EULA – Jupiter Broadcasting

FOSS Clothing | BSD Now 280

Angela Fisher — Thu, 10 Jan 2019 09:50:51 +0000

There was a tremendous amount of reaction to and discussion about my blog entry on the midlife crisis in open source. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a detailed response — which he shortly thereafter elevated into a blog entry.

Let me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.

To GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like choosealicense.com, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.

To foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!

###NetBSD and LLVM
NetBSD entering 2019 with more complete LLVM support

I’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.
Previously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.

The process of upstreaming support to LLVM sanitizers has been finalized

I’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.
The NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).

##News Roundup
###Thoughts on FreeBSD 12.0

Playing with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.
I like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.
Something which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.
I probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.

###FreeBSD 12.0 Performance Against Windows & Linux On An Intel Xeon Server

Last week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.
While FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.
I did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this OpenBenchmarking.org result file.

###How NetBSD came to be shipped by Microsoft
Google cache in case the site is down

In 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.
Danger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.
In 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.
NetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)
We began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.
Microsoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.

##Beastie Bits

##Feedback/Questions

Dries – Lets talk a bit about VIMAGE jails
ohb – Question About ZFS Root Dataset
Micah – Active-Active NAS Sync recommendations

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

The post FOSS Clothing | BSD Now 280 first appeared on Jupiter Broadcasting.

What’s New MATE | LINUX Unplugged 116

chris — Tue, 27 Oct 2015 17:47:02 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Behind the scenes on Ubuntu MATE’s new features pushing the Ubuntu platform forward for traditional desktops, why Apple’s latest court case proves Richard Stallman was right about owning your own software & there is real debate about Xiaomi’s new Linux laptop.

Plus the big EFF win that’s great for Linux users, the big problems facing x86 that are a wake up call to distro makers & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Pre-Show:

World Without Linux Episode 2: Are We There Yet? – YouTube

Feedback:

Linux Academy

Linux Academy | Linux and AWS Online Training

Intel x86 considered harmful (new paper)

So, today I’m releasing this first paper, finally. You can get the PDF
_here, and also the EPUB version
here._

_As mentioned, the paper is mostly a (hopefully systematic) survey of the various
problems and attacks presented against the x86 platform over the last 10 year_s.

Qubes 3.0

DigitalOcean

DigitalOcean: SSD Cloud Server, VPS Server, Simple Cloud Hosting

DOJ dismisses Apple’s arguments against decrypting iOS communications

Federal courts should require Apple to unlock encrypted data because the operating system is “licensed, not sold,” to customers, the Justice Department argued in a reply brief in the U.S. District Court for the Eastern District of New York.

Richard Stallman is the hero the internet needs

But suddenly he doesn’t seem crazy anymore. After the Snowden revelations, and all the other major and minor privacy breaches of the past few years, his paranoia now seems justified — even rational:

He warned of the growing danger of DRM in his great short story The Right to Read (1997).
He refuses to own a cellphone, on the grounds that it might be used as a tracking or covert listening device. This still sounds slightly paranoid, but looks increasingly possible.
Stallman considers cloud computing dangerous. In 2008 I thought this was alarmist; now nobody trusts the cloud.
He’s always held that proprietary software cannot be trusted. Windows 10’s shady behaviour proves that he has a point.

TING

Ting – mobile that makes sense

Xiaomi’s Linux Laptop To Enter Production ‘Early Next Year’

The model with a 12.5-inch screen will be manufactured by Inventec (who make laptops for Acer, Toshiba and HP), with an initial order of 250,000 units.

The slightly larger device is to be made by Compal Electronics (known for manufacturing Apple devices, and various PlayStation, Xbox and Nintendo games consoles), with Xiaomi placing an order for 300,000 units.

Support Jupiter Broadcasting on Patreon

The post What's New MATE | LINUX Unplugged 116 first appeared on Jupiter Broadcasting.

Get Tracked with Windows 10 | TTT 198

chris — Wed, 29 Jul 2015 10:19:01 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Windows 10 is released to the public, but the devil is in the details. Microsoft’s new small print – how your personal data is (ab)used, we share the details.

Plus how the mainstream is reacting to the new release, the sliding market share of the iPad & the teleportation breakthrough scientists are reporting.

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

The post Get Tracked with Windows 10 | TTT 198 first appeared on Jupiter Broadcasting.

