Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Submission + - Google Admits that Google.com is Dangerous (eweek.com)

darthcamaro writes: For over a decade, Google's Safe Browsing technology has helped to alert users to dangerous site, where malware and phishing exploits can be found. Apparently one of those unsafe sites is none other than Google.com itself.

Google's automatic spidering of the Web will catch some malicious sites, and by Google's own admission, there are sites in its index that will redirect users to locations that will attempt to install malware on their computers. Google also admits and warns that by way of Google.com (and the sites linked in its index), "Attackers on this site might try to trick you to download software or steal your information (for example passwords, messages, or credit card information)."


Comment Red Hat has a different view - and it's not hype (Score 3, Informative) 21

I don't know much about Windows and there there are 12 other advisories more impactful that Badlock this month - but Red Hat is and has taken the Linux related vulnerabilities *very* seriously - which is a good thing, it means no shellshocked/heartbleed repeat, patches on time and no real risk.

"Working closely with the community over many months, Red Hat engineers have been heavily involved in the process of analyzing and developing Samba patches for Badlock-associated issues," Josh Bressers, security strategist at Red Hat sad.

Submission + - Heartbleed Turns Two -Has Anything Changed? (eweek.com)

darthcamaro writes: Two years ago on April 7 2014, the Heartbleed vulnerability on OpenSSL was first disclosed, arguably changing the open-source security world in many ways. For one there is now an unfortunate trend of security vendors branding vulnerabilities. On a more positive note though is the emergence of more rigor in open-source code auditing, thanks in part to the effort of the Linux Foundation's Core Infrastructure Initiative (CII).

"OpenSSL now has a well-known and published approach for how it will appropriately inform all interested parties of security advisories," Emily Ratliff, senior director of infrastructure security at The Linux Foundation, told eWEEK. "Even trivial patches must follow the review process."


Submission + - OpenStack Mitaka Debuts (eweek.com)

darthcamaro writes: The 13th release of OpenStack, codenamed Mitaka is now generally available, with updates across all major projects. Among the biggest new capabilities in OpenStack Mitaka however isn't a new project or a new featue in a single existing project, but rather the official debut of the OpenStack Client, which creates for the first time a unified command line interface to control the cloud.

"The OpenStack client is a command line client that unifies access across all the main projects," Jonathan Bryce, executive director of the OpenStack Foundation, said.
So if an administrator wants to create a user, a block storage device or a virtual server, or attach to a network, all those functions are now enabled in the single tool that is the OpenStack client. The OpenStack client provides a standardized set of commands, whereas previously, each project had its own command line client, Bryce said. He added that the OpenStack client can be run locally or in the cloud, and can be configured to control multiple OpenStack clouds.


Submission + - Comodo CEO Not Afraid of Google Project Zero (eweek.com)

darthcamaro writes: Google Project Zero researchers have aggressively been going after Comodo anti-virus and security tech in recent week. Now Comodo's CEO is shooting back saying that his company believes in responsible disclosure. He also noted that Comodo is set to debut its own bug bounty program at some point soon.

Submission + - Mozilla Takes Tab Candy Away from Firefox Users (eweek.com)

darthcamaro writes: While most modern web browsers are busy adding news features for users, Mozilla is taking them away. In the new Firefox 45 milestone, Mozilla has decided to remove the Tab Groups features, previously known as Panorama and originally started as the Mozilla Labs Tab Candy project.

"The primary reason for discontinuing the feature is low usage," Nick Nguyen, vice president of Firefox Product at Mozilla said.


Submission + - Pwn2Own 2016 Won't Attack Firefox (cause it's too easy!) (eweek.com) 1

darthcamaro writes: For the last decade, the Pwn2own hacking competition has pitted the world's best hackers against web browsers to try and find zero-day vulnerabilities in a live event. The contest, which is sponsored by HPE and TrendMicro this year is offering over half a million dollars in prize money, but for the first time, not a penny of that will directed to Mozilla Firefox. While Microsoft Edge, Google Chrome and Apple Safari are targets, Firefox isn't because it's apparently too easy and not keeping up with modern security.

"We wanted to focus on the browsers that have made serious security improvements in the last year," Brian Gorenc, manager of Vulnerability Research at HPE said.


