Editors • About the Site • Comes vs. Microsoft • Using This Web Site • Site Archives • Credibility Index • OOXML • OpenDocument • Patents • Novell • News Digest • Site News • RSS

05.14.15

Links 15/5/2015: Skrooge Releases, Linux 3.14.42, Linux 3.10.78

Posted in News Roundup at 9:07 pm by Dr. Roy Schestowitz

GNOME bluefish

Contents

GNU/Linux

  • An Unlikely Ambassador

    I would consider myself an unlikely Linux ambassador. Not that I hide any Linux use or fascination but that I am not out there on a mission to encourage or convert people to Linux. Mostly it would be an occasional conversation about me using Linux for something or a conversation where I am explaining that there are more operating systems then just Windows or OS X. Most of the time my Linux conversations are with those that already have some connection to Linux. To be honest I have probably been a much bigger “Ambassador” to LibreOffice than to Linux; and I am not an uber LibreOffice or ODF fan boy but one that believes for most basic users it will work just fine without all the Microsoft expense. All of that has taken a slight detour within the past couple of weeks.

  • Desktop

    • HP is Putin Ubuntu Linux on Russian computers

      Some Windows partners, such as Dell, offer Linux-based operating systems as an alternative, but this is few and far between. HP, however, is planing to sell machines in Russia running the Ubuntu operating system. I suppose you could say the company is Putin (puttin’) Linux on the desktop there!

    • Legacy Modernization Applications for Linux

      Like many companies, your company may depend on Linux for its main operating system. For nearly a quarter century, Linux has been pivotal for organizations all over the world. While it definitely comes with a number of benefits, it’s important to remember that any system built on Linux is still susceptible to old age. After enough time, your software could even become obsolete. According to Gartner, for example, the average data center is nine years old. However, after seven years, Gartner says that these data centers begin becoming outmoded. This helps illustrate why legacy modernization is such a vital process to carry out regularly.

    • Terminal Emulation Applications for Linux

  • Kernel Space

  • Applications

  • Desktop Environments/WMs

    • K Desktop Environment/KDE SC/Qt

      • Skrooge 1.12.0 released

        The Skrooge Team announces the release 1.12.0 version of its popular Personal Finances Manager based on KDE Frameworks.

      • Skrooge 2.0.0 Beta available

        The Skrooge Team announces the availability of 1.99.75 version of its popular Personal Finances Manager based on KDE Frameworks. This is a Beta version intended for users willing to help us by testing the KF5 port before the final Release.

      • Simple Qt container optimization you should do on your code

        Most of us know we shouldn’t let our containers detach. QList, QVector, QString, etc. are implicitly shared. Copying them is cheap, but when we call a non const member function it will detach and trigger a deep copy.

      • Qt 5.5 Now Plans To Ship At The End Of June

        Qt 5.5 has been running behind schedule for some time while now The Qt Company is trying to get it back on track and to officially ship Qt 5.5 by the end of next month.

    • GNOME Desktop/GTK

      • GNOME Asia 2015 impressio

        I must to congrat all the enthusiasm and effort from many young students supported by experienced people, leaded by Estu Fardani. There are lots of Linux users in Indonesia and I saw the willing to contribute with the GNOME project. I met Estu in person and I found more friendly local people: my new dear friend Deetah, Harris, Utian, Aris, Kukuh, Fahmi, Moco, Pico, Siska, Lenin & the awsome Sendy!

      • GNOME 3.16.2 released

        The second update of GNOME 3.16 is out with many bug fixes, documentation improvements, translations updates, and more. We hope you’ll like it.

      • GNOME 3.16.2 Released

        GNOME 3.16.2 was announced this afternoon by Red Hat’s Matthias Clasen. The GNOME 3.16.2 release contains numerous bug fixes, documentation updates, translation updates, and other minor work. GNOME 3.16.2 release information can be found via this mailing list post.

