and audience for all to see. I bring this story up not to pick on this poor chap but to highlight the fact that security awareness is about human behavior, first and foremost. Understand that point and you are well on your way to building a more secure culture and organization. My work as director of the Security Awareness Training program at the SANS Institute affords me a view across hundreds of organizations and hundreds of thousands of employees trying to build a more secure workforce and society. As we near the end of this year's National Cyber Security Awareness Month, here are two tips to incorporate robust security awareness training into your organization and daily work.

What comes after ‘iptables’? It’s successor, of course: `nftables`

Nftables is a new packet classification framework that aims to replace the existing iptables, ip6tables, arptables and ebtables facilities. It aims to resolve a lot of limitations that exist in the venerable ip/ip6tables tools. The most notable capabilities that nftables offers over the old iptables are: Read more

Linux 4.8.5

I'm announcing the release of the 4.8.5 kernel. All users of the 4.8 kernel series must upgrade. The updated 4.8.y git tree can be found at: git:// linux-4.8.y and can be browsed at the normal git web browser: Read more Also: Linux 4.4.28