Skip to main content

Home/ Future of the Web/ Group items tagged patch

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
Gary Edwards

Two Microsofts: Mulling an alternate reality | ZDNet - 1 views

www.zdnet.com/n-alternate-reality-7000016916

Microsoft microsoft-monopoly Judge-Thomas-Penfield-Jackson

shared by Gary Edwards on 19 Jun 13 - No Cached
  • Judge Jackson had it right. And the Court of Appeals? Not so much
  • Judge Jackson is an American hero and news of his passing thumped me hard. His ruling against Microsoft and the subsequent overturn of that ruling resulted, IMHO, in two extraordinary directions that changed the world. Sure the what-if game is interesting, but the reality itself is stunning enough. Of course, Judge Jackson sought to break the monopoly. The US Court of Appeals overturn resulted in the monopoly remaining intact, but the Internet remaining free and open. Judge Jackson's breakup plan had a good shot at achieving both a breakup of the monopoly and, a free and open Internet. I admit though that at the time I did not favor the Judge's plan. And i actually did submit a proposal based on Microsoft having to both support the WiNE project, and, provide a complete port to WiNE to any software provider requesting a port. I wanted to break the monopolist's hold on the Windows Productivity Environment and the hundreds of millions of investment dollars and time that had been spent on application development forever trapped on that platform. For me, it was the productivity platform that had to be broken.
  • I assume the good Judge thought that separating the Windows OS from Microsoft Office / Applications would force the OS to open up the secret API's even as the OS continued to evolve. Maybe. But a full disclosure of the API's coupled with the community service "port to WiNE" requirement might have sped up the process. Incredibly, the "Undocumented Windows Secrets" industry continues to thrive, and the legendary Andrew Schulman's number is still at the top of Silicon Valley legal profession speed dials. http://goo.gl/0UGe8 Oh well. The Court of Appeals stopped the breakup, leaving the Windows Productivity Platform intact. Microsoft continues to own the "client" in "Client/Server" computing. Although Microsoft was temporarily stopped from leveraging their desktop monopoly to an iron fisted control and dominance of the Internet, I think what were watching today with the Cloud is Judge Jackson's worst nightmare. And mine too. A great transition is now underway, as businesses and enterprises begin the move from legacy client/server business systems and processes to a newly emerging Cloud Productivity Platform. In this great transition, Microsoft holds an inside straight. They have all the aces because they own the legacy desktop productivity platform, and can control the transition to the Cloud. No doubt this transition is going to happen. And it will severely disrupt and change Microsoft's profit formula. But if the Redmond reprobate can provide a "value added" transition of legacy business systems and processes, and direct these new systems to the Microsoft Cloud, the profits will be immense.
  • ...1 more annotation...
  • Judge Jackson sought to break the ability of Microsoft to "leverage" their existing monopoly into the Internet and his plan was overturned and replaced by one based on judicial oversight. Microsoft got a slap on the wrist from the Court of Appeals, but were wailed on with lawsuits from the hundreds of parties injured by their rampant criminality. Some put the price of that criminality as high as $14 Billion in settlements. Plus, the shareholders forced Chairman Bill to resign. At the end of the day though, Chairman Bill was right. Keeping the monopoly intact was worth whatever penalty Microsoft was forced to pay. He knew that even the judicial over-site would end one day. Which it did. And now his company is ready to go for it all by leveraging and controlling the great productivity transition. No business wants to be hostage to a cold heart'd monopolist. But there is huge difference between a non-disruptive and cost effective, process-by-process value-added transition to a Cloud Productivity Platform, and, the very disruptive and costly "rip-out-and-replace" transition offered by Google, ZOHO, Box, SalesForce and other Cloud Productivity contenders. Microsoft, and only Microsoft, can offer the value-added transition path. If they get the Cloud even halfway right, they will own business productivity far into the future. Rest in Peace Judge Jackson. Your efforts were heroic and will be remembered as such. ~ge~
  • Gary Edwards on 19 Jun 13
     
