FileZilla FTP Client Adds Support for Master Password That Encrypts Your Logins

Found on Bleeping Computer on Saturday, 27 May 2017
Browse Software

In November 2016, a user frustrated with Koose's stance forked the FileZilla FTP client and added support for a master password via a spin-off app called FileZilla Secure.

The author of FileZilla Secure took this action after his computer was infected with malware, and the malware stole the FileZilla password trove, a file named sitemanager.xml.

So it only took more than a decade to implement a security setting that should have existed since the beginning. Every single security how-to tells you not to store passwords in plaintext, but FileZilla knew better. Nothing happened for 10 years, but suddenly this essential security featre is implemented (but not activated by default) after someone else forked the software and fixed this bug, siphoning from the original FileZilla userbase. With all that said, the software has secured a position on the "never install" list after FileZilla supported adware.

Red Hat Enterprise Linux 7.4 Set to Improve Security Features

Found on eWEEK on Wednesday, 24 May 2017
Browse Software

The upcoming Red Hat Enterprise Linux 7.4 release is set to provide organizations with a series of new features and enhancements that will improve security and performance.

Security isn't the only area of enhancement in RHEL 7.4, as the new release will also benefit from the inclusion the Network Manager 1.8 update. Network Manager is the open-source service that enables detection and configuration of network connectivity.

Well, any update is always about features and security. That said, they could drop NetworkManager altogether which is the amongst the first packages to be uninstalled always.

Redmond puts wall around Windows 10 for Chinese government edition

Found on The Register on Tuesday, 23 May 2017
Browse Software

"The China Government Edition will use these manageability features to remove features that are not needed by Chinese government employees, like OneDrive, to manage all telemetry and updates, and to enable the government to use its own encryption algorithms within its computer systems."

Presumably a lot less information is collected by the notoriously data-hungry OS, and little of it is likely to flow to Redmond's servers. Any info that is extracted is almost certainly staying in China.

Sounds like a mix of good and bad things; having the MS surveillance removed globally would get lot of support not only in China.

Windows 10 S: no command line apps, free Pro upgrades for assistive tech users

Found on Ars Technica on Saturday, 20 May 2017
Browse Software

First, a thing 10 S won't do: run command-line applications. CMD and PowerShell, the two built-in Windows command-line interfaces, won't be supported.

The rationale is that the built-in command-line applications include dangerous tools (for example, the diskpart partitioning program) that can break things, and the Store has no third-party command-line tools at all. To keep Windows 10 S protected against user error, they're all prohibited.

Partitioning the disk drive you bought is now a security risk? What on earth is Microsoft smoking? The command line is one of the most important tools, even on Windows. Removing it makes the OS completely useless.

It might be time to say goodbye to the MP3 - so let's look back at its life

Found on BBC Nws on Tuesday, 16 May 2017
Browse Software

The Fraunhofer Institute says it has "terminated" its licensing programme with Technicolor because its patents are expiring.

The supposed "death" of the MP3 won't have much of an impact because of streaming and most new portable players now use different formats anyway.

It's not dead, and it won't be dead for many more years. The patents simply expired, what means that everybody can now implement the MP3 codec. While it's true that newer codecs can deliver better quality at a lower bandwidth, the widespread support of MP3 will keep it alive for a long time.

Don't tell people to turn off Windows Update, just don't

Found on Troy Hunt on Monday, 15 May 2017
Browse Software

Often, the updates these products deliver patch some pretty nasty security flaws. If you had any version of Windows since Vista running the default Windows Update, you would have had the critical Microsoft Security Bulletin known as "MS17-010" pushed down to your PC and automatically installed.

This is how consumer software these days should be: self-updating with zero input required from the user. As soon as they're required to do something, it'll be neglected which is why Windows Update is so critical.

That would be a no-brainer suggestion if Microsoft wouldn't have royally messed up the update procedure. With every new update milestone, reports about problems are getting scarier: reboot loops, more telemetry, behavioral changes and software incompatibilities. It looks like Mirosoft has pushed the alpha and beta to the users. The final nail into the coffin was the decision to label the Windows 10 upgrade scareware as an important update. Before all that, regular updates were a common thing; after that, users got fed up with those business decisions.

Opera’s new browser gives you direct access to WhatsApp, Messenger, and Telegram

Found on The Verge on Wednesday, 10 May 2017
Browse Software

Opera may be the underdog of the browser world, but it continues to fight hard, adding interesting new features to try and win over users. The latest addition is a messaging sidebar built directly into the browser interface.

As well as the messaging sidebar, Opera Reborn debuts a redesigned UI, offering animated icons, colorful themes, and a dedicated dark mode.

It looks like it is fighting to die. These features are cruft and only help to bloat up the once lean and fast browser. Selling out to a chinese consortium sure did not benefit Opera; at least there is Vivaldi left.

Linux kernel security gurus Grsecurity oust freeloaders from castle

Found on The Register on Thursday, 27 April 2017
Browse Software

Linux users, the free lunch is over. Pennsylvania-based Open Source Security on Wednesday decided to stop making test patches of Grsecurity available for free.

To date and going forward, Grsecurity's patches are and will be distributed under the GPLv2 free-software license, just like the Linux kernel.

Except they need to distribute the sources if they make their patches available to the public. That's exactly why for example CentOS exists: the team behind it recompiles the sources available from RedHat; and no legal team could stop that. With SELinux available in their mainstream kernel, there is no reason to use a grsec Kernel anyway.

Windows Updates getting even more complex, a little more controllable

Found on Ars Technica on Tuesday, 25 April 2017
Browse Software

This split packaging (and split classification) should make it easier for organizations to, for example, deploy Security Update very quickly but hold the non-security portion back so that it can be more thoroughly tested and validated. Systems that are set to skip "quality updates" will skip these packages, picking up only the security updates.

Or, Microsoft could return to the previous method of releasing the patches in single files so users can cherrypick whatever they want; but no, this is so uncool today.

Top-ranked programming Web tutorials introduce vulnerabilities into software

Found on HelpNetSecurity on Sunday, 23 April 2017
Browse Software

Researchers from several German universities have checked the PHP codebases of over 64,000 projects on GitHub, and found 117 vulnerabilities that they believe have been introduced through the use of code from popular but insufficiently reviewed tutorials.

In their research, they evaluated only PHP application code, but their approach can be easily used to evaluate codebases in other programming languages, especially because they have made available their crawler (GithubSpider) and code analogue detector (CADetector) tools.

That applies to tutorials about literally everything. Many of them are written by people who managed to get something running with a big portion of luck and feel the need to share their findings. It does not only affect programming, but entire OS installations too: for example, if you stumble over "disable SELinux" then better quit reading more on that page.