Trailrunner7 writes "In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running 'javaws.exe' without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google's Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response."
dnaumov writes "FreeNAS, a popular, free NAS solution, is moving away from using FreeBSD as its underlying core OS and switching to Debian Linux. Version 0.8 of FreeNAS as well as all further releases are going to be based on Linux, while the FreeBSD-based 0.7 branch of FreeNAS is going into maintenance-only mode, according to main developer Volker Theile. A discussion about the switch, including comments from the developers, can be found on the FreeNAS SourceForge discussion forum. Some users applaud the change, which promises improved hardware compatibility, while others voice concerns regarding the future of their existing setups and lack of ZFS support in Linux."