    Comments on the latest SVN article mulling the effects of Judge Thomas Penfield Jackson's anti trust ruling and proposed break up of Microsoft. comment: "Chinese Wall" Ummm, there was a Chinese Wall between Microsoft Os and the MS Applciations layer. At least that's what Chairman Bill promised developers at a 1990 OS/2-Windows Conference I attended. It was a developers luncheon, hosted by Microsoft, with Chairman Bill speaking to about 40 developers with applications designed to run on the then soon to be released Windows 3.0. In his remarks, the Chairman described his vision of commoditizing the personal computer market through an open hardware-reference platform on the one side of the Windows OS, and provisioning an open application developers layer on the other using open and totally transparent API's. Of course the question came up concerning the obvious advantage Microsoft applications would have. Chairman Bill answered the question by describing the Chinese Wall that existed between Microsoft's OS and Apps develop departments. He promised that OS API's would be developed privately and separate from the Apps department, and publicly disclosed to ALL developers at the same time. Oh yeah. There was lots of anti IBM - evil empire stuff too :) Of course we now know this was a line of crap. Microsoft Apps was discovered to have been using undocumented and secret Window API's. http://goo.gl/0UGe8. Microsoft Apps had a distinct advantage over the competition, and eventually the entire Windows Productivity Platform became dependent on the MSOffice core. The company I worked for back then, Pyramid Data, had the first Contact Management application for Windows; PowerLeads. Every Friday night we would release bug fixes and improvements using Wildcat BBS. By Monday morning we would be slammed with calls from users complaining that they had downloaded the Friday night patch, and now some other application would not load or function properly. Eventually we tracked th
Gonzalo San Gil, PhD.

Patched Android Lockscreen Still a Threat | Mobile | LinuxInsider [MS Note...] - 0 views

www.linuxinsider.com/...reen-Still-a-Threat-82513.html

Google Microsoft 's once trustworthy opensource android mobile threat

shared by Gonzalo San Gil, PhD. on 25 Sep 15 - No Cached
    • Gonzalo San Gil, PhD.
      Gonzalo San Gil, PhD. on 25 Sep 15
       
      [With the announcement that Microsoft would partner with the truly open-source, Android-based Cyanogen OS to provide a bundled suite of apps, both companies made one thing very clear: Android's not just for Google anymore. http://www.wired.com/2015/04/microsoft-google-cyanogen/]
  • Gonzalo San Gil, PhD. on 25 Sep 15
     
    Although Google issued a patch for its Nexus line, hackers can have a field day exploiting a recently discovered lockscreen vulnerability on other Android products. "Even when users feel confident about locking their phone with a strong password, if their device is exposed to this exploit, it does not really matter how strong the password is," noted Armando Leon, director of mobile at LaunchKey.
  • Gonzalo San Gil, PhD. on 25 Sep 15
     
    Although Google issued a patch for its Nexus line, hackers can have a field day exploiting a recently discovered lockscreen vulnerability on other Android products. "Even when users feel confident about locking their phone with a strong password, if their device is exposed to this exploit, it does not really matter how strong the password is," noted Armando Leon, director of mobile at LaunchKey.
Gary Edwards

Windows XP: How end of support sparked one organisation's shift from Microsoft | ZDNet - 1 views

www.zdnet.com/hift-from-microsoft-7000028510

Chrome chrome-OS

shared by Gary Edwards on 17 Apr 14 - No Cached
  • Gary Edwards on 17 Apr 14
     
    Good story of how a UK Company responded to Microsoft's announcement if XP end of life. After examining many alternatives, they settled on a ChromeBook-ChromeBox - Citrix solution. Most of the existing desktop hardware was repurposed as ChromeTops running Chrome Browser apps and Citrix XenDesktop for legacy data apps. excerpt/intro: "There are the XP diehards, and the Windows 7 and 8 migrators. But in a world facing up to the end of Windows XP support, one UK organisation belongs to another significant group - those breaking with Microsoft as their principal OS provider. Microsoft's end of routine security patching and software updates on 8 April helped push the London borough of Barking and Dagenham to a decision it might otherwise not have taken over the fate of its 3,500 Windows XP desktops and 800 laptops. "They were beginning to creak but they would have gone on for a while. It's fair to say if XP wasn't going out of life, we probably wouldn't be doing this now," Barking and Dagenham general manager IT Sheyne Lucock said. Around one-eighth of corporate Windows XP users are moving away from Microsoft, according to recent Tech Pro Research. Lucock said it had become clear that the local authority was locked into a regular Windows operating system refresh cycle that it could no longer afford. "If we just replaced all the Windows desktops with newer versions running a newer version of Windows, four years later we would have to do the same again and so on," he said. "So there was an inclination to try and do something different - especially as we know that with all the budget challenges that local government is going to be faced with, we're going to have to halve the cost of our ICT service over the next five years." Barking and Dagenham outsourced its IT in December 2010 to Elevate East London, which is a joint-venture between the council and services firm Agilisys. Lucock and systems architect Rupert Hay-Campbell are responsible for strategy, policy
  • Paul Merrell on 18 Apr 14
     
