Bonum Certa Men Certa

Security Disinformation

Measuring electricity



Summary: Latest OpenSSL FUD and Microsoft's Howard Schmidt's role informing the public about cyber-security risks

OUR complaints about The Register have intensified recently [1, 2, 3, 4] because of poor articles like this one (see the comments).



The Register spreads FUD about OpenSSL (not the first such smear, after comparisons to "communism" too) and Bradley M. Kuhn from the SFLC has responded as follows:

Ok, Be Afraid if Someone's Got a Voltmeter Hooked to Your CPU



Boy, do I hate it when a FLOSS project is given a hard time unfairly. I was this morning greeted with news from many places that OpenSSL, one of the most common FLOSS software libraries used for cryptography, was somehow "severely vulnerable".

I had a hunch what was going on. I quickly downloaded a copy of the academic paper that was cited as the sole source for the story and read it. As I feared, OpenSSL was getting some bad press unfairly. One must really read this academic computer science article in the context it was written; most commenting about this paper probably did not.

First of all, I don't claim to be an expert on cryptography, and I think my knowledge level to opine on this subject remains limited to a little blog post like this and nothing more. Between college and graduate school, I worked as a system administrator focusing on network security. While a computer science graduate student, I did take two cryptography courses, two theory of computation courses, and one class on complexity theory. So, when compared to the general population I probably am an expert, but compared to people who actually work in cryptography regularly, I'm clearly a novice. However, I suspect many who have hitherto opined about this academic article to declare this "severe vulnerability" have even less knowledge than I do on the subject.


There are much bigger problems to worry about, such as the latest news about Windows botnets [1, 2, 3]. The authors of the Windows exploit might not even face a jail sentence, based on this report.

Three Spanish men were arrested last month for allegedly building an international network of more than 12 million hacked PCs that were used for everything from identity theft to spamming. But according to Spanish authorities and security experts who helped unravel the crime ring, the accused may very well never see the inside of a jail cell even if they are ultimately found guilty, due to insufficient cyber crime legislation in Spain.


Regarding this new article about Scott Charney's outrageous remarks [1, 2] (he worked for the US government before Microsoft hired him), Groklaw wrote 3 days ago: "First Microsoft fills the world with security issues and problems, then it wants the public to be taxed to fix them? I think Microsoft needs to fix its own software itself." Microsoft's own negligence [1, 2, 3] ought to have Microsoft bear the bill.

Howard Schmidt, the US Cyber Czar who came directly from Microsoft [1, 2, 3, 4], claims/pretends that there is no problem, even though many firms that include Google were intruded due to an Internet Explorer hole that Microsoft had knowingly ignored for 5 months [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12] (there are more security patches coming shortly). Even Google source code got grabbed. [via]

Operation Aurora continues to be a hot topic inside and outside of security circles. At this week’s RSA Conference in San Francisco many conversations are on the topic of the attacks that hit Google and dozens of other companies in January.


These reports indicate that proprietary source code got nicked from Google. Microsoft also nicks proprietary source code from companies/projects like Plurk [1, 2, 3, 4], which probably puts the Redmond-based company at the same side as the crackers.

"Cyberwar Hype Intended to Destroy the Open Internet," says this report from Wired. [via]

The biggest threat to the open internet is not Chinese government hackers or greedy anti-net-neutrality ISPs, it’s Michael McConnell, the former director of national intelligence.

McConnell’s not dangerous because he knows anything about SQL injection hacks, but because he knows about social engineering. He’s the nice-seeming guy who’s willing and able to use fear-mongering to manipulate the federal bureaucracy for his own ends, while coming off like a straight shooter to those who are not in the know.


And on the other hand, on the same occasion we find that "US urges 'action' needed to fight net attacks," according to the BBC.

Homeland Security secretary Janet Napolitano has admitted there is an urgent need to step up efforts to protect Americans from cyber attacks.


They seem to contradict themselves. Now they claim to be looking for ideas:

Homeland Security wants to pick your brains



[...]

The lucky winners will be invited to an event in Washington DC in late May or early June. They'll get to partner with the department to lead in the planning of the National Cybersecurity Awareness Campaign, due to launch in October.


Over at CNET, Dennis O'Reilly has this new article about "five ways to keep your [Windows] PC free of viruses and Trojans". Here is one of his suggestions.