An Encryptioner’s Conscience | TechSNAP 217

chris — Thu, 04 Jun 2015 17:35:50 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The sad state of SMTP encryption, a new huge round of flaws has been found in consumer routers & the reviews of Intel’s new Broadwell desktop processors are in!

Plus some great questions, a huge round-up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

The sad state of SMTP (email) encryption

This article talks about the problems with the way email transport encryption is done
When clients submit mail to a mail server, and when mail servers talk to each other to exchange those emails, they have the option of encrypting that communication to prevent snooping
This “opportunistic” encryption happens if the server you are connecting to (as a client, or as another server), advertises the STARTTLS option during the opening exchange
If that keyword is there, then your client can optionally send the STARTTLS command, and switch further communications to be encrypted
The first problem with this is that it happens over plain text, which has no protection against modification
Some cisco firewalls, and most bad guys, will simply modify the message from the server before it gets to you, to remove the STARTTLS keyword, so you client will assume the server just doesn’t speak TLS.
Do we maybe need something like HSTS for SMTP?
When submitting email from my client machine, I always use a special port that is ALWAYS SSL.
But this is only the beginning of the problem
SSL/TLS are designed to provide 3 guarantees:
- Authenticity: You are talking to who you think you are talking to (not someone pretending to be them). This is provided by verifying that the presented SSL Certificate is issued by a trusted CA
- Integrity: The message was not modified or tampered with by someone during transit. This is provided by the MAC (Message Authentication Code), a hash that is used to ensure the message has not been modified
- Privacy: The contents of the message are encrypted so no one else can read them. This is provided by symmetric encryption using a session key negotiated with the other side using asymmetric cryptography based on the SSL Certificate.
Mail servers rarely actually check authenticity, because many mail servers use self-signed certificates.
Many domains are hosted on one server, so the certificate is not likely to match the name of the email domain
The certificate check is done against the hostname in the MX record, but most people prefer to use a ‘vanity’ name here, mail.mydomain.com, which won’t match in2-smtp.messagingengine.com or whatever the mail server ends up being called
But, even if we did enforce this, and reject mail sent by servers with self-signed certificates, without DNSSEC, someone could just spoof the MX records, and instead of my email being sent over an encrypted channel to your server, which I have verified, I would be given an incorrect MX record, telling me to deliver mail to mx1.evilguy.com, which has a perfectly vaild SSL certificate for that domain
In the end, the better solution looks like it will be DNSSEC + DANE (publish the fingerprint of the correct SSL certificate as a DNS entry, alongside your MX record)
With this setup, you still get all 3 protections of SSL, without needing to trust the Certificate Authorities, who do not have the best record at this point
Don’t think MitM is a big deal? The ongoing problem of BGP hijacking suggests otherwise. A lot of internet traffic is getting misdirected. If it eventually makes it to its destination, people are much less likely to notice.

Researchers find 60 flaws in 22 common consumer network devices

A group of security researchers doing their IT Security Master’s Thesis at Universidad Europea de Madrid in Spain have published their research
They found serious flaws in 22 different SOHO network devices, including those from D-Link, Belkin, Linksys, Huawei, Netgear, and Zyxel
Most of the devices they surveyed were ones distributed by ISPs in Spain, so these vulnerabilities have a very large impact, since almost every Internet user in Spain has one of these 22 devices
They found 11 unique types of vulnerability, for a total of 60 flaws across the 22 devices
Persistent Cross Site Scripting (XSS)
- Unauthenticated Cross Site Scripting
- Cross Site Request Forgery (CSRF)
- Denial of Service (DoS)
- Privilege Escalation
- Information Disclosure
- Backdoor
- Bypass Authentication using SMB Symlinks
- USB Device Bypass Authentication
- Bypass Authentication
- Universal Plug and Play related vulnerabilities
All of this makes me glad my router runs FreeBSD.
Luckily, there are finally some consumer network devices like these that can run a real OS, like the TP-LINK WDR3600, which has a 560mhz MIPS CPU and can run FreeBSD 11 or Linux distros such as DD-WRT
Additional Coverage – ITWorld

CareFirst Blue Cross hit by security breach affecting 1.1 million customers

“CareFirst BlueCross BlueShield last week said it had been hit with a data breach that compromised the personal information on approximately 1.1 million customers. There are indications that the same attack methods may have been used in this intrusion as with breaches at Anthem and Premera, incidents that collectively involved data on more than 90 million Americans.”
It would be interesting to know if there are common bits of infrastructure or software in use at these providers that made these compromises possible, or if security was just generally lax enough that the attackers were able to compromise the three insurance providers separately
“According to a statement CareFirst issued Wednesday, attackers gained access to names, birth dates, email addresses and insurance identification numbers. The company said the database did not include Social Security or credit card numbers, passwords or medical information. Nevertheless, CareFirst is offering credit monitoring and identity theft protection for two years.”
“There are clues implicating the same state-sponsored actors from China thought to be involved in the Anthem and Premera attacks.”
“As Krebs noted in this Feb. 9, 2015 story, Anthem was breached not long after a malware campaign was erected that mimicked Anthem’s domain names at the time of the breach. Prior to its official name change at the end of 2014, Anthem was known as Wellpoint. Security researchers at cybersecurity firm ThreatConnect Inc. had uncovered a series of subdomains for we11point[dot]com (note the “L’s” in the domain were replaced by the numeral “1”) — including myhr.we11point[dot]com and hrsolutions.we11point[dot]com. ThreatConnect also found that the domains were registered in April 2014 (approximately the time that the Anthem breach began), and that the domains were used in conjunction with malware designed to mimic a software tool that many organizations commonly use to allow employees remote access to internal networks.”
“On Feb. 27, 2015, ThreatConnect published more information tying the same threat actors and modus operandi to a domain called “prennera[dot]com” (notice the use of the double “n” there to mimic the letter “m”)
So it seems that the compromises may have just been a combination of spear phishing and malware, to trick employees into divulging their credentials to sites they thought were legitimate
Such targeted attacks on teleworkers are a disturbing new trend
The same Chinese bulk registrant also bought careflrst[dot]com (the “i” replaced with an “L”) and caref1rst[dot]com (the “i” replaced with the number “1”).
“Additionally, ThreatConnect has unearthed evidence showing the same tactics were used on EmpireB1ue.com (note the “L” replaced with a number “1”), a domain registered April 11, 2014 (the same day as the phony Carefirst domains). EmpireBlue BlueCross BlueShield was one of the organizations impacted by the Anthem breach.”
Anthem has broken the trend, and is offering “AllClear ID” credit and identity theft monitoring, rather than Experian

First review of Intel’s new Broadwell desktop processors

The long awaited new line of desktop processors has landed
Problems with the new 14nm fabrication process resulted in the entire broadwell line being delayed, significantly in the case of the desktop chip
The two new models are the Core i7 5775c, and Core i5 5765c with a 65W TDP
These Broadwell chips are a lower TDP than the top-end Haswell cousins, actually being closer to the lower clocked i7-4790S than the top end i7-4770K
Overall, speeds are not quite as fast as the current generation Haswell flagship processors
These new processors use Intel’s Iris Pro 6200 Integrated GPU, with performance numbers that now outpace rival AMD’s offerings, although at a higher price point
Broadwell will soon be replaced by Skylake, later this year, so you might want to wait to make your next big purchase
Broadwell also features: “128MB of eDRAM that acts almost like an L4 cache. This helps alleviate memory bandwidth pressure by providing a large(ish) pool near the CPU but with lower latency and much greater bandwidth than main memory. The eDRAM has the greatest effect in graphics, but we also saw some moderate increases in our non-3D regular benchmark suite”
In the end, it is a bit unexpected for the desktop range to include only 2 processors, and in the middle TDP, with no offerings at the lower end (35W) or higher end (88W)
Some of the benchmarks suggest the eDRAM may help with video encoding

Feedback:

Round Up:

The post An Encryptioner's Conscience | TechSNAP 217 first appeared on Jupiter Broadcasting.

Microsoft Cyber Terrorism | Tech Talk Today 18

chris — Tue, 01 Jul 2014 09:51:40 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Could Netflix be classified as a cyber security threat, or is this being overblown? Having Dynamic DNS problems? You can thank Microsoft, they played cowboy and shut down the No-IP service.

Plus Newegg starts accepting Bitcoin, another big open source adoption and more!

Direct Download:

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | Torrent Feed

Become a Tech Talk Today supporter on Patreon:

Show Notes:

Netflix Could Be Classified As a ‘Cybersecurity Threat’ Under New CISPA Rules | Motherboard

The cybersecurity bill making its way through the Senate right now is so broad that it could allow ISPs to classify Netflix as a “cyber threat,” which would allow them to throttle the streaming service’s delivery to customers.

“A ‘threat,’ according to the bill, is anything that makes information unavailable or less available. So, high-bandwidth uses of some types of information make other types of information that go along the same pipe less available,” Greg Nojeim, a lawyer with the Center for Democracy and Technology, told me. “A company could, as a cybersecurity countermeasure, slow down Netflix in order to make other data going across its pipes more available to users.”

The general uproar surrounding the bill could have led to the postponement of its markup—it was originally set to be discussed by Feinstein’s Intelligence Committee last week, but was pushed back. No word on when it’ll be taken up by the committee, but considering that the bill has been in the works behind closed doors for several months now, don’t expect it to die without first getting some very serious consideration on Capitol Hill.

Millions of dynamic DNS users suffer after Microsoft seizes No-IP domains

Millions of legitimate servers that rely on dynamic domain name services from No-IP.com suffered outages on Monday after Microsoft seized 22 domain names it said were being abused in malware-related crimes against Windows users.

Microsoft enforced a federal court order making the company the domain IP resolver for the No-IP domains. Microsoft said the objective of the seizure was to identify and reroute traffic associated with two malware families that abused No-IP services. Almost immediately, end-users, some of which were actively involved in Internet security, castigated the move as heavy handed, since there was no evidence No-IP officially sanctioned or actively facilitated the malware campaign, which went by the names Bladabindi (aka NJrat) and Jenxcus (aka NJw0rm).

In a complaint Microsoft filed under seal on June 19, Microsoft attorneys said No-IP is “functioning as a major hub for 245 different types of malware circulating on the Internet.” The document said abuse of the service has been the subject of recent blog posts by both OpenDNS and Cisco Systems.

Monday’s seizure was the tenth major malware disruption Microsoft has participated in. The actions typically combine surprise technical and legal procedures that eradicate or significantly disrupt major botnets.

South Korea gives up on Microsoft – Giving Open Sauce a chance

According to a government statement, South Korea wants to break from its Microsoft dependency and move to open source software by 2020″

In a statement the government said that it will invigorate open source software in order to solve the problem of dependency on certain software. The government has invested in Windows 7 to replace XP, but it does not want to go through the same process in 2020 when the support of the Windows 7 service is terminated.

Facebook Added ‘Research’ To User Agreement 4 Months After Emotion Manipulation Study

The study came to light recently when he and his two co-researchers from Cornell University and University of California-SF published their study describing how users’ moods changed when Facebook curated the content of their News Feeds to highlight the good, happy stuff (for the lucky group) vs. the negative, depressing stuff

Four months after this study happened, in May 2012, Facebook made changes to its data use policy, and that’s when it introduced this line about how it might use your information: “For internal operations, including troubleshooting, data analysis, testing, research and service improvement.”

Newegg.com – BITCOIN ACCEPTED

Twitter / Newegg: We’re proud to announce…

We're proud to announce our acceptance of @Bitcoin via @BitPay. Learn more at https://t.co/2jxwhQQ92U #neweggbitcoin https://t.co/tRD4VO0MIU

— Newegg (Official) (@Newegg) July 1, 2014

We’re proud to announce our acceptance of @Bitcoin via @BitPay. Learn more at https://bit.ly/1qcn4Jo #neweggbitcoin

1-800-FLOWERS.COM Partners with Coinbase to Accept Bitcoin

Beginning this fall, 1-800-FLOWERS will be adding bitcoin as a payment option across its extensive family of gifting sites, including 1-800-FLOWERS.COM, FannieMay.com, Cheryl’s.com, ThePopcornFactory.com, 1-800-Baskets.com, FruitBouquets.com, and Stockyards.com.

Time Machine:

Today in Tech:

23 Years ago In 1991 — Finnish Prime Minister Harri Holkeri made the world’s first GSM call over a privately operated network to Vice Mayor Kaarina Suonio in Tampere. The Prime Minister used Nokia gear on GSM’s original 900MHz band.

The post Microsoft Cyber Terrorism | Tech Talk Today 18 first appeared on Jupiter Broadcasting.