    Meanwhile, some organizations missed the end of life deadline and are now paying Microsoft for extended support. E.g., the U.S. Internal Revenue Service, which is still running 58,000 desktops on WinXP. http://arstechnica.com/information-technology/2014/04/irs-another-windows-xp-laggard-will-pay-microsoft-for-patches/
Gonzalo San Gil, PhD.

European Commission to update its open source policy | Joinup - 0 views

joinup.ec.europa.eu/...-update-its-open-source-policy

European Commission open source encouragement

shared by Gonzalo San Gil, PhD. on 15 Dec 14 - No Cached
  • Gonzalo San Gil, PhD. on 15 Dec 14
     
    " Steps up efforts to contribute code upstream The European Commission wants to make it easier for its software developers to submit patches and add new functionalities to open source projects. Contributing to open source communities will be made central to the EC's new open source policy, expects Pierre Damas, Head of Sector at the Directorate General for IT (DIGIT)."
  • Gonzalo San Gil, PhD. on 15 Dec 14
     
    " Steps up efforts to contribute code upstream The European Commission wants to make it easier for its software developers to submit patches and add new functionalities to open source projects. Contributing to open source communities will be made central to the EC's new open source policy, expects Pierre Damas, Head of Sector at the Directorate General for IT (DIGIT)."
Gonzalo San Gil, PhD.

​No reboot patching comes to Linux 4.0 | ZDNet - 1 views

www.zdnet.com/...ot-patching-comes-to-linux-4-0

linux 4.o Linux 4.0 reboot no more update patch system performance upgrade

shared by Gonzalo San Gil, PhD. on 17 Mar 15 - No Cached
  • Gonzalo San Gil, PhD. on 17 Mar 15
     
    "With Linux 4.0, you may never need to reboot your operating system again."
  • Gonzalo San Gil, PhD. on 17 Mar 15
     
    "With Linux 4.0, you may never need to reboot your operating system again."
Gonzalo San Gil, PhD.

50 Open Source Replacements for Windows XP - Datamation - 1 views

www.datamation.com/...acements-for-windows-xp-1.html

open source replacements windows xp linux choices

shared by Gonzalo San Gil, PhD. on 20 Apr 14 - No Cached
  • Gonzalo San Gil, PhD. on 20 Apr 14
     
    "(Page 1 of 3) Microsoft officially ended support for Windows XP on April 8, 2014. That means the company is no longer patching newly discovered security vulnerabilities in the operating system, and people who continue to use it are opening themselves up to security risks."
Gonzalo San Gil, PhD.

Mozilla blocks all Flash in Firefox after third zero-day | Computerworld - 0 views

www.computerworld.com/...efox-after-third-zero-day.html

mozilla blocks flash firefox

shared by Gonzalo San Gil, PhD. on 14 Jul 15 - No Cached
  • Gonzalo San Gil, PhD. on 14 Jul 15
     
    "Automatically blocks even the current version of Flash patched July 8; users can sidestep the ban after seeing a warning"
Gonzalo San Gil, PhD.

NGINX Open Source 1.9.5 Released with HTTP/2 Support - 0 views

www.nginx.com/nginx-1-9-5

nginx open source HTTP_2 support released Internet servers

shared by Gonzalo San Gil, PhD. on 28 Sep 15 - No Cached
  • Gonzalo San Gil, PhD. on 28 Sep 15
     
    "Earlier this year we released an early-alpha patch to enable HTTP/2 support in our open source NGINX product and last week a fully-supported implementation of HTTP/2 in NGINX Plus. Today we proudly announce that HTTP/2 has been committed to the open source repo and is now officially available as part of NGINX version 1.9.5."
Gonzalo San Gil, PhD.

