Sorry, you need to enable JavaScript to visit this website.

Feed aggregator

Linus Torvalds On Git's Use Of SHA-1: 'The Sky Isn't Falling'

Slashdot - 39 min 33 sec ago
Google's researchers specifically cited Git when they announced a new SHA-1 attack vector, according to ZDNet. "The researchers highlight that Linus Torvald's code version-control system Git 'strongly relies on SHA-1' for checking the integrity of file objects and commits. It is essentially possible to create two Git repositories with the same head commit hash and different contents, say, a benign source code and a backdoored one,' they note." Saturday morning, Linus responded: First off - the sky isn't falling. There's a big difference between using a cryptographic hash for things like security signing, and using one for generating a "content identifier" for a content-addressable system like git. Secondly, the nature of this particular SHA1 attack means that it's actually pretty easy to mitigate against, and there's already been two sets of patches posted for that mitigation. And finally, there's actually a reasonably straightforward transition to some other hash that won't break the world - or even old git repositories... The reason for using a cryptographic hash in a project like git is because it pretty much guarantees that there is no accidental clashes, and it's also a really really good error detection thing. Think of it like "parity on steroids": it's not able to correct for errors, but it's really really good at detecting corrupt data... if you use git for source control like in the kernel, the stuff you really care about is source code, which is very much a transparent medium. If somebody inserts random odd generated crud in the middle of your source code, you will absolutely notice... It's not silently switching your data under from you... And finally, the "yes, git will eventually transition away from SHA1". There's a plan, it doesn't look all that nasty, and you don't even have to convert your repository. There's a lot of details to this, and it will take time, but because of the issues above, it's not like this is a critical "it has to happen now thing". In addition, ZDNet reports, "Torvalds said on a mailing list yesterday that he's not concerned since 'Git doesn't actually just hash the data, it does prepend a type/length field to it', making it harder to attack than a PDF... Do we want to migrate to another hash? Yes. Is it game over for SHA-1 like people want to say? Probably not."

Read more of this story at Slashdot.

Seven Film Studios Want 41 Web Sites Blocked By Australian ISPs

Slashdot - 1 hour 39 min ago
angry tapir writes: A group of film studios is undertaking what is set to be the most significant use so far of Australia's anti-piracy laws, which allow rights holders to apply for court orders that can compel ISPs to block their customers from accessing certain piracy-linked sites. A pair of rights holders last year successfully obtained court orders forcing Australia's most popular ISPs to block a handful of sites including The Pirate Bay. Now Village Roadshow wants to have 41 more sites blocked. Village Roadshow joined six other studios in requesting an injunction Friday in federal court, reports Computerworld. And meanwhile, "a separate site-blocking application has been launched by Australian music labels, which are seeking to have Telstra, Optus, TPG and Foxtel's broadband arm block access to Kickass Torrents."

Read more of this story at Slashdot.

Garmin Engineer Shot And Killed By Man Yelling 'Get Out Of My Country!'

Slashdot - 2 hours 39 min ago
lxw56 writes: Garmin engineer Srinivas Kuchibhotla was shot and killed at a local bar in Olathe, Kansas, the U.S. headquarters of Garmin. Co-worker Alok Madasani was also injured along with bystander Ian Grillot, who attempted to help the men. "The suspect in the shooting, Adam Purinton, was drinking at the bar in Olathe, Kansas, at about 7:15 p.m. that night," reports The Verge. "A witness said he yelled 'get out of my country' to two of the victims, reportedly saying the men, believed to originally be from India, were 'Middle Eastern.'" In 2015, Garmin employed 2,700 workers in Olathe and has plans to double this number, which the article notes has led to "increasing diversity" in the community.

Read more of this story at Slashdot.

Benchmarks Of Ubuntu 17.04 Beta vs. Antergos, Clear Linux, openSUSE Tumbleweed

Phoronix - 2 hours 43 min ago
For those curious how Ubuntu 17.04 is shaping up, considering this week was the "beta" release for participating flavors, I decided to take a fresh Ubuntu 17.04 x86_64 daily ISO and see how its performance compares to Ubuntu 17.10, Clear Linux 13600, Antergos 17.2, and openSUSE Tumbleweed.

