Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Submission + - xz/liblzma Backdoored, Facilitating ssh Compromise

ewhac writes: A backdoor has been discovered in the liblzma data compression library, whose purpose is to facilitate a compromise of ssh. liblzma versions 5.6.0 and 5.6.1 are known to be affected. Debian's "unstable" and "testing" repos yesterday rolled back the library by pushing version "5.6.1+really5.4.5-1" to mitigate the exposure. RedHat is also recommending all users roll back to a pre-5.6.0 release.

The backdoor is not in the source code, but rather is in the test suite contained in the distribution tarballs. Hostile payloads masquerading as test data are decompressed during the ./configure phase to modify the Makefile and drop modified versions of liblzma_la-crc32_fast.o and liblzma_la-crc64_fast.o. When the compromised library is loaded by client programs (such as ssh), these in turn install an audit hook in the dynamic linker, allowing them to intercept lookups/calls to RSA_public_decrypt@....plt, which it then replaces with its own code. This compromise appears to have only been discovered in the last few days; study of the precise nature and scope of the compromise is ongoing.

Comment Re:What else should the government save? (Score 1) 262

Phone booths have been replaced by cell phones

Ah, but a homeless person cannot hide from the rain in his cell-phone! Ergo, we must fund the phone booths!

Paper books replaced clay tablets and should be saved.

Saved by the government?

What will completely replace AM radio?

Replace in what?

If not radio waves

Oh, it would still be radio waves, I'm sure. WiFi, LTE....

Comment Re:Bah (Score 2) 110

You do realize that the entire population of Israel is not superstitious

Superstitions — like fears of number 13 and black cats — are what people resort to, when religion is taken from them :-)

Many Israelis don't give a flying fuck what rabbis say.

Most care, though.

What you could've pointed out is that it is not wrong for observant Jews to produce non-Kosher foods — as long as they don't eat them. That would've been a valid point.

But you didn't — such was your urge to attack the religious, it blinded you to anything else :)

Comment Still not Kosher (Score 1) 110

The eel meat was produced by Forsea Foods in Israel

The rules of Kosher are simple: if it lives in the water, it must have scales to be edible. This excludes eel (as well as crab, lobster, oysters, sturgeon and catfish)...

Now lab-grown could work — because it is fake — but, given rabbinate's earlier refusal to approve fake pork, I doubt, they'll approve fake eel either. Then again, fake crab is fine — because it is made from regular (scaly) fish...

Comment XFCE4 on FreeBSD (Score 4, Interesting) 155

And the article also points out that one of those early Unix desktops "is still alive, well ...

My XFCE4-desktop is awesome, thank you very much. Last uptime was 386 days — and it only went down, because the video card's fan stopped working...

Firefox, Thunderbird, and Libreoffice have to be recompiled on occasion, but that's nothing compared to the forced biweekly reboots my corporate desktop is undergoing — running the OS, that is alleged to have "won"...

Comment Re:Just imagine... (Score 1) 96

The government isn't paying a witness. It's buying information to find a crime.

Nonsense. Paid informants would often alert police to crimes, that cops didn't know about either.

linked to life experience

I'm not that old :-)

Read the article that your link points too.

My link points to the story of one (in)famous paid informant. Christians — and all of the Founders were such — universally disapproved of the man, but the practice of paying such people for their aid to law-enforcement was not banned by them.

Comment Re:Just imagine... (Score 1) 96

Exactly, as he said it was unimaginable that a private entity could harvest this information. Yes at great cost for one person, completely unimaginable to do it for the entire population, even the paper to write it down would have bankrupted them.

It was just as unimaginable for a government — any government — to amass it too.

Yet, the concept of using paid informants was known for millennia — and none of the Founders thought about forbidding their use.

Comment Re:Just imagine... (Score 1) 96

At the time of the constitution it was unimaginable that a private entity could harvest this information.

The concept of "private detective" existed for centuries.

If Sherlock Holmes (fictional) and Pinkerton (very real) could sniff out information, why couldn't the government then obtain it from them? Perry Mason wouldn't get anywhere without his trusty private detective agency — with office on the same floor as his own. Hired by the clients — who'd inevitably be falsely accused of murder — they had to share information with police on pain of losing their licenses. Such was already the state of affairs in the 1930-ies!

If today's technology existed back then and we followed the spirit of why the constitution was written I can guarantee that this would be illegal

Sounds like an attempt — an unconstitutional attempt — to ascribe to the Constitution, what is not there...

Finally, how is "buying information from data-brokers" different — in principle — from obtaining it from paid informants?

Comment Re:Just imagine... (Score 1) 96

Unconstitutional activity is still unconstitutional even if the government pays a third party to do it.

Could you cite the part of the Constitution being violated here?

You cannot. The whole problem is that there is nothing illegal — much less unconstitutional — about it all.

It makes sense logically too — if a private dick can know it, why can't the government buy it from him?

Submission + - Russia's Wikipeida Replacement "Ruwiki" Is Now Live (nypost.com)

An anonymous reader writes: Ruwiki, the Russian government approved replacement for Wikipedia, has reportedly gone live. Ruwiki was originally approved in May 2022 and has been in beta testing since mid 2023. The contents of Ruwiki reflects Russian government positions and reportedly incorporate more Russia specific content than Wikipedia. The Russian government is reported to have put substantial resources into the Ruwiki project. Wikipedia itslef has been repeatedly fined by Russian courts for hosting online content contrary to Russian law, much of it regarding the 2022 invasion of Ukraine which is referred to by the Russian government as a "Special Military Operation.". If Wikipedia is blocked it will further isolate Russians and cut off one of the last major independent sources of information still available to them.

Comment Re:2010 - 2016 (Score 0) 194

You don't think not leaving the house for months might have had something to do with it?

Which athletes weren't doing — sportsmen continue exercising every day — and yet, they also saw a dramatic increase of heart problems following the vaccination drive. The articles reporting on this rarely mention vaccinations (because the Faucis in government will will quickly pull their grants in retaliation), but we all remember, how athletes weren't allowed to compete without one...

And the Associated Press' "fact check" is just pathetic, confirming, rather than rebutting the claim.

Slashdot Top Deals

"The medium is the massage." -- Crazy Nigel

Working...