      • Orca Open Source Screen Reader Receives Major Update for GNOME 3.16.2

        We reported earlier this week that the hard-working developers behind the acclaimed GNOME desktop environment used by default in numerous GNU/Linux distributions, including Ubuntu GNOME and Fedora, are preparing the second and last point release of GNOME 3.16.

      • GNOME Shell and Mutter Get Minor Updates for GNOME 3.16.2

        The GNOME Project has just announced the general availability of the GNOME 3.16.2 desktop environment, the second and last maintenance release of the 3.16 series.

  • Distributions

    • The death of Foresight Linux

      There are many different Linux distributions, and some last for longer periods of time than others. Foresight Linux is a distribution that has finally reached the end of the road, and will no longer be developed.

    • Reviews

    • New Releases

    • Red Hat Family

      • Red Hat Wins SIIA Software CODiE Awards for Best Cloud Management Solution and Best Open Source Innovation

        Red Hat CloudForms and Red Hat Enterprise Linux 7 Earn Prestigious Industry Recognition

      • Fedora

        • The One Problem I Have So Far With Fedora’s DNF Package Manager

          There’s one gripe I continue to have with DNF but at least it doesn’t mean the end of the world… DNF is mostly a drop-in replacement to the Yum command and when calling yum on Fedora 22 it will end up redirecting to dnf. One of the few exceptions though to where DNF is a drop-in replacement for Yum is supporting the –skip-broken argument.

        • Fedora 21 vs. Fedora 22 Benchmarks

          For those curious how the performance of Fedora 22 is shaking out, here’s some early benchmarks comparing the Fedora Workstation 21 and Fedora Workstation 22 (with all updates as of the final freeze) in various workloads.

          Plenty of Fedora 22 benchmarks are in the works now that this Red Hat backed Linux distribution is gearing up for release and has settled down with its many changes and new features. The Fedora 22 state tested was with the Linux 4.0.2 kernel, GNOME Shell 3.16.1, Mesa 10.5.4, and GCC 5.1.1 while using an EXT4 file-system. On the same exact Intel ultrabook, Fedora 21 was also re-benchmarked both in stock form and with all available updates as of 12 May.

    • Debian Family

  • Devices/Embedded

    • Mouser adds to open source board sales channel

      The distributor’s Open Source Hardware Technology website now has an updated product selector which allows users to select a board from 30 different parameters including processor type and speed, memory and expansion capabilities, wireless and wired networking, user interface options, video connectivity.

    • CHIP: $9 Linux ‘micro-computer’ hits $1m Kickstarter funding in four days

      THE CHIP ‘MICRO-COMPUTER’ that costs just $9 (£5.85) has reached over $1m in funding just four days after arriving on Kickstarter.

    • Raspberry Pi Model B+ price cut to just $25

      The Raspberry Pi B+, which was previously priced at $35, has had its price cut to just $25. The price cuts have already gone into effect on the primary Raspberry Pi stockist websites: RS Components in the UK (£16) and MCM Electronics in the US ($25).

      According to Raspberry Pi, the price reduction was made possible by “production optimizations,” though no specifics were given. At first glance, there don’t appear to be any board- or component-level changes, though Raspberry Pi might not have updated its product images yet.

    • Phones

Free Software/Open Source

  • In Free Software, it’s okay to be imperfect, as long as you’re open and honest about it

    In the FOSS world, people seem more likely to really see the person, not just the community they belong to. And from a person, they expect that they really and honestly feel sorry if they made a mistake. And they seem to be more forgiving if a FOSS contributor admits a mistake and apologizes than if a proprietary software company does. It’s not only individuals, though. It seems like even companies in the FOSS field are expected to be more open and honest than those in the proprietary software field.

  • Free Software and Free Culture: Open Source’s Influence on Society

    In an age when Microsoft (MSFT) is floating the idea of open-sourcing even Windows, it’s clear that open source has pretty much conquered the world of software—or the parts of it that matter, at least. But, in a lot of ways, the weight of open source is now extending into many other realms, defining how people interact and collaborate well beyond the context of computers. That’s a fascinating issue, and it gives the key to understanding what could be the ultimate legacy of the free and open source software movements.

  • 5 open source remakes of classic PC games you won’t want to miss

    Buying the latest games will typically get you top-quality graphics and an iTunes-ready soundtrack, but that won’t necessarily translate into compelling gameplay. And even if it does, there’s no guarantee you’ll be kept entertained for more than a few hours. The solution? Try one of these open source takes on classic PC games.

    Sure, the graphics won’t be as good. There is no chance you’ll want to download the soundtrack, and there will probably be odd glitches and bugs here and there. But, you can be sure the central concept will be great (it’s what inspired the remake in the first place). It’ll have been developed by people who love it, rather than just because they want your cash. And as, in most cases, the projects are still evolving — with new features, content, missions, expansion packs — you’ll want to keep playing for a long, long time.

  • Google stomps on scammers — and helps open source

    A recent rules change to Google Adwords may make it easier for open source projects to protect their good reputation

  • Cloud Security Alliance, Waverley Labs Collaborate On Open-Source Software-Defined Perimeter Spec

    The Cloud Security Alliance (CSA), a group that promotes security best practices for cloud computing, is making progress on its plans to develop a software-defined perimeter (SDP) framework for protecting Internet-connected systems against a range of security threats.

  • Web Browsers

    • Mozilla

      • Letter To Mozilla

        We are a group of Free Software advocates from Melbourne Australia and supporters of the Mozilla Foundation and its goals. While we would usually hold Mozilla in high esteem, on this International Day Against DRM we feel compelled to join the FSF and Defective By Design in condemning Mozilla’s decision to include proprietary mechanisms (Encrypted Media Extensions) in Firefox.

        We understand that you are trying to do what makes content owners comfortable lest they not allow their content on your browser; you have outlined this in the article “DRM and the Challenge of Serving Users”. However it seems that your focus is on the short term, compromising your values to retain existing users, rather than protecting them in the longer term. That article significantly neglects any mention of the harms caused by such proprietary technologies, and how they lead users to inflict this harm upon themselves.

      • FREE Firefox?

        The challenge is, going from the Firefox start page, find a way to download the FREE version, without using external websites (so no Google search).

  • SaaS/Big Data

    • Nexenta Extends Its Market Leadership in Open Source-driven Software-Defined Storage at OpenStack Summit; End-to-End Integration Into OpenStack Framework
    • Pentaho ignites Apache Spark orchestration

      Orlando-based open source analytics company Pentaho is ‘in the process of being acquired’ by Hitachi Data Systems, but the brand appears strong enough to be retained 100% intact inside of the new parent company.

    • How to become a valued OpenStack contributor

      Most PTL’s are elected because they are the most technical contributor on a particular project. They are rarely elected for leadership skills. Most of our top technical contributors struggle with leadership, and naturally shy away from it. This frequently leads to dysfunction in community dynamics, as the PTL continues to focus on contributing at a very high level, and puts limited effort into leadership work. Doing things like setting project vision, tracking and celebrating milestones, providing team members with actionable feedback, and sharing the project vision with community members outside the project are all good ways of exhibiting leadership. Doing those things as a part time effort can yield limited results in terms of team unity, and effectiveness. My suggestion to open source project leaders is to earmark considerable time for leadership work, and scale back direct contribution work. A well empowered, motivated, and effective team can produce much more velocity than a PTL individually focused on strong contribution, and ignoring leadership responsibilities in order to do it.

  • CMS

    • Open source a clear choice for CMS development

      As time went on, we simply continued to ride the open source path. We assembled a huge collection of functional applications we had built for client sites that could be added to and modified for new ones. Shopping carts, contact forms, opt-in email list managers, employment opportunity listings, content editors, slide shows, all built as open source using PHP.

      A few years later came the emergence of Content Management Systems, which contained—as a package—many of the functional elements we previously had relied upon our own resources to create. Drupal, Joomla!, WordPress, and others were emerging as the default new development platforms for most digital agencies who had followed the same path as ours.