FAA Warns More Drones Are Flying Near Airports

Slashdot - 3 hours 39 min ago
Between February and September of 2016, there were 1,274 reports of drones near airports -- versus just 874 for the same period in 2015, according to newly-released FAA research. "The report detailed more than 1,200 incidents of airplane pilots, law enforcement, air traffic controllers, and U.S. citizens reporting drones flying in places they shouldn't," writes Fortune. An anonymous reader quotes their report: One of takeaway of the report was that while the FAA has received several reports from pilots that drones may have hit their aircraft, the administration was unable to verify any such claim. "Every investigation has found the reported collisions were either birds, impact with other items such as wires and posts, or structural failure not related to colliding with an unmanned aircraft," the FAA said in a statement... Although a drone hasn't smashed into an airplane yet, the FAA "wants to send a clear message that operating drones around airplanes and helicopters is dangerous and illegal. Unauthorized operators may be subject to stiff fines and criminal charges, including possible jail time," the FAA said.

Read more of this story at Slashdot.

Severe IE 11 Bug Allows 'Persistent JavaScript' Attacks

Slashdot - 4 hours 39 min ago
An anonymous reader writes: New research published today shows how a malicious website owner could show a constant stream of popups, even after the user has left his site, or even worse, execute any kind of persistent JavaScript code while the user is on other domains. In an interview, the researcher who found these flaws explains that this flaw is an attacker's dream, as it could be used for: ad fraud (by continuing to load ads even when the user is navigating other sites), zero-day attacks (by downloading exploit code even after the user has left the page), tech support scams (by showing errors and popups on legitimate and reputable sites), and malvertising (by redirecting users later on, from other sites, even if they leave the malicious site too quickly). This severe flaw in the browser security model affects only Internet Explorer 11, which unfortunately is the second most used browser version, after Chrome 55, with a market share of over 10%. Even worse for IE11 users, there's no fix available for this issue because the researcher has decided to stop reporting bugs to Microsoft after they've ignored many of his previous reports. For IE11 users, a demo page is available here.

Read more of this story at Slashdot.

A Soft Implementation Of ARB_gpu_shader_fp64 Is Slowly Being Tackled For Mesa

Phoronix - 5 hours 4 min ago
Last year there was a Google Summer of Code student working on a library to implement double-precision operations (FP64) in pure GLSL 1.30 as a benefit to older GPUs not having native FP64 capabilities. While that work didn't materialize as a solution in 2017 for those wanting "soft" ARB_gpu_shader_fp64 for being able to potentially expose OpenGL 4.0 on more R600g era GPUs, the work is ongoing...

$10K Package Of Super Nintendo Games Finally Found By Post Office

Slashdot - 5 hours 39 min ago
A project to preserve (and validate) every Super Nintendo game ROM had been derailed when the post office lost a package containing 100 games from the PAL region. But now Byuu, the creator of the Higan SNES emulator, reports that the package has been found. An anonymous reader writes: Thursday Byuu finally posted photos of the unboxing for the package that was shipped to him January 5th. "I'd like to offer my sincerest apologies to the USPS for assuming the worst in that these games were stolen. I should not have been so hasty to assume malicious intent." At the same time, Byuu writes that "My package was sitting in Atlanta, GA for well over a month with my address clearly visible right on the box. Had this case not been escalated to the media, it likely would have gone up for auction in a bin with other electronics sometime in March." Byuu is now refunding donations he'd received to replace the missing games, and says he can now also resume work on the SNES Preservation Project. And going forward, according to Eurogamer, "Byuu has said he will be more cautious with shipping games in the future -- only using smaller shipments, or buying individual games to scan and archive then selling them on to get some money back."

Read more of this story at Slashdot.

Are Your Slack Conversations Really Private and Secure?

Slashdot - 6 hours 39 min ago
An anonymous reader writes: "Chats that seem to be more ephemeral than email are still being recorded on a server somewhere," reports Fast Company, noting that Slack's Data Request Policy says the company will turn over data from customers when "it is compelled by law to do so or is subject to a valid and binding order of a governmental or regulatory body...or in cases of emergency to avoid death or physical harm to individuals." Slack will notify customers before disclosure "unless Slack is prohibited from doing so," or if the data is associated with "illegal conduct or risk of harm to people or property." The article also warns that like HipChat and Campfire, Slack "is encrypted only at rest and in transit," though a Slack spokesperson says they "may evaluate" end-to-end encryption at some point in the future. Slack has no plans to offer local hosting of Slack data, but if employers pay for a Plus Plan, they're able to access private conversations. Though Slack has 4 million users, the article points out that there's other alternatives like Semaphor and open source choices like Wickr and Mattermost. I'd be curious to hear what Slashdot readers are using at their own workplaces -- and how they feel about the privacy and security of Slack?

Read more of this story at Slashdot.

