01.29.14

Gemini version available ♊︎

The Latest FOSS FUD Revolves Around Fakes and Bogus Arguments

Posted in Free/Libre Software, Security at 2:07 pm by Dr. Roy Schestowitz

Summary: How Free/Open Source Software (FOSS) gets discredited over “security”, based on something which has nothing to do with FOSS and more to with human error or social engineering

THE reports from IDG make it sound as though FileZilla is a security threat [1,2] when it fact it is fakes that are a threat, as Sean pointed out to counter these allegations [3].

Yesterday we took note of the trend and two days ago we gave some examples of security-flavoured FUD against Android, of which there is plenty these days (and even today). Some of it is correctly being characterised as platform-agnostic [4]. This sometimes requires user intervention [5] or social engineering [6], so there’s a lot more to be taken into account. When the OpenSSL project got compromised some weeks ago it was actually the fault of a weak password [7,8], but some of the media spread FUD about OpenSSL itself. Weak passwords are a common human error [9] and those who don’t encrypt E-mails that contain passwords (they should!) only have themselves to blame [10,11]. To get an example of real vulnerability, consider Apple’s Safari storing passwords in plain text [12]!!! GNU/Linux, by contrast, facilitates strong encryption and has protection against all sorts of attacks [13-14].

Blaming FOSS for issues that relate to social engineering is a common FUD pattern these days (like blaming Android for users installing malware they download outside repositories), but the real security issues are back doors like Microsoft’s, security flukes like Apple’s, and data leakage through so-called ‘clouds’ (which are typically promoted by proprietary software players, tightly connected to the crack-leaning NSA).

Related/contextual items from the news:

  1. FileZilla warns of large malware campaign
  2. FileZilla warns of large malware campaign
  3. FileZilla, Other Open-Source Software From ‘Right’ Sources Is Safe

    A basic tenant of open-source software security has long been the idea that since the code is open, anyone can look inside to see if there is something that shouldn’t be there.

  4. Java-based malware driving DDoS botnet infects Windows, Mac, Linux devices

    The cross-platform HEUR:Backdoor.Java.Agent.a, as reported in a blog post published Tuesday by Kaspersky Lab, takes hold of computers by exploiting CVE-2013-2465, a critical Java vulnerability that Oracle patched in June. The security bug is present on Java 7 u21 and earlier. Once the bot has infected a computer, it copies itself to the autostart directory of its respective platform to ensure it runs whenever the machine is turned on. Compromised computers then report to an Internet relay chat channel that acts as a command and control server.

  5. Yahoo users exposed to malware attack

    Users clicking on some ads are redirected to sites armed with code that exploits vulnerabilities in Java and installs a variety of different malware.

  6. Password Security Requires Multiple Layers of Protection

    The gist of the story is that “123456″ is now the most commonly used weak password—surpassing the use of the word “password.”

  7. No hypervisor vulnerability exploited in OpenSSL site breach

    The OpenSSL Project confirmed that weak passwords used on the hosting infrastructure led to the compromise of its website, dispelling concerns…

  8. OpenSSL site defacement involving hypervisor hack rattles nerves (updated)

    Code repositories remained untouched in the December 29 hack, and the only outward sign of a breach was a defacement left on the OpenSSL.org home page. The compromise is nonetheless rattling some nerves. In a brief advisory last updated on New Year’s Day, officials said “the attack was made via hypervisor through the hosting provider and not via any vulnerability in the OS configuration.” The lack of additional details raised the question of whether the same weakness may have been exploited to target other sites that use the same service. After all, saying a compromise was achieved through a hypervisor vulnerability in the Web host of one of the Internet’s most important sites isn’t necessarily comforting news if the service or hypervisor platform is widely used by others.

  9. 7 sneak attacks used by today’s most devious hackers
  10. 10,000 Top Passwords

    Back when I wrote Perfect Passwords, I generated a list of the top 500 worst (aka most common) passwords which seems to have propagated quite a bit across the internet, including being mentioned on Gizomodo, Boing Boing, Symantec, Laughing Squid and many other sites. Since then I have collected a large number of new passwords bringing my current list to about 6,000,000 unique username/password combos, including many of those that have been recently made public*.

  11. All Your Internet Are Belong To Iceland*

    All that being said, and given that the Luddite solution of forsaking the Internet may not be terribly practical, this is another reason to encrypt technical data that you are sending by email even if the recipient is a U.S. person firmly planted on U.S. soil. No, the encryption isn’t a defense to the violation, but it is at least a mitigating factor. Remember, as I posted last May, that the U.S. military thinks it can put ITAR-controlled technical data on a Chinese satellite if it’s encrypted; so if you don’t have anything else to say in your defense when an email with export controlled data accidentally wanders through Lithuania, you will at least have that. And maybe one day in the distant future, BIS and DDTC will admit that the Internet exists and that encryption works.

  12. Older Versions of Safari Store Login Info in Plain Text

    Older versions of Safari for Mac store unencrypted user login credentials in a plain text file, according to security firm Kaspersky (via ZDNet). Safari saves the information in order to restore a previous browsing session, reopening all sites, even those that require authentication using the browser’s “Reopen All Windows from Last Session” functionality.