  • FSF/FSFE/GNU/SFLC

    • Free Software Foundation announces deputy director search

      The Free Software Foundation (FSF), a Boston-based 501(c)(3) charity with a worldwide mission to protect freedoms critical to the computer-using public, would love to find an experienced, Boston-based deputy director to expand our leadership team.

  • Licensing

    • Linux Foundation Updates SPDX Compliance Effort

      Back in 2010, the Linux Foundation first launched its Software Package Data Exchange (SPDX) effort that helps to build out and identify software components in a standardized manner. Since then, use of SPDX has grown, and on May 12 the SPDX 2.0 specification was announced. The new specification aims to be even more comprehensive in helping organizations understand the open-source licenses that are used as part of an application deployment.

  • Openness/Sharing

    • Open Source Project Hopes To Offer $23,000 EV With 186 Miles Range

      An open source project is currently in the works to build an electric vehicle powered by in-wheel motors.

      The goals are ambitious: 1) Build an electric vehicle with a minimum range of 186 miles that can theoretically be put into production and sold for under $22,700. 2) Share the design so that others can replicate or customize the platform. 3) Do it all in less than a year.

Leftovers

  • Hardware

  • Security

  • Defence/Police/Secrecy/Aggression

    • The Jeb Bush Adviser Who Should Scare You

      Paul Wolfowitz not only championed the Iraq War—he obsessively promoted a bizarre conspiracy theory.

    • Ignorance and attempts to rewrite WWII history – that’s what makes me sick

      Everybody in this country is perfectly aware of the fact that we were allies with the British, the French, and of course, the Americans whom we gloriously linked-up with on the River Elbe in April 1945. But we also remember how from the very beginning, in 1939, the West was hoping to orient Hitler to the East and make the German socialists and the Russian communists kill each other. Yes, Moscow did get tons of American supplies under the Lend-Lease Act passed in 1941, and the Northern convoys to Murmansk were a manifestation of real heroism by the Royal Navy. We also cherish the memory of the French Normandie-Niemen air squadron and Le Resistance, but the Russians will never forget that we had to suffer three long years, until our brothers in arms finally landed in Normandy in 1944. That reduced the distance between D-day and VE-Day for them to just 10 months, while for the Russians it was 46 long months of war… For the first time since 1941 Moscow really celebrated Victory on March, 26, 1944 – the day the Soviet troops crossed the River Prut and recaptured the state border. By the time the allies crossed the Channel three months later the Red Army had started its victorious march across Europe, liberating Romania, Hungary, Bulgaria, Czechoslovakia, Austria and Norway. The heaviest price we paid during this operation was for ousting German troops from Poland: 600,000 Soviet soldiers were killed on Polish soil.

  • Transparency Reporting

    • Born Kneeling

      Rusbridger and his extraordinary wig go on and on as a pretend opposition outlet, their reputation much dented by recent hysterical unionist output which exceeds the Daily Express. But Rusbridger’s continued usefulness to the establishment is not in doubt. The pose of publishing the most harmless of Prince Charles’ letters does little to help a threadbare disguise.

  • Censorship

    • David Cameron to unveil new limits on extremists’ activities in Queen’s speech

      A counter-terrorism bill including plans for extremism disruption orders designed to restrict those trying to radicalise young people is to be included in the Queen’s speech, David Cameron will tell the national security council on Wednesday.

      The orders, the product of an extremism task force set up by the prime minister, were proposed during the last parliament in March, but were largely vetoed by the Liberal Democrats on the grounds of free speech. They were subsequently revived in the Conservative manifesto.

  • Privacy

    • [tor-relays] Please enable IPv6 on your relay!
    • Exposure to ideologically diverse news and opinion on Facebook

      Exposure to news, opinion and civic information increasingly occurs through social media. How do these online networks influence exposure to perspectives that cut across ideological lines? Using de-identified data, we examined how 10.1 million U.S. Facebook users interact with socially shared news. We directly measured ideological homophily in friend networks, and examine the extent to which heterogeneous friends could potentially expose individuals to cross-cutting content. We then quantified the extent to which individuals encounter comparatively more or less diverse content while interacting via Facebook’s algorithmically ranked News Feed, and further studied users’ choices to click through to ideologically discordant content. Compared to algorithmic ranking, individuals’ choices about what to consume had a stronger effect limiting exposure to cross-cutting content.