UKSM Is Still Around For Data Deduplication Of The Linux Kernel

Phoronix - 7 hours 23 min ago
Several years back we wrote about Ultra Kernel Samepage Merging (UKSM) for data de-duplication within the Linux kernel for transparently scanning all application memory and de-duping it where possible. While the original developer is no longer active, a new developer has been maintaining the work and continues to support it on the latest Linux kernel releases...

Java and Python FTP Attacks Can Punch Holes Through Firewalls

Slashdot - 7 hours 39 min ago
"The Java and Python runtimes fail to properly validate FTP URLs, which can potentially allow attackers to punch holes through firewalls to access local networks," reports CSO Online. itwbennett writes: Last weekend security researcher Alexander Klink disclosed an interesting attack where exploiting an XML External Entity vulnerability in a Java application can be used to send emails. At the same time, he showed that this type of vulnerability can be used to trick the Java runtime to initiate FTP connections to remote servers. After seeing Klink's exploit, Timothy Morgan, a researcher with Blindspot Security, decided to disclose a similar attack that works against both Java's and Python's FTP implementations. "But his attack is more serious because it can be used to punch holes through firewalls," writes Lucian Constantin in CSO Online. "The Java and Python developers have been notified of this problem, but until they fix their FTP client implementations, the researcher advises firewall vendors to disable classic mode FTP translation by default..." reports CSO Online. "It turns out that the built-in implementation of the FTP client in Java doesn't filter out special carriage return and line feed characters from URLs and actually interprets them. By inserting such characters in the user or password portions of an FTP URL, the Java FTP client can be tricked to execute rogue commands..."

Read more of this story at Slashdot.

Uncle Sam needs you... to debug, improve Dept of Defense open-source software at code.mil

El Reg - 8 hours 13 min ago
You don't hate freedom, do you? You love America, right?

The US Department of Defense wants you to contribute unclassified code to software projects developed in support of national security.…

systemd 233 Is Around The Corner With More Additions, Changes

Phoronix - 8 hours 54 min ago
Systemd 233 is expected to be released in the days ahead and as usual it's packing new features and various additions...

Better Turbo Boost Max 3.0 Support Is Landing For Linux 4.11

Phoronix - 9 hours 45 min ago
Better support for Intel Turbo Boost Max 3.0 are among the changes to find with the platform-drivers-x86 updates for the Linux 4.11 kernel...

Al Gore Sells $29.5 Million In Apple Stock

Slashdot - 10 hours 13 min ago
An anonymous reader quotes a report from AppleInsider: A U.S. Securities and Exchange Commission filing on Friday reveals Apple board member Al Gore this week sold 215,437 shares of Apple stock (APPL) worth about $29.5 million. Gore's stock sale, which was accomplished in multiple trades ranging from $136.4 to $137.12 on Wednesday, nearly matches a $29.6 million purchase of Apple shares made in 2013. When Gore bought the stock batch more than four years ago, he exercised Apple's director stock option to acquire 59,000 shares at a price of about $7.48 per share, costing him approximately $441,000. This was pre-split AAPL, so shares were valued at $502.68 each. Following today's sale, Gore owns 230,137 shares of Apple stock worth $31.5 million at the end of trading on Friday.

Read more of this story at Slashdot.

Experimental Patches Revised For AMDGPU HDMI Stereo 3D, DAL/DC Now Supported

Phoronix - 10 hours 29 min ago
Last month an independent contributor to the AMD Linux graphics stack posted AMDGPU patches for HDMI Stereo 3D support within this open-source Radeon DRM driver. Those patches were rather dismissed in part because they didn't implement the support along the new DAL/DC display code-paths, but that has now changed...

Git 2.12 Ships With A Variety Of Changes

Phoronix - 10 hours 47 min ago
Junio Hamano announced on Friday the release of Git 2.12.0...

OpenRISC For Linux 4.11 Gets Some Optimizations, Prepares For SMP

Phoronix - 10 hours 52 min ago
OpenRISC continues advancing with its sights on being a free and open processor for embedded systems using the RISC instruction set architecture...

MD RAID Optimizations, Btrfs Fixes For Linux 4.11

Phoronix - 11 hours 6 min ago
The MD pull request was submitted on Friday for the Linux 4.11 kernel as were the Btrfs file-system changes...

UK cops can keep millions of mugshots of innocent folks on file

El Reg - 13 hours 12 min ago
You can ask to be removed, but it's up to officers to listen, Home Office cheerfully concludes

After unlawfully hoarding millions of mugshots of one-time suspects, UK police chiefs were this week told to delete the snaps – but only if the people in the photos complain. And even then, requests can be easily waved away.…

Syndicate content