Another Day, Another Billion Android Users at Risk | Mobile | LinuxInsider [# ! Note !... - 0 views

www.linuxinsider.com/...droid-Users-at-Risk-82570.html

shared by Gonzalo San Gil, PhD. on 11 Oct 15 - No Cached
  • Gonzalo San Gil, PhD. on 11 Oct 15
     
    "By Richard Adhikari Oct 5, 2015 5:27 PM PT Google on Monday released an over-the-air update for Nexus devices, which includes patches for the latest Stagefright vulnerabilities and other flaws. Android's Stagefright media processing feature, which recently imperiled 1 billion devices around the world, was once again putting them at risk, Zimperium revealed last week."
Gonzalo San Gil, PhD.

Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide - 0 views

www.copyleft.org/guide

copyleft gnu GPL comprehensive tutorial guide

shared by Gonzalo San Gil, PhD. on 15 Dec 14 - No Cached
  • Gonzalo San Gil, PhD. on 15 Dec 14
     
    "This material is regularly updated by a community of contributors and is available online at all times at https://copyleft.org/guide/. Patches are indeed welcome to this material. Sources can be found in the Git repository at: https://gitorious.org/copyleft-org/tutorial/"
Gonzalo San Gil, PhD.

Linux Kernel Security (SELinux vs AppArmor vs Grsecurity) | [ # ! 2009 to check and upd... - 0 views

www.cyberciti.biz/...vs-apparmor-vs-grsecurity.html

open source linux security SELinux alternatives AppArmor Grsecurity check

shared by Gonzalo San Gil, PhD. on 07 Dec 15 - Cached
  • Gonzalo San Gil, PhD. on 07 Dec 15
     
    " Unfortunately, stock kernel is not secured out of box. There are some important Linux kernel patches to secure your box"
Gonzalo San Gil, PhD.

WordPress 4.4.1 Updates for XSS (and 52 other issues) - InternetNews. [# ! Note] - 0 views

www.internetnews.com/...r-xss-and-52-other-issues.html

wordpress updates xss issues

shared by Gonzalo San Gil, PhD. on 07 Jan 16 - No Cached
  • Gonzalo San Gil, PhD. on 07 Jan 16
     
    "January 07, 2016 The first WordPress update of 2016 is out and like many other incremental updates, it is being triggered by a security vulnerability. The single security issue being patched in WordPress 4.4.1 is a cross site scripting vulnerability that could have potentially enabled a site compromised."
Gonzalo San Gil, PhD.

7 steps to proactive security | Network World - 1 views

www.networkworld.com/...eps-to-proactive-security.html

proactive network security

shared by Gonzalo San Gil, PhD. on 28 Nov 16 - No Cached
  • Gonzalo San Gil, PhD. on 28 Nov 16
     
    "The key to securing against this threat lies in a common metaphor-if a ship has a hole, it is better to patch the breach than bail the water Network World | Oct 21, 2016 4:00 AM P"
Paul Merrell