    • NSA’s Loudest Defenders Have Financial Ties to NSA Contractors

      The Intercept’s Lee Fang has highlighted a few examples of loud National Security Agency allies that have financial ties to the agency and mass surveillance. The list includes Stewart Baker, the general counsel to the NSA from 1992 through 1994, Fox News military analyst Jack Keane, Retired General Wesley Clark, former Central Intelligence Agency chief James Woolsey, former Republican National Committee chair Jim Gilmore, former NSA director Mike McConnell, and Center for Strategic and International Studies President John Hamre. They have surfaced regularly in the media to denounce Snowden, and in the case of Woolsey, to call for Snowden to be “hanged by his neck”.

    • Many of the NSA’s Loudest Defenders Have Financial Ties to NSA Contractors

      Due to the secretive nature of the agency’s work, NSA contracts are often shielded from public disclosure, and identifying financial links between pundits and the agency’s web of partners is tricky. But the work of journalists and whistleblowers such as James Bamford, who was assigned to an NSA unit while serving in the Navy, gives us a sense of which companies work for U.S. intelligence agencies. Drawing largely from these disclosures, The Intercept has identified several former government and military officials whose voices have shaped the public discourse around government spying and surveillance issues but whose financial ties to NSA contractors have received little attention. These pundits have played a key role in the public debate as the White House and the agency itself have struggled to defend the most controversial spying programs revealed by Snowden’s documents.

    • House votes overwhelmingly to end NSA’s mass collection of phone records

      The House overwhelmingly passed a bipartisan bill Wednesday to dial back the once-secret National Security Agency program that collects and stores data from nearly every landline or cellphone call dialed or received in the United States.

    • Senator Bob Corker Says NSA Should Be Spying On More Americans, Not Fewer

      Senator Bob Corker, who heads the Senate Foreign Relations Committee, appears to now be calling for the NSA to spy on more Americans, rather than fewer, arguing that the metadata collection program that is currently being debated in Congress is so small that he considers it negligent.

    • Corker calls NSA surveillance program shockingly small

      Senate Foreign Relations Committee Chairman Bob Corker said Wednesday he was shocked to learn this week how little data the National Security Agency is actually amassing in its controversial collection of Americans’ phone records.

    • The NSA’s Call Record Program, a 9/11 Hijacker, and the Failure of Bulk Collection

      The fact is, U.S. intelligence agencies knew of al-Mihdhar long before 9/11 and had the ability find him. In the years, months, and days before 9/11, the NSA already had access to a massive database of Americans’ call records. Analysts—at NSA or CIA—could have easily searched the database for calls made from the U.S. to the safehouse in Yemen. They simply didn’t.

  • Civil Rights

    • U.S. marshal involved in road rage incident in South County

      A U.S. marshal was among four people cited for assault in an apparent case of road rage Sunday, authorities said.

      A man who was involved in the incident told a TV reporter that it began with a honk and moved to a parking lot, where a man in another vehicle approached him holding a gun and punched him in the face with it.

  • Internet/Net Neutrality

    • Cable Industry Tries To Distance Itself From Decades Of Poor Service By Eliminating The Word ‘Cable’

      Annoyance with the cable industry appears to have reached the tipping point, with consumers fed up with skyrocketing prices, inflexible programming options and some of the worst customer service in any U.S. industry. The cable industry’s ingenious solution? Stop using the word cable. Last week, the cable industry held its annual trade conference, previously dubbed “The Cable Show.” Trying to distance itself from the aging, negative associations with the word “cable,” the industry has decided to rename the conference The Internet & Television Expo.

“VENOM” FUD Attack — Like “Heartbleed” FUD Attack — Linked to Microsoft

Posted in Microsoft, Security at 7:48 pm by Dr. Roy Schestowitz

VENOM™ and Heartbleed™ do have something in common

Mike Convertino
From Microsoft management to CrowdStrike™ management

Summary: Why CrowdStrike™ is motivated to smear Free software and establish a stigma of insecurity in Free software-based virtual machines/’clouds’

The word/brand “Heartbleed” was made up by a Microsoft-connected firm — a firm that is headed by Microsoft’s former security chief. It basically took credit for a 2-year-old flaw that a Google engineer had found, publishing (along with a logo and a catchy brand name) dangerous details well before a patch could be made available and widely deployed/applied, i.e. it was an irresponsible disclosure.

CrowdStrike™ 'pulled a "Heartbleed"' in the sense that it followed some similar patterns (reminiscent of the above). XFaCE, a regular from our IRC channels, diverted our attention to the press release “CrowdStrike™ Appoints Amol Kulkarni as Vice President Engineering”, dated Dec 9, 2014 (less than half a year ago).

“Former Microsoft Bing Engineering Leader [leaving a dead/dying effort] joins Executive Team at CrowdStrike,” says the press release.

“Why is it that we so often find out-of-proportion scare (or FUD) against Free software linked to Microsoft and its ‘former’ staff or close partners?”More important a find, however, is the background of Mike Convertino from the company’s leadership team. The introduction is very telling; rather than hide his background it is noting: “Prior to his work at CrowdStrike, Convertino was the Senior Director of Network Security at Microsoft where he was responsible for protecting all of the company’s networks from intrusion and exploitation.”

So the apple doesn’t fall too far from the tree.

“They also use Microsoft Office extensively, given their job ads,” XFaCE added.

“Adam Meyers, “VP of Intelligence” at CrowdStrike™, used to work for SRA International,” XFaCE says. According to Wikipedia, “SRA provides information technology services to clients in national security, civil government, and health care and public health. Its largest market, national security, includes the Department of Defense, Homeland Security, US Army, US Air Force, and intelligence agencies.”

“Microsoft is a partner,” says XFaCE. George Kurtz, the CEO and co-founder of CrowdStrike, comes from McAfee, a common and frequent source of anti-Linux and anti-Android FUD. The famed Scottish-American founder of McAfee is now a fugitive.

Why is it that we so often find out-of-proportion scare (or FUD) against Free software linked to Microsoft and its ‘former’ staff or close partners? █

Spinning Microsoft’s Inability to Sell Windows (or Office) as a Strength

Posted in Deception, Microsoft at 11:22 am by Dr. Roy Schestowitz

Summary: The ‘cloud’ mindset, which is promoted by surveillance fanatics, increasingly used to pretend that Microsoft has a bright future, despite declining sales

When Microsoft can no longer sell Windows and Office (its cash cows) all it will have left to sell is people’s private data, even Skype audio/chats/video. That’s what the vision of ‘cloud’ seems to be about: subscription (infinitely-recurring payments) and data (with no true promise of privacy).

Yesterday we noted that some IDG journalists are actually Microsoft staff and some are Microsoft MVPs, like this so-called ‘journalist’ who keeps promoting (advertising) Microsoft ‘cloud’ (Matt Weinberger does the same thing in other sites). One ‘analyst’ (like Gartner or IDC, but financial) went as far as hyping up Azure to upgrade Microsoft, using the ludicrous claim (among others) that “Microsoft embraces linux”, despite Microsoft obviously hating Linux. Recall the series below:

Anyone choosing to run GNU/Linux on the NSA-friendly platform called Azure is asking or begging to be snooped on. What would customers say? Microsoft’s love of surveillance is well documented. The whole ‘cloud’ nonsense works well for Microsoft and those claiming that Microsoft will do well “because cloud” are either ignorant or bribed.

