Bonum Certa Men Certa

Panic Over Transport Layer Security (TLS) Flaw Which is Already Patched

Bad news sells better

Summary: What the media is not really telling us about the GnuTLS vulnerability

The corporate press has shown its ignorance by characterising GNU as "Linux" and describing an already-patched flaw as the worst thing since proprietary software. Some went as far as suggesting that the NSA was behind it [1] and Muktware rebutted [2] the seminal article [3] which started a lot of the panic (at the time of writing there are dozens of articles about this, but we don't need to feed them with links). What we have here is another case of Dan Goodin creating panic in the Microsoft-friendly Ars, just as he had done when he worked for the Microsoft-friendly The Register. The only shocking thing is the amount of press coverage this received. PGP/GPG, OpenSSH, OpenSSL etc. were previously named here for flaws that had been found (in the context of Red Hat and the NSA [1, 2, 3]). These are not so uncommon. One just needs to keep up to date (patched) -- one that which Apple's customers cannot do. They can't even write their own patches.



Related/contextual items from the news:


  1. NSA did it again? This time GnuTLS fails to check malicious certificates


  2. Yes there was a security hole in Linux, but Red Hat already fixed it
    Originally reported by Ars Technica, the fix was available by the time the general public was made aware of it. It’s actually fairly similar to a certain security hole that lived for a year and could have allowed for exploits to be used in the wild.


  3. Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping
    The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn't be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers.

Recent Techrights' Posts

GAFAM and "MATA"
The use of dark humour there hopefully helps illuminate what a lot of "modern" technology became like and how it interacts with human civilisation (to what ends and whose gain)
Flying in 2025
worse than ever before
The UEFI 9/11 - Part III - Chaos is Scheduled to Happen Second Thursday of September (No Matter What the Microsofters Tell You)
The clock is ticking
Downplaying the Impact of "UEFI 9/11" is a Losing Strategy
we won't publish much whilst on holiday
 
How Not to Build Software
code forges that need a Web browser perhaps fill some 'niche' demand
Birds Are Not "Pests and Vermin", Privacy is Not a Crime, and GNU/Linux is Not 'Hacking Platform'
I could not help but think of Free software analogies
The Sites Should Be Very Fast Again
That issue is now resolved
Activists, Including Technical Activists, Need Not Pursue Affirmation
Techrights doesn't play or participate in a "popularity contest"
Government Sites Should Run Free Software
Not proprietary bloatware with buzzwords
LLM Slopfarms Take No Breaks
When people run sites by bots they don't need to worry about "breaks"
GNOME Having a Meltdown Again
Thanks and farewell to Steven Deobald
Gemini Links 30/08/2025: Low Tech and Hunchbin 1.0.6
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, August 29, 2025
IRC logs for Friday, August 29, 2025
Financiers and Sponsors of the Slop Hype (Pyramid Scheme Waiting to End, Bubble That Will Inevitably Implode)
It's also burning the planet
Slopwatch: Fake Articles About "Linux", Google Helps Ponzi Schemes and Slopfarms in Google News
Slopfarms are a real pain
Gemini Links 29/08/2025: Retiring at 62 and URL Filtering HTTP(S) Proxy on Qubes OS
Links for the day
Links 29/08/2025: Lisa Cook Sues Convicted Felon and Backdoor Mandate in UK Resisted
Links for the day
Links 29/08/2025: Arti 1.5.0, War on Public Health (CDC), and Slop 'Bros' Made to Pay for Their Mass Plagiarism
Links for the day
Representing and Speaking for Animals
If I ever choose to take this matter to tribunal with animals-centric NGOs on my side, it'll get some press coverage for sure
No, 4Chan is Not Fighting for You by Lawyering Up Against Ofcom (UK)
Don't mistake proto-fascists for people who "fight for you". They don't.
In Many Places in the World Vista 11 "Market Share" is Going Down, Not Up
In some countries Windows is already down to third place or lower
More Microsoft-Connected Layoffs, at Least Third Time This Month! (Also Another Death on Campus)
Microsoft as a "gaming" company is where studios, projects, games, and even developers come to die
Slopwatch: Fake Articles About "Linux", Slop Images in VentureBeat, Linux Foundation Spam Made With LLM Slop and Slop Images
The only relief or upside - if any exists - is that the pace of slop was down a bit this week
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, August 28, 2025
IRC logs for Thursday, August 28, 2025
Gemini Links 29/08/2025: Poems, Games, and Java 25 Performance
Links for the day
Links 28/08/2025: Greenland 'Interferences' by US and Skinnerboxes to Get Banned in Korean Schools
Links for the day
Richard Stallman (RMS) Talk in Ethereum Cypherpunk Congress Will be Remote
This past week RMS received lots of accolades online
The Register MS (Run by Microsoft Operatives): Free Software is Putin, Hence Evil and Dangerous
The current editor in chief is an American Microsofter, the previous one went to work for Google (US)
Links 28/08/2025: Chatbots Distorting/Fabricating History and Also Driving Suicide
Links for the day
Gemini Links 28/08/2025: Back in Japan and Why "Hacker News" Sucks
Links for the day
A Much-Needed Wake-up Call to Users of Wordpress.com, Blogspot, Substack and All Those Other Outsourced (and Centralised) Platforms
There are several lessons in there
The UEFI 9/11 - Part II - Campaign of Censorship and Defamation Against Critics
In dictatorships, humour serves an important role. It's tragic.
Open Source Initiative (OSI) Resists Software Freedom, Even by Attacking Its Own
The OSI is compromised
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, August 27, 2025
IRC logs for Wednesday, August 27, 2025
Slopwatch: linuxsecurity.com, Slopfarms in Google News, and More
Some readers of ours end up sending us links that are from slopfarms, not realising those are slopfarms