NSA Based Malware Used In Massive Cyber-Attack Hitting 74 Countries - 0 views

www.mintpressnews.com/...227763

surveillance state cyberwar NSA exploits Shadow-Brokers leak

shared by Paul Merrell on 13 May 17 - No Cached
  • Apparent National Security Agency (NSA) malware has been used in a global cyber-attack, including on British hospitals, in what whistleblower Edward Snowden described as the repercussion of the NSA’s reckless decision to build the tools. “Despite warnings, @NSAGov built dangerous attack tools that could target Western software. Today we see the cost,” Snowden tweeted Friday. At least two hospitals in London were forced to shut down and stop admitting patients after being attacked by the malware, which operates by locking out the user, encrypting data, and demanding a ransom to release it. The attacks hit dozens of other hospitals, ambulance operators, and doctors’ offices as well.
  • The Blackpool Gazette in the northwest reported that medical staff had resorted to using pen and paper when phone and computer systems shut down. Elsewhere, journalist Ollie Cowan tweeted a photo of ambulances “backed up” at Southport Hospital as the staff attempted to cope with the crisis.
  • Other disruptions were reported in at least 74 countries, including Russia, Spain, Turkey, and Japan, and the number is “growing fast,” according to Kaspersky Lab chief Costin Raiu. Security architect Kevin Beau said it was spreading into the U.S. as well. The malware, which Microsoft tested briefly earlier this year, was leaked by a group calling itself the Shadow Brokers, which has been releasing NSA hacking tools online since last year, the New York Times reports. Times journalists Dan Bilefsky and Nicole Perlroth wrote: Microsoft rolled out a patch for the vulnerability in March, but hackers apparently took advantage of the fact that vulnerable targets—particularly hospitals—had yet to update their systems. The malware was circulated by email. Targets were sent an encrypted, compressed file that, once loaded, allowed the ransomware to infiltrate its targets. Reuters reported that the National Health Service (NHS), England’s public health system, was warned about possible hacking earlier in the day, but that by then it was already too late.
  • ...2 more annotations...
  • A Twitter account with the handle @HackerFantastic, the co-founder of the cyber security company Hacker House, tweeted that the firm had “warned the NHS with Sky news about vulnerabilities they had last year, this was inevitable and bound to happen at some stage.” “In light of today’s attack, Congress needs to be asking @NSAgov if it knows of any other vulnerabilities in software used in our hospitals,” Snowden tweeted. “If @NSAGov had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened.” Disclosing the vulnerability when it was found would have given hospitals years, not months, to update their systems and prepare for an attack, he added.
  • witter user @MalwareTechBlog added, “Something like this is incredibly significant, we’ve not seen P2P spreading on PC via exploits at this scale in nearly a decade.” Patrick Toomey, a staff attorney with the American Civil Liberties Union’s (ACLU) National Security Project, said, “It would be shocking if the NSA knew about this vulnerability but failed to disclose it to Microsoft until after it was stolen.” “These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world,” Toomey said. “It is past time for Congress to enhance cybersecurity by passing a law that requires the government to disclose vulnerabilities to companies in a timely manner. Patching security holes immediately, not stockpiling them, is the best way to make everyone’s digital life safer.”
Paul Merrell

Haavard - 300 million users strong, Opera moves to WebKit - 1 views

my.opera.com/...webkit

webkit Opera HTML5

shared by Paul Merrell on 14 Feb 13 - No Cached
  • Today, we announced that Opera has reached 300 million active users. At the same time, we made the official announcement that Opera will move from Presto to WebKit as the engine at the core of the browser.
  • It was always a goal to be compatible with the real web while also supporting and promoting open standards.That turns out to be a bit of a challenge when you are faced with a web that is not as open as one might have wanted. Add to that the fact that it is constantly changing and that you don't get site compatibility for free (which some browsers are fortunate enough to do), and it ends up taking up a lot of resources - resources that could have been spent on innovation and polish instead.
  • Although I was skeptical at first when I started hearing about the switch, I am now fully convinced that it is the right thing to do. Not only will it free up significant engineering resources at Opera and allow us to do more innovation instead of constantly trying to adapt to the web, but our users should benefit from better site compatibility and more innovative features and polish.This move allows us to focus even more on the actual user experience.
  • ...2 more annotations...
  • If switching to WebKit allows us to accelerate our growth and become an important contributor to the project (we will contribute back to WebKit, and have already submitted our first patch (bug)), we may finally have a direct impact on the way web sites are coded. We want sites to be coded for open standards rather than specific browsers.
  • WebKit has matured enough that it is actually possible to make the switch, and we can help it mature even further. In return, we get to spend more resources on a better user experience, and less on chasing an ever-changing web.This move allows us to create a platform for future growth because it allows us to focus our resources on things that can actually differentiate Opera from the competition, and could help the web move in the right direction.
  • Paul Merrell on 14 Feb 13
     
    And so there will be only three major web page rendering engines, webkit, mozilla's gecko, and MSIE. with only webkit in the ascendancy. 
Gonzalo San Gil, PhD.