Yesterday we found Vista 10 ads (in article form) in the Microsoft-friendly media because they must pretend that Microsoft matters in mobile and that Windows is free or something along those lines. Microsoft’s mouthpiece can’t help spreading the lie that Vista 10 will be 'free' (Microsoft admits it’s “marketing”, i.e. lie). Gartner has been among those promoting the 'free' Vista 10 lie.

Microsoft is simply unable to compete with free (freedom and gratis), so now it pretends that it can devour all of GNU/Linux (in Azure) or that somehow reducing the cost of Windows and moving to a subscription model will magically work out. This is utter nonsense. Only a drunk analyst, an incompetent analyst, or a bribed analyst can claim such a thing. █

New Windows Ransomware: No Branding, Not Even a Mention of Windows

Posted in Microsoft, Security at 11:15 am by Dr. Roy Schestowitz

Summary: New example of media bias which completely omits Windows and spares Microsoft as that may lead to bad publicity

The VENOM® hype campaign is still occupying headlines, serving to distract from Microsoft’s ~50 vulnerabilities which were disclosed on Tuesday and hardly received any media attention.

We recently complained that the ToryGraph advertised Microsoft and deleted Netscape from history, thereby hiding Microsoft's criminal shame.

A reader has just told us that the ToryGraph fails to call out Windows when there is negative news. There is Windows ransomware again, but Windows not even named. There is no brand, no name, no logo, etc.

Microsoft Windows does not need to be infected to demand ransom, Microsoft does the job itself and has done exactly that (demanded ransom) since the first of the Vista series (before 7, 8, and 10). Microsoft no longer thinks it can convince people to pay for Windows, so this strategy is seemingly being dropped. █

VENOM® is Not a Serious Bug, It’s Just a Marketing Campaign From CrowdStrike

Posted in Security at 10:47 am by Dr. Roy Schestowitz

Bugs
Image courtesy of Red Hat, demonstrating lack of correlation between severity and logos/brands

Summary: Many journalists bamboozled into becoming couriers of CrowdStrike, an insecurity firm which tries to market itself using a name and logo for a very old bug

THERE is a disproportionate level of coverage not of Free software but of bugs in Free software. We last wrote about it only days ago

A firm called CrowdStrike (who? Exactly!) is trying to emulate the ‘success’ of previous FUD campaigns. Now is the time to check who’s a real journalist (fact-checking) and who’s just serving PR campaigns like “VENOM”, a shameless FUD campaign from CrowdStrike.

The whole “VENOM” nonsense was covered in a good article titled “VENOM hype and pre-planned marketing campaign panned by experts”. To quote: “On Wednesday, CrowdStrike released details on CVE-2015-3456, also known as Venom. Venom is a vulnerability in the floppy drive emulation code used by many virtualization platforms.

“However, while it’s possible that a large number of systems are impacted by this flaw, it isn’t something that can be passively exploited.

“Several security experts discussed the flaw online, focusing on the marketing and the media attention that it generated – including some over-hyped headlines. Most media organizations were briefed ahead of time about the discovery and gagged by embargo until the Venom website launched, so they had plenty of time to write.

“Many media articles compared Venom to Heartbleed, which is an apples to oranges comparison. If anything, the only commonality is the fact that both flaws had a pre-planned marketing campaign.”

Here comes the “Heartbleed” brand. Yet again. They’re using names that are scary (even all caps, like “GHOST”) because it’s so much easier to sell than “CVE-2015-3456″. Journalists rarely have the technical knowledge to analyse a bug or a flaw, so they assume bugs and logos are indicative of severity.

This patch Tuesday Microsoft revealed 40+ vulnerabilities. Not a single one had a brand name, logo, etc. Here is how IDG covered 46 flaws publicly disclosed by Microsoft just for this Tuesday (Microsoft hides even more flaws). So many flaws were collectively covered in one article and yet there are no logos; none has any branding.

“VENOM” has become the latest example of what we call bugs with branding. This has got to stop because it corrupts journalism and makes the field of computer security almost synonymous with marketing or advertising. CrowdStrike used ALL CAPS (for emphasis rather than acronym) and connotation with poison to market itself, an insecurity firm, after finding a floppy drive bug from over a decade ago. There is a logo too (the first example we found of it), not just branding for this bug, dubbed “VENOM”.

Bug branding (turning number into branding-friendly FUD) seems to have adopted the ALL CAPS convention from “GHOST”, only for extra scare. This FUD has surfaced even in Linux-centric sites, which played along with the marketing campaign. Red Hat [1] and SJVN [2], even Phoronix [3] and Softpedia [4], have covered it by now, despite no focus on security news there.

Branding for bugs leads to stupid headlines that are more poetic than factual and are very light on facts. There is little substance there. This whole recipe (bug+brand name+logo=lots of publicity without much merit) has been repeatedly exploited to give a bad name to FOSS security. A lot of headlines try to connect this to the “Heartbleed” brand. Headlines that we have found so far (links below) include “New Venom bug hits data centers, but it’s hardly Heartbleed”, “Venom bug could allow hackers to take over cloud servers – and experts say it could be worse than Heartbleed”, “New Venom flaw may be worse than Heartbleed, researchers warn”, and “Venom vulnerability more dangerous than Heartbleed, targets most virtual machines”.

Zack Whittaker (former Microsoft staff) covered it like this in the CBS-owned tech tabloid, ZDNet: “Bigger than Heartbleed, ‘Venom’ security vulnerability threatens most datacenters”

Here is that “Heartbleed” brand again. “Please Stop Comparing Every Security Flaw to Heartbleed,” said one good headline from Gizmodo (that’s just how they covered this marketing campaign).

The word/brand “Heartbleed” was made up by a Microsoft-connected firm. Watch coverage from Microsoft-friendly sites and you will find headlines like: “Heartbleed, eat your heart out: VENOM vuln poisons countless VMs”

Dan Goodin, a foe of FOSS (from a security angle), brings in the NSA and Bitcoin to add FUD amid this branded bug/buzz. He wrote about the latest branded bug not once but twice (see links below). He is squeezing the most FOSS FUD out of it (opportunism). Kim Komando chose the headline “New bug taking over the Internet”. No sensationalism here? One press release said “Better Business Bureau Says Most Don’t Need to Worry” [about the branded bug], so there is some objectivity out there too, or an effort to calm people down.

Watch carefully how the bug is marketed in the media: Logo with SVG-like transparency; for a bug! Looks like it was prepared by graphics/marketing professionals. Are insecurity firms now liaising with marketing firms to professionally draw SVG logos for bugs? More logos for simple bugs (we found several, but one main logo) are circulating, usually with photos of snakes. See the complete list [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36] as of this morning. How much more of this FUD is going to circulate before journalists realise that they make a mountain out of a molehill? █

Related/contextual items from the news:

  1. VENOM, don’t get bitten.

    CVE-2015-3456 (aka VENOM) is a security flaw in the QEMU’s Floppy Disk Controller (FDC) emulation. It can be exploited by a malicious guest user with access to the FDC I/O ports by issuing specially crafted FDC commands to the controller. It can result in guest controlled execution of arbitrary code in, and with privileges of, the corresponding QEMU process on the host. Worst case scenario this can be guest to host exit with the root privileges.

  2. For Venom security flaw, the fix is in: Patch your VM today

    The QEMU fix itself is now available in source code. Red Hat has been working on the fix since last week.

  3. VENOM Bug In QEMU Escapes VM Security
  4. 11-Year-Old Bug in Virtual Floppy Drive Code Allows Escape from Virtual Machines

    Popular virtualization platforms relying on the virtual Floppy Disk Controller code from QEMU (Quick Emulator) are susceptible to a vulnerability that allows executing code outside the guest machine.

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channels: Come and chat with us in real time

New to This Site? Here Are Some Introductory Resources

No

Mono

ODF

Samba logo






We support

End software patents

GPLv3

GNU project

BLAG

EFF bloggers

Comcast is Blocktastic? SavetheInternet.com



Recent Posts