If you can't give up Windows, you may still be able to install Linux on an old PC or in a partition of your Windows PC. Then you can use that system (or partition) whenever you engage in any sensitive computer activities. You'll find instructions for dual-booting Windows and the Ubuntu version of Linux on the Ubuntu Community Documentation site.


Thumbs up to Dennis.

"Usually Microsoft doesn't develop products, we buy products. It's not a bad product, but bits and pieces are missing."

--Arno Edelmann, Microsoft's European business security product manager

Comments

Recent Techrights' Posts

(Live-)Stream of Richard Stallman's Latest Talk in Europe (No Longer Live)
The latest public talk and Live-Streamed schedule were announced early on for the public to know about
Richard Stallman is Already in India, Giving Talks About Microsoft Chaffbots and More
he's already giving some talks in India
Drunk on Chatbots, LinuxSecurity.com Spews Out More LLM Slop About "Wine"
They just keep googlebombing "Linux" and "Security" using slop
Gemini Links 24/01/2025: The "Hey Hi" Hype Continues Fading, Tesla/X/Twitter/SpaceX Associate With Nazism
Links for the day
Robbery at the European Patent Office (EPO), Office Staff as 'Prisoners'
publication from the Central Staff Committee, dated yesterday
Techrights in 0.036 Seconds
Combining Gemini and HTTP/S, yesterday we served an impressive number of requests
BetaNews Run by Plagiarism Bots That Googlebomb (for SEO) "Linux"
Google rewards and thus encourages plagiarism
IBM Titles Considered Worthless and Many IBM 'Fellows' Are Vanishing (Also: IBM Staff Inside Linux Attacks the Rights of Computer Users for Recognition or Rewards Like "Distinguished Engineer")
James Bottomley is still "a Distinguished Engineer at IBM"
 
