The D in Systemd stands for 'Dammmmit!' A nasty DHCPv6 packet can pwn a vulnerable Linux box

Found on The Register on Saturday, 27 October 2018
Browse Software

The flaw therefore puts Systemd-powered Linux computers – specifically those using systemd-networkd – at risk of remote hijacking: maliciously crafted DHCPv6 packets can try to exploit the programming cockup and arbitrarily change parts of memory in vulnerable systems, leading to potential code execution. This code could install malware, spyware, and other nasties, if successful.

Though a number of major admins have in recent years adopted and championed it as the replacement for the old Init era, others within the Linux world seem to still be less than impressed with Systemd and Poettering's occasionally controversial management of the tool.

The question is, why would someone stuff anything network related into what was supposed to be an init replacement? Or all the other crap SystemD contains? Another question is why they wrote DHCPv6 from scratch when IPv6 does not really need DHCP since it has Stateless Address Autoconfiguration (SLAAC) and Neighbor Discovery Protocol (NDP).

20 top lawyers were beaten by legal AI. Here are their surprising responses

Found on Hackernoon on Friday, 26 October 2018
Browse Various

The study, carried out with leading legal academics and experts, saw the LawGeex AI achieve an average 94% accuracy rate, higher than the lawyers who achieved an average rate of 85%. It took the lawyers an average of 92 minutes to complete the NDA issue spotting, compared to 26 seconds for the LawGeex AI.

Those who took on the AI are 20 US-trained corporate lawyers with legal and contract expertise with experience at companies including Goldman Sachs and Cisco, and global law firms including Alston & Bird and K&L Gates.

There won't be much pity for lawyers.

Facebook fined £500,000 for Cambridge Analytica scandal

Found on BBC News on Thursday, 25 October 2018
Browse Legal-Issues

The fine is the maximum allowed under the old data protection rules that applied before GDPR took effect in May.

"Facebook also failed to keep the personal information secure because it failed to make suitable checks on apps and developers using its platform."

Sadly, that's just pocket change for Zuckerberg.

Sony goes back on 11-year-old promise to keep Warhawk servers up

Found on Ars Technica on Wednesday, 24 October 2018
Browse Software

If you read Ars Technica (or simply play online games regularly), you're probably accustomed to game makers shutting down online gameplay servers at will, often with little-to-no notice.

Lorenzo B. signed the petition and described himself as "a player of 10 years who has spent money on the game and spent money on all the added extra maps, too. It is important to me to get what I paid for, and what I paid for is the Warhawk game that is now offline on the PlayStation network."

Remember, you're not buying a game; you're just paying money to be allowed to play as long as some beancounters in a company let you.

F***=off, Google tells its staff: Any mention of nookie now banned from internal files, URLs

Found on The Register on Tuesday, 23 October 2018
Browse Censorship

Late last week, a Google programmer claimed that their bosses had suddenly banned swear words from internal documents, and even shortened URLs to files were being blocked.

"They grep all the links for swear words and just delete them. Apparently one person who used the 'gimme a random string' option had his link deleted because they randomly got a swear word.

Google has form as a censor of bad language: the Chocolate Factory's speech-to-text translation engine refuses to print swear words without asterisks. Microsoft, too, decided to take a line on this with some of its platforms.

All this censorsho through the backdoor (no pun intended) is disgusting and feels like the first (or already second) step towards a world which you would not like.

GitHub.com freezes up as techies race to fix dead data storage gear

Found on The Register on Monday, 22 October 2018
Browse Internet

From about 4pm US West Coast time on Sunday (2300 UTC), the website has been stuttering and spluttering. Specifically, the site is still up and serving pages – it's just intermittently serving out-of-date files, and ignoring submitted Gists, bug reports, pushes, and posts.

Right now, we're seeing scores of complaints about the site being down on Twitter – including quite a few upset coders in Japan, where at time of writing is late Monday morning. Nice start to the week.

If you store your project online, "in the cloud", your project is not important. Learn from it.

As End of Life Nears, More Than Half of Websites Still Use PHP V5

Found on Threatpost on Sunday, 21 October 2018
Browse Software

Despite end-of-life in the horizon, a new report by Web Technology Surveys found that PHP version 5 is still used by 61.8 percent of all server-side programming language websites. And, of those using version 5, 41.5 percent of websites are using version 5.6, the report said.

What this means is, security patches, upgrades and bug fixes will cease for end-of-life technology – putting that percentage of PHP-based websites using PHP 7.0 and below at risk.

With no doubt the writer of this article has not done any research at all and makes the same mistake as many so-called security analysists: blindly relying on version numbers. First of all, every admin should by default set expose_php to off to disable version information so it cannot be collected. That already messes up the numbers in the article. Even worse however is not knowing that the biggest player in the field of server operating systems, namely RedHat (and thus all others based on it, like CentOS), actively supports older PHP versions by backporting security patches. So, as long as admins keep their OS updated, bugs will be squashed, no matter if PHP itself has dropped support or not. Not knowing that should be embarrasssing to anybody who talks about webserver security. So in short, the article is completely misleading and entirely useless without taking the underlying server OS into the count.

Vivaldi 2.0 review: The modern Web browser does not have to be so bland

Found on Ars Technica on Saturday, 20 October 2018
Browse Software

Vivaldi has recently hit the 2.0 milestone. You can download the latest version from the Vivaldi site or install it through the app store or package manager of your OS. And at first blush, perhaps the most shocking thing about this release is that it's merely 2.0. This release is a throwback to an earlier time when version numbers had meaning, and a major number increment meant that something major had happened.

The most important thing for browser is that it actively protects the privacy of the user by all means possible to break tracking and data collection.

You like HTTPS. We like HTTPS. Except when a quirk of TLS can smash someone's web privacy

Found on The Register on Friday, 19 October 2018
Browse Internet

The privacy risks associated with web tracking, however, persist, and now it appears there's yet another mechanism for following people online. Blame researchers from the University of Hamburg in Germany for the latest expansion of the privacy attack surface.

They note that Facebook and Google, due to their behavioral ad businesses, specify longer session resumption ticket lifetimes than most. Facebook's lifetime hint setting of 48 hours is higher than 99.99 per cent of all session ticket hints found. Google's 28 hour value exceeds 97.13 per cent of Alexa's top million websites.

Facebook and Google track you. Facebook in the most aggressive way. Clearly they have learned absolutely nothing from the privacy scandals they went through and just keep on doing business like before.

Remote South Atlantic Islands Are Flooded With Plastic

Found on Smithsonian on Thursday, 18 October 2018
Browse Nature

Now, reports Marlene Cimons at Nexus Media, that pollution is getting even worse. A new study in the journal Current Biology shows that plastic trash on the beaches and in the ocean has increased tenfold in the just the last decade and a hundredfold over the last three decades.

“Three decades ago these islands, which are some of the most remote on the planet, were near-pristine,” lead author David Barnes of the British Antarctic Survey says in a statement. “Plastic waste has increased a hundredfold in that time, it is now so common it reaches the seabed. We found it in plankton, throughout the food chain and up to top predators such as seabirds.”

If only it was possible to dump that junk onto those who created it. Instead, global politics fail so very hard at something so important as protecting the world everybody lives in.