TCP Flaw Opens Linux Systems to Hijackers | Software | LinuxInsider - 0 views

www.linuxinsider.com/...ystems-to-Hijackers-83798.html

tcp flaw open system hijack solve patch it no2 open source free software vulnerabilities GNU-Linux GNU Linux to fix

shared by Gonzalo San Gil, PhD. on 19 Aug 16 - No Cached
  • Gonzalo San Gil, PhD. on 19 Aug 16
     
    "By Richard Adhikari Aug 11, 2016 4:09 PM PT A flaw in the RFC 5961 specification the Internet Engineering Task Force developed to protect TCP against blind in-window attacks could threaten Android smartphones, as well as every Linux computer on the planet. [*Correction - Aug. 12, 2016]"
Paul Merrell

Cover Pages: Open Web Foundation Formed to Support Community Specification Development. - 0 views

xml.coverpages.org/ni2008-09-22-a.html

community-driven standards open web foundation

shared by Paul Merrell on 23 Sep 08 - Cached
  • The formation of the Open Web Foundation (OWF) was announced on July 24, 2008 at the OSCON 2008 Conference. OWF is "applying the open source model of seeing a common pain point and trying to patch the system by creating an 'organizational library' that makes it easier to go through a collaborative specification process and come out of it with clean IPR, leading to faster implementation and adoption.
  • According to the OWF web site: "The Open Web Foundation is an independent non-profit dedicated to the development and protection of open, non-proprietary specifications for web technologies. It is an attempt to create a home for community-driven specifications. Following the open source model similar to the Apache Software Foundation, the foundation is aimed at building a lightweight framework to help communities deal with the legal requirements necessary to create successful and widely adopted specification. The foundation is trying to break the trend of creating separate foundations for each specification, coming out of the realization that we could come together and generalize our efforts... The Open Web Foundation is made up of individuals who believe that the open web is built on technologies that are created in the open by a diversity of contributors, and which free to be used and improved upon without restriction."
Paul Merrell

Help:CirrusSearch - MediaWiki - 0 views

www.mediawiki.org/...Help:CirrusSearch

Wikipedia MediaWiki search-engines CirrusSearch

shared by Paul Merrell on 19 Mar 15 - No Cached
  • CirrusSearch is a new search engine for MediaWiki. The Wikimedia Foundation is migrating to CirrusSearch since it features key improvements over the previously used search engine, LuceneSearch. This page describes the features that are new or different compared to the past solutions.
  • 1 Frequently asked questions 1.1 What's improved? 2 Updates 3 Search suggestions 4 Full text search 4.1 Stemming 4.2 Filters (intitle:, incategory: and linksto:) 4.3 prefix: 4.4 Special prefixes 4.5 Did you mean 4.6 Prefer phrase matches 4.7 Fuzzy search 4.8 Phrase search and proximity 4.9 Quotes and exact matches 4.10 prefer-recent: 4.11 hastemplate: 4.12 boost-templates: 4.13 insource: 4.14 Auxiliary Text 4.15 Lead Text 4.16 Commons Search 5 See also
  • Stemming In search terminology, support for "stemming" means that a search for "swim" will also include "swimming" and "swimmed", but not "swam". There is support for dozens of languages, but all languages are wanted. There is a list of currently supported languages at elasticsearch.org; see their documentation on contributing to submit requests or patches.
  • ...1 more annotation...
  • See also Full specifications in the browser tests
  • Paul Merrell on 19 Mar 15
     
    Lots of new tricks to learn on sites using MediaWiki as folks update their installations, I'm not a big fan of programs written in PHP and Javascript, but they're impossible to avoid on the Web. So is MediaWiki, so any real improvements help.  
Paul Merrell

Microsoft pledges to tell email customers of state-sponsored hacking in future - Techno... - 0 views