  13. Quantum crypto pitches for data centre links
  14. Linux Is the Only Way to Protect Against Potential Sound-Transmitted Malware
Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Links 27/05/2022: Many More Microsoft Security Failures (and Spin/Lies)

    Links for the day



  2. Links 26/05/2022: KStars 3.5.9 and Chrome 103 Beta

    Links for the day



  3. Links 26/05/2022: AlmaLinux OS 9.0, MooseX::Extended for Perl Introduced

    Links for the day



  4. Links 26/05/2022: Kernel Events and Systemd-Free GNU/Linux Distributions

    Links for the day



  5. Links 26/05/2022: DuckDuckGo Increasingly Exposed as Microsoft Proxy

    Links for the day



  6. EPO Celebrates Software Patents Again, Dubbing Them 'Hey Hi' (AI) and '4IR'

    The ludicrous state of the EPO is demonstrated by yesterday’s puff piece about “four million” (merely requests for monopoly in Europe; most come from outside Europe) and L’Oréal, which claims to have “invented” something that was already done in the 1990s if not the 1980s



  7. [Meme] EPO's Monkey Business: Lowering the Patent Examination Bar

    As we shall show in a moment, EPO President António Campinos has lowered the quality of patents and applications; sooner or later he might outsource the job to ‘livestock’



  8. IRC Proceedings: Wednesday, May 25, 2022

    IRC logs for Wednesday, May 25, 2022



  9. Heads of Patent Offices Are Immune to Coronavirus

    The overconfident chiefs of the U.S. Patent and Trademark Office (USPTO) and EPO might love speaking about COVID-19 (in relation to patents), but they do not take it seriously themselves



  10. Links 26/05/2022: Plex Finally on GNU/Linux

    Links for the day



  11. The General Consultative Committee of the EPO Exposes a Disaster and a Lack of Genuine Dialogue

    The General Consultative Committee (GCC) at the EPO deals with unlawful proposals from António Campinos (he’s happy to violate laws, constitutions, protocols, conventions, just like Benoît Battistelli did) and once again the abuses by managers is covered up; it’s as if the Office is run by unaccountable gangsters who arrogantly curse at everyone whilst insisting they’re the nicest people ever



  12. The Latest Letter to Josef Kratochvìl and the Heads of Delegation of the Administrative Council of the European Patent Organisation

    A week-old letter from the Central Staff Committee (CSC) to the Administrative Council of the European Patent Organisation highlights the nature of a crisis; there's no genuine dialogue and staff of the EPO (i.e. the scientists who do all the actual work) is constantly under attack



  13. [Meme] The Recordings Must Have Accidentally Been Lost While Breaking the Rules

    The EPO‘s “nicest” chief, Monopoly Tony, won’t even mention the recordings…



  14. Links 25/05/2022: ‘V Rising’ on GNU/Linux and Pearl Linux OS 11

    Links for the day



  15. Links 25/05/2022: Librem Tries Another Approach

    Links for the day



  16. IRC Proceedings: Tuesday, May 24, 2022

    IRC logs for Tuesday, May 24, 2022



  17. Links 24/05/2022: nginx-1.22.0 and WordPress 6.0

    Links for the day



  18. [Meme] Divine Protection

    You won’t find Monopoly Tony (António Campinos) wearing a mask at the EPO because the rules of the Office do not apply to him



  19. António Campinos and the Alicante Clique (EPO Management, Appointed Based on Nepotism Despite Lack of Qualifications) Nowadays Exploiting Kids for PR Charades

    The sick old habit of exploiting kids for Public Relations (PR) and marketing purposes is all too common at the EPO (they’re constantly exploiting “the children” to associate criticism of the EPO with demeaning the young and innocent), but the management — which enjoys nepotism and immunity rather than relevant skills — carries on today and it’s being called “inaugural”



  20. [Meme] Snake on a Plane

    The EPO‘s President ‘Monopoly Tony’ (António Campinos), whom you never see wearing a mask (none of the photo ops; he does not even socially distance himself from peers, he wears sneakers instead of masks) during the height of a pandemic, is the "f***ing president"; don’t tell him to wear one…



  21. Microsoft GitHub Exposé — Part XX — Entering Phase II

    We're about to resume the long-running series about the sick clique which ran GitHub until the assault on women became too much of a liability (among other wrongdoings and PR blunders)



  22. Links 24/05/2022: Fedora 37 Test Days and Tor Browser 11.0.13

    Links for the day



  23. Microsoft Vidal, as USPTO Director, Already Plays 'Political Cards' to Disguise and Deflect Away From the Corporate Agenda

    Microsoft Vidal, another corporate pawn in charge of the world’s most dangerous patent system, is using soft-spoken defle



  24. Links 24/05/2022: WAL-G 2.0

    Links for the day



  25. IRC Proceedings: Monday, May 23, 2022

    IRC logs for Monday, May 23, 2022



  26. Unethical Advertising, Published as So-called 'Articles', in CNX Software

    As we noted earlier this year, the CNX team is looking for money in the wrong places



  27. Links 23/05/2022: Broadcom to Buy VMware?

    Links for the day



  28. LibreOffice Conference 2022, As Before, Puts the Keynotes on Sale (the Rich Buy Influence, the Price Doubles)

    Discrimination against the community; talks and mentions are based on money, not merit ($2000 has become $4000 in just one year)



  29. Links 23/05/2022: Kdenlive 22.04.1 and New Alpine Linux Released

    Links for the day



  30. António Campinos Promotes Software Patents Using Buzzwords and Sketchy Loopholes With Dubious Legal Basis

    ‘Monopoly Tony’ (António Campinos) is shamelessly manipulating EPO processes at both ends (sender and receiver) to facilitate the illegal granting of invalid European software patents; we’re meant to think this former EU official and imposter (banker) is some guru in the sciences because he reads a lousy speech crafted for him with lots of meaningless buzzwords peppered all over it (he’s not good at reading it, either)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts