Bonum Certa Men Certa

The Latest FOSS FUD Revolves Around Fakes and Bogus Arguments

Summary: How Free/Open Source Software (FOSS) gets discredited over "security", based on something which has nothing to do with FOSS and more to with human error or social engineering

THE reports from IDG make it sound as though FileZilla is a security threat [1,2] when it fact it is fakes that are a threat, as Sean pointed out to counter these allegations [3].



Yesterday we took note of the trend and two days ago we gave some examples of security-flavoured FUD against Android, of which there is plenty these days (and even today). Some of it is correctly being characterised as platform-agnostic [4]. This sometimes requires user intervention [5] or social engineering [6], so there's a lot more to be taken into account. When the OpenSSL project got compromised some weeks ago it was actually the fault of a weak password [7,8], but some of the media spread FUD about OpenSSL itself. Weak passwords are a common human error [9] and those who don't encrypt E-mails that contain passwords (they should!) only have themselves to blame [10,11]. To get an example of real vulnerability, consider Apple's Safari storing passwords in plain text [12]!!! GNU/Linux, by contrast, facilitates strong encryption and has protection against all sorts of attacks [13-14].

Blaming FOSS for issues that relate to social engineering is a common FUD pattern these days (like blaming Android for users installing malware they download outside repositories), but the real security issues are back doors like Microsoft's, security flukes like Apple's, and data leakage through so-called 'clouds' (which are typically promoted by proprietary software players, tightly connected to the crack-leaning NSA).

Related/contextual items from the news:



  1. FileZilla warns of large malware campaign


  2. FileZilla warns of large malware campaign


  3. FileZilla, Other Open-Source Software From 'Right' Sources Is Safe
    A basic tenant of open-source software security has long been the idea that since the code is open, anyone can look inside to see if there is something that shouldn't be there.


  4. Java-based malware driving DDoS botnet infects Windows, Mac, Linux devices
    The cross-platform HEUR:Backdoor.Java.Agent.a, as reported in a blog post published Tuesday by Kaspersky Lab, takes hold of computers by exploiting CVE-2013-2465, a critical Java vulnerability that Oracle patched in June. The security bug is present on Java 7 u21 and earlier. Once the bot has infected a computer, it copies itself to the autostart directory of its respective platform to ensure it runs whenever the machine is turned on. Compromised computers then report to an Internet relay chat channel that acts as a command and control server.


  5. Yahoo users exposed to malware attack
    Users clicking on some ads are redirected to sites armed with code that exploits vulnerabilities in Java and installs a variety of different malware.


  6. Password Security Requires Multiple Layers of Protection
    The gist of the story is that "123456" is now the most commonly used weak password—surpassing the use of the word "password."


  7. No hypervisor vulnerability exploited in OpenSSL site breach
    The OpenSSL Project confirmed that weak passwords used on the hosting infrastructure led to the compromise of its website, dispelling concerns...
  8. OpenSSL site defacement involving hypervisor hack rattles nerves (updated)
    Code repositories remained untouched in the December 29 hack, and the only outward sign of a breach was a defacement left on the OpenSSL.org home page. The compromise is nonetheless rattling some nerves. In a brief advisory last updated on New Year's Day, officials said "the attack was made via hypervisor through the hosting provider and not via any vulnerability in the OS configuration." The lack of additional details raised the question of whether the same weakness may have been exploited to target other sites that use the same service. After all, saying a compromise was achieved through a hypervisor vulnerability in the Web host of one of the Internet's most important sites isn't necessarily comforting news if the service or hypervisor platform is widely used by others.
  9. 7 sneak attacks used by today's most devious hackers


  10. 10,000 Top Passwords
    Back when I wrote Perfect Passwords, I generated a list of the top 500 worst (aka most common) passwords which seems to have propagated quite a bit across the internet, including being mentioned on Gizomodo, Boing Boing, Symantec, Laughing Squid and many other sites. Since then I have collected a large number of new passwords bringing my current list to about 6,000,000 unique username/password combos, including many of those that have been recently made public*.


  11. All Your Internet Are Belong To Iceland*
    All that being said, and given that the Luddite solution of forsaking the Internet may not be terribly practical, this is another reason to encrypt technical data that you are sending by email even if the recipient is a U.S. person firmly planted on U.S. soil. No, the encryption isn’t a defense to the violation, but it is at least a mitigating factor. Remember, as I posted last May, that the U.S. military thinks it can put ITAR-controlled technical data on a Chinese satellite if it’s encrypted; so if you don’t have anything else to say in your defense when an email with export controlled data accidentally wanders through Lithuania, you will at least have that. And maybe one day in the distant future, BIS and DDTC will admit that the Internet exists and that encryption works.


  12. Older Versions of Safari Store Login Info in Plain Text
    Older versions of Safari for Mac store unencrypted user login credentials in a plain text file, according to security firm Kaspersky (via ZDNet). Safari saves the information in order to restore a previous browsing session, reopening all sites, even those that require authentication using the browser's "Reopen All Windows from Last Session" functionality.


  13. Quantum crypto pitches for data centre links


  14. Linux Is the Only Way to Protect Against Potential Sound-Transmitted Malware


Recent Techrights' Posts

Gemini Links 21/08/2025: The Attraction of Back Alleys, Initramfs, and BSD ISPs
Links for the day
 
Latest Is Not Greatest: The Case of "Foldable" Tech
don't be shamed into abandoning old things just because the "fashion industry" of Apple and Samsung tells you to
Airlines and Their Tricks That Only Work in the 'Digital Age'
People sceptical of the direction technology has taken are not "Luddites"
Open Source Initiative (OSI), Which Became a Propaganda Front of Microsoft and "Hey Hi" (Hype, Misnomer), Wants You to Forget These Scandals
A lot of these issues won't be set aside until there's a resolution
The Culture of Overnight Coding
An industry-wise push-back is needed
Windows Down to New Lows in Guinea Bissau and Many Countries Around It
If Android is accounted for, Windows is down to about 10%
Gemini Links 21/08/2025: Modern Dating, Debian 13, and Apache
Links for the day
Microsoft Has Had About 10 Waves of Mass Layoffs So Far This Year (Not Two as Mainstream Media and Slopfarms Endlessly Claim)
Notice how the MSM (Mainstream Media) never mentions the debt of Microsoft. It is a conscious, deliberate decision.
Slopwatch: Sites Gone Rogue, Google Promoting Lies, and DDoS Attacks by Plagiarism Giants
Charlatans and frauds engage in a war against artistic industries, mislabeling plagiarism as "AI"
Links 21/08/2025: Covid Cases on the Rise, "Social Media Trolls", Russia's Attacks Intensify
Links for the day
Links 21/08/2025: Stephanie Shirley Dies and "Groklaw Domain Hijacked?"
Links for the day
Search in 2025 (Age of DDoS Attacks Under the Guise of "AI" "Innovation")
One common concern when things go "live" is that any random bot out there can execute queries, pumping up RAM and CPU usage, as happened when we used MediaWiki and WordPress
Using Slop for Images Does Not Make Your Site Look Advanced or Witty, It Just Makes Your Whole Work Look Like Presumed Plagiarism
Lazy slobs and Serial Sloppers use the guise/excuse of "AI" to plagiarise and spam the Web
Financing of the "Hey Hi" (AI) Bubble by Those Who Profit From Planetary Destruction (Global Warming)
It's about personal gain, too
Richard Stallman Will Speak in Ethereum Cypherpunk Congress
it's good to see that the FSF pays considerable respect to it founder, who is moreover invited to speak at events
(At Least) Second Wave of Mass Layoffs in Microsoft This Month
This is not the first time this month that Microsoft has mass layoffs
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, August 20, 2025
IRC logs for Wednesday, August 20, 2025
IBM Operatives Inside The Register MS and More Shady Money to Follow
The Register MS bites every banknote it can sink its teeth into
On the Internet, Nobody Knows Microsoft and Windows Are Becoming Niche Players Until Data is Shown Correctly, Not Microsoft-Sponsored Articles in Microsoft Publishers
Microsoft controls a lot of publishers and thus it controls information
Slopwatch: Serial Sloppers and Slopfarms in Google News (e.g. Linux Journal and WebProNews)
Google plays an active role (if not deliberately then through utter neglect and carelessness) in plagiarism
Links 20/08/2025: Mass Surveillance Framed as "Artificial Intelligence" (All Old Things Reworded to Misframe Old Computer Issues), Europe Resists Capitulation to US(SR)
Links for the day
Gemini Links 20/08/2025: Trips and Permacomputing
Links for the day
Links 20/08/2025: Oracle Layoffs in India, "AI" Scammers/Profiteers Admit It's a "Bubble", Softbank-Saudi (Oil) Control Tech Companies
Links for the day
Social Control Networks Give You False Metrics to 'Addict' You To Them
Leaving social control media may seem hard, but the same is true for any other addiction
A Lot of What Happened in Twitter Was Bots, Botfarms, and Troll Farms. It's Even Worse Now (Under X.com) and People Are Noticing.
Last month we said the same was happening in YouTube
Microsoft May Have Become - at Least Partially - Like a Boiler Room Scam
Giving imaginary salaries using imaginary tokens based on imaginary value (with restrictions on conversion to cash)
In Vietnam, Microsoft's Search Engine "Market Share" Fell to Almost 0%, CocCoc More Than 5 Times Bigger
Why are people still investing in this company?
All That's Left of MSNBC (Microsoft-NBC) is Microsoft NOW
When plutocrats and large corporations (even deep in debt) buy all the communication channels
The Register MS, Paid to Promote "AI" Hype, Does "Sez" (Says) Pieces
every bubble-funded "news" site tries to make it a story about "AI"
Many Companies Are Run by Liars Who Ride Other People's Money
Or steal it
Before CoreAI There Was Builder.ai
GitHub isn't about "AI" (just a bunch of lies and storytelling for shareholders' patience)
Microsoft Windows in Croatia at New Lows
We've been keeping track of this trend for a while
Using the Best Tool/s for the Job: RSS Feeds and RSS Readers
Use RSS feeds. Reject those "modern" Web things
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, August 19, 2025
IRC logs for Tuesday, August 19, 2025
Gemini Links 20/08/2025: Neovim, XML, and Alhena 5.2.9
Links for the day