www.cbc.ca/...osoft-hotmail-attack-1.3386823

internet-security email Microsoft penetration-attempts

shared by Paul Merrell on 05 Jan 16 - No Cached
  • Microsoft Corp. has agreed to change its policies and always tell email customers when it suspects there has been a government hacking attempt after widespread hacking by Chinese authorities was exposed. Microsoft experts concluded several years ago that Chinese authorities had hacked into more than a thousand Hotmail email accounts, targeting international leaders of China's Tibetan and Uighur minorities in particular — but it decided not to tell the victims, allowing the hackers to continue their campaign, according to former employees of the company. On Wednesday, after a series of requests for comment from Reuters, Microsoft said it would change its policy on notifying customers. Microsoft spokesman Frank Shaw said the company was never certain of the origin of the Hotmail attacks.
  • The company also confirmed for the first time that it had not called, emailed or otherwise told the Hotmail users that their electronic correspondence had been collected. The company declined to say what role the exposure of the Hotmail campaign played in its decision to make the policy shift. The first public signal of the attacks came in May 2011, though no direct link was immediately made with the Chinese authorities.
  • That's when security firm Trend Micro Inc announced it had found an email sent to someone in Taiwan that contained a miniature computer program. The program took advantage of a previously undetected flaw in Microsoft's own web pages to direct Hotmail and other free Microsoft email services to secretly forward copies of all of a recipient's incoming mail to an account controlled by the attacker. Trend Micro found more than a thousand victims, and Microsoft patched the vulnerability before the security company announced its findings publicly
Paul Merrell

EFF Pries More Information on Zero Days from the Government's Grasp | Electronic Fronti... - 0 views

www.eff.org/...cy-zero-days-governments-grasp

surveillance state zero-day-exploits FOIA litigation

shared by Paul Merrell on 26 Jan 16 - No Cached
  • Until just last week, the U.S. government kept up the charade that its use of a stockpile of security vulnerabilities for hacking was a closely held secret.1 In fact, in response to EFF’s FOIA suit to get access to the official U.S. policy on zero days, the government redacted every single reference to “offensive” use of vulnerabilities. To add insult to injury, the government’s claim was that even admitting to offensive use would cause damage to national security. Now, in the face of EFF’s brief marshaling overwhelming evidence to the contrary, the charade is over. In response to EFF’s motion for summary judgment, the government has disclosed a new version of the Vulnerabilities Equities Process, minus many of the worst redactions. First and foremost, it now admits that the “discovery of vulnerabilities in commercial information technology may present competing ‘equities’ for the [government’s] offensive and defensive mission.” That might seem painfully obvious—a flaw or backdoor in a Juniper router is dangerous for anyone running a network, whether that network is in the U.S. or Iran. But the government’s failure to adequately weigh these “competing equities” was so severe that in 2013 a group of experts appointed by President Obama recommended that the policy favor disclosure “in almost all instances for widely used code.” [.pdf].
  • The newly disclosed version of the Vulnerabilities Equities Process (VEP) also officially confirms what everyone already knew: the use of zero days isn’t confined to the spies. Rather, the policy states that the “law enforcement community may want to use information pertaining to a vulnerability for similar offensive or defensive purposes but for the ultimate end of law enforcement.” Similarly it explains that “counterintelligence equities can be defensive, offensive, and/or law enforcement-related” and may “also have prosecutorial responsibilities.” Given that the government is currently prosecuting users for committing crimes over Tor hidden services, and that it identified these individuals using vulnerabilities called a “Network Investigative Technique”, this too doesn’t exactly come as a shocker. Just a few weeks ago, the government swore that even acknowledging the mere fact that it uses vulnerabilities offensively “could be expected to cause serious damage to the national security.” That’s a standard move in FOIA cases involving classified information, even though the government unnecessarily classifies documents at an astounding rate. In this case, the government relented only after nearly a year and a half of litigation by EFF. The government would be well advised to stop relying on such weak secrecy claims—it only risks undermining its own credibility.
  • The new version of the VEP also reveals significantly more information about the general process the government follows when a vulnerability is identified. In a nutshell, an agency that discovers a zero day is responsible for invoking the VEP, which then provides for centralized coordination and weighing of equities among all affected agencies. Along with a declaration from an official at the Office of the Director of National Intelligence, this new information provides more background on the reasons why the government decided to develop an overarching zero day policy in the first place: it “recognized that not all organizations see the entire picture of vulnerabilities, and each organization may have its own equities and concerns regarding the prioritization of patches and fixes, as well as its own distinct mission obligations.” We now know the VEP was finalized in February 2010, but the government apparently failed to implement it in any substantial way, prompting the presidential review group’s recommendation to prioritize disclosure over offensive hacking. We’re glad to have forced a little more transparency on this important issue, but the government is still foolishly holding on to a few last redactions, including refusing to name which agencies participate in the VEP. That’s just not supportable, and we’ll be in court next month to argue that the names of these agencies must be disclosed. 
1 - 20 of 22 Next ›
Showing 20▼ items per page