Rumour of IBM 'Bloodbath' in Clown Computing
Performance Improvement Plans mean one step ahead or before layoffs
Dr. Andy Farnell: "Richard Stallman Chose to Stand For the Rights of People to Use Technology as They Wish. He Chose Freedom Instead of Riches."
Keeping busy in public transport
Gemini Links 24/01/2025: Drehgriffel, Computer Science and Capitalism
Links for the day
Microsoft Lost a Ton of Market Share in Web Servers Last Month (the Last Month of 2024) and Massive Losses Continue in 2025, Shows New Report
Microsoft down sharply
Microsoft (Nick Vidal) and Co-opting "Open Future" With Microsoft-led "Open Source AI Definition" (Openwashing LLM Slop and GPL Violations)
Microsoft is tainting all sorts of groups via the OSI
Microsoft, IBM, and Front Groups That Advance Racism for Profit
IBM has profited a lot from racism and it still does
FOSDEM and 'No Nazis'
the issue isn't wealth but principles
Gemini Links 24/01/2025: "Social" Control Media is Unsatisfying; An Old Call for a Gemini Without TLS
Links for the day
[Meme] Levels of Outrage
Apparently it's hip for criminals to leverage "the law" to silence their exposers
Links 24/01/2025: Earthquake, Landslide, and Official Implicated in Airplane With Landing Gear Issues (Boeing Plane) "Found Dead"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, January 23, 2025
IRC logs for Thursday, January 23, 2025
CDN Giant: Microsoft Bing and Skype Collapsed Since the LLM Hype, Same as Other Metrics Show
No wonder Microsoft managers suffer anxiety and there are several waves of layoffs even on the same month
Gemini Links 23/01/2025: Experience With Outer Wilds and Gifting a Site
Links for the day
Slopwatch: Fake 'Articles' About Linux by Brian Fagioli and by Brittany Day in BetaNews and linuxsecurity.com (LLM Slop Sites That Are Online Leeches or SEO Operations Working Against Free Software Journalism)
Two new examples for today
Links 23/01/2025: More Overt Constitutional Violations and "TikTok Executive Order" (White Flag to CCP)
Links for the day
Status of New Year's Resolutions
3 weeks later
"The AI Bubble is Popping", Now It's Bailout Time
The hype will quietly fizzle, just like "blockchains"
[Meme] When the Government of the Netherlands Participates in Your Crimes It Lacks an Incentive to Hold You Accountable for Crimes
the EPO's corrupt management boasted (on television) that it would ignore rulings against it even if issued by the highest Dutch court
Links 23/01/2025: US Constitution Already Besieged (Impeachable Offences Pile Up), Arrest Warrant for Assad
Links for the day
Microsoft's Head of Business Development Quits (Days After Two Large Waves of Mass Layoffs)
We recently learned that people close to the management are very stressed this month
[Meme] Reliable Sources
Sooner or later LLMs swallow up their own lies (that they generated), which means that over time those things will only deteriorate further, exacerbating an already-large misinformation pandemic
BetaNews Plagiarising Work in the Linux Space
The originals won't even be listed
Gemini Links 23/01/2025: US Politics and DevOps Career
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, January 22, 2025
IRC logs for Wednesday, January 22, 2025
Links 22/01/2025: Jeju Air Blame-Shifting (Talk to the Wall), Copyright Maximalism Rebounds
Links for the day
[Meme] The 'Garbage in, Garbage Out' Patent Office
"law of the buzzword"
Clueless and Nontechnical EPO Management Uses the 'Great Scam' (Hey Hi Hype) to Justify Automation Where It's Both Detrimental and Illegal
The EPC has been practically set aflame; thus, the EPO has no legitimacy or reason to exist anymore
Links 22/01/2025: Democratising Tech Initiative and "Bye Bye Meta"
Links for the day
The Japanese translation of the term "free software"
by Akira Urushibata
Links 22/01/2025: "The AI Bubble Is Bursting" and Microsoft's Scam Altman is Already Looking for De Facto Bailout From the Insurrectionist
Links for the day
Dr. Andy Farnell's Latest Article About Software Freedom and Richard Stallman
why Dr. Stallman is being picked on
Geminispace (Gemini Protocol) Offers an Escape From Social Control Networks Owned by Oligarchs and Governments
Gemini capsules that promote fascism and retreat to feudalism are rare and scarce
The Free Software Foundation (FSF) Has Formally Added an Outreach and Communications Coordinator
Maybe the addition happened last year (we mentioned it in passing), but now it's in the "rota"
Electronic Frontier Foundation: Fighting 'for the Poor and Powerless' While Taking Home $336,000 in Annual Salary
nowadays works for or serves not the interests of the masses
Of Note: The Misguided, Infiltrated, Weakened Electronic Frontier Foundation (EFF) Now Operating at a Loss of Over a Million Dollars
Worst since the COVID-19 lockdowns
Free Software Foundation's Miriam Bastian: We Surpassed Our Year-end Goal of $400,000 USD Thanks to You!
Miriam Bastian: We surpassed our year-end goal of $400,000 USD!
[Meme] Omit Microsoft When It's a Scandal or a Breach, Whereupon It Becomes Just an 'IT Company'
Microsoft is like a cult. Members of this cult promote the opposite of security, expecting to be financially rewarded for it.
Calling Out Windows (TCO) is Apparently Impermissible in Some News Sites
The online news sites are failing us (and corporate sponsors play a role)
Richard Stallman's Remarks on His Pain
Published two days ago
Focusing on the Issues
we'll do our best to find the news and not talk about "Mr. T"
Only About 3.6% of Web Users in Pakistan Use Vista 11, According to statCounter
It's not hard to see why so far in 2025 Microsoft has already had several waves of mass layoffs - more than any other company
Rumour: In IBM, Impending "25% Reduction in Finance Roles"
25% to be laid off?
[Meme] Fake Articles From linuxsecurity.com (Just Googlebombing "Linux" With LLM Slop)
Google should really just entirely delist that site
RedHat.com Written by Microsoft Staff, Promoting Microsoft' Proprietary Software That Does Not Even Run on Linux!
This is RedHat.com this week...
Links 22/01/2025: Mass Layoffs at Stripe, Microsoft's Illegal Accounting Practices Under Scrutiny
Links for the day
Fake 'Article' by Brittany Day (Guardian Digital, Inc) About Linux Mint 22.1 'Xia'
Apparently they've convinced themselves that this is OK
Red Hat Dumps "Inclusive Language", Puts "Master" In Official Communications and Headlines
Red Hat: you CANNOT say "master" (because it is racist). Also Red Hat: we put in it our headlines.
Red Hat Offers DRM, TPM, and Backed Doored 'Confidential' Containers (CoCo) for Microsoft (Proprietary Spyware)
No kidding!
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, January 21, 2025
IRC logs for Tuesday, January 21, 2025