Submission + - CoreOS Launches Rkt 1.0 (eweek.com)

darthcamaro writes: Docker is about to get some real competition in the container runtime space, thanks to the official launch of rkt 1.0. CoreOS started building rkt in 2014 and after more than a year of security, performance and feature improvement are now ready to declare it 'production-ready.' While rkt is a docker runtime rival, docker apps will run in rkt, giving using a new runtime choice.

rkt will remain compatible with the Docker-specific image format, as well as its own native App Container Image (ACI). That means developers can build containers with Docker and run those containers with rkt. In addition, CoreOS will support the growing ecosystem of tools based around the ACI format.


Submission + - Docker 1.10 Brings Linux SECCOMP Security to Containers (eweek.com)

darthcamaro writes: Starting this week, there is a new tool in the toolbox to secure Docker containers. In addition to SELinux (or AppArmor) and Namespaces — Docker 1.10 will now include a default SECCOMP profile. So what's the difference between SECCOMP and SELinux?

SELinux is the list of people you can talk to, while seccomp is the list of what words you can say, McCarty said. As an example, if a person could communicate with another person using only three or five words, it would very much limit what could be expressed and prevent most types of illicit activities, and applies in much the same way to Linux containers, he added.


Submission + - Docker Inc Acquires Unikernels, but that's Not the End for Linux (eweek.com)

darthcamaro writes: Docker Inc today announced that it is acquiring privately held Unikernel Systems. With a Unikernel, there is not need for a full general purpose operating system, like Linux, instead an application can be built together with its own OS-like libraries. While some might see this as a big challenge for Linux, Solomon Hykes, founder of Docker doesn't quite see it that way.

"It's not an either/or situation with unikernels, and for the foreseeable future, the vast majority of Docker containers will run on Linux," Hykes said. "We're big believers in Linux, and you should expect more Linux-oriented work to come from us."


Submission + - Is Docker Making any Money? (eweek.com)

darthcamaro writes: You can't go to any technology conference today without hearing the word Docker or containers. Docker is everywhere, but is anyone actually making money from it? Or is it another multi-billion dollar unicorn boondoggle? According to a newly posted video interview with Docker Inc CEO Ben Golub, Docker isn't yet profitable — but it will be — soon. As a freely available open-source technology many companies start with Docker in pilot projects.

"A lot of those pilots are now turning into serious revenue, which is nice," Golub said. "While we're certainly not profitable yet, I think what we're building is the foundation for a profitable business."


Submission + - Shuttleworth Says Snappy Won't Replace .deb Linux Package Files in Ubuntu 15.10 (serverwatch.com)

darthcamaro writes: Mark Shuttleworth, BDFL of Ubuntu is clearing the air about how Ubuntu will make use of .deb packages even in an era where it is moving to its own Snappy ('snaps') format of rapid updates. Fundamentally it's a chicken and egg issue.

We build Snappy out of the built deb, so we can't build Snappy unless we first build the deb," Shuttleworth said.


Submission + - Mozilla Admits Bugzilla Breached - as far back as 2013 (eweek.com)

darthcamaro writes: Mozilla today publicly admitted that secured areas of bugzilla, where non-public zero days are stored, was accessed by an attacker. The attacker got access to as many as 185 security bugs before they were made public. The whole hack raises the issue of Mozilla's own security, since it was a user password that was stolen and the bugzilla accounts weren't using two-factor authentication.

Submission + - Linux Foundation Chief Say that It's 'FUN' to Work with Microsoft (eweek.com)

darthcamaro writes: Though Jim Zemlin, executive director of the Linux Foundation was heckled at Linuxcon for holding up a Tux penguin with a Microsoft logo — he's supportive of Microsoft's open source efforts. .

"Don't hold it [the Microsoft penguin]," an audience member shouted. "You might get cancer."


Submission + - Linus Torvalds Isn't Looking 10 years Ahead for Linux and That's OK (eweek.com)

darthcamaro writes: At the Linuxcon conference in Seattle today, Linus Torvalds responded to questions about Linux security and about the next 10 years of Linux. For security, Torvalds isn't too worried as he sees it just being about dealing with bugs. When it comes to having a roadmap he's not worried either as he just leaves that to others.

"I'm a very plodding, pedestrian person and look only about six months ahead," Torvalds said. "I look at the current release and the next one, as I don't think planning 10 years ahead is sane."


Slashdot Top Deals

Neutrinos have bad breadth.

Working...