Hot answers tagged updates
11
Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone).
This absence of security upgrades is a shortcoming of the Android ...
9
There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS.
The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. ...
8
First of all, OpenBSD is really just on a server in Canada, where the development takes place, through CVS. People replicate the tree by connecting using SSH there etc. When releases are made, isos are created and mirrors replicate them. I imagine they get the files using a secure way, but can't know for sure. Then you have a list of mirrors to download ...
5
I agree, they should make available a way to securely authenticate the iso's.
They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving the hashes sitting beside the just-as-easily-compromised iso file.
But in the absence of that you can, download, wait and verify that there isn't a security ...
5
It sounds like you are in a corporate environment with in house or vendor specific applications needed for business. You should be able to use a combination of code signing and whitelisting to setup policies where it will only run the JAVA applets and applications that are authorized. This is not full proof, but may help to reduce infections.
See the JAVA ...
5
The fact that they are constantly making changes to improve security is a good thing. It means they are keeping up with exploits and patching accordingly. This is the kind of thing you want to see in a security library. Just because a library isn't patched often, doesn't mean that they don't have any problems. It might just mean that they aren't fixing them ...
4
some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...
3
http://security.didici.cc/ is all I use nowadays. Not a source per se - it's a news aggregator, but includes many high quality news sources, as well as podcasts, videos, events, CVEs and Tweets (as well as stackexchange posts - which is where I found your question).
Full disclosure: I'm the author of the site.
3
For a site I would recommend the SANS Internet Storm Center at https://isc.sans.edu/.
I find the most useful for news for me is a twitter list of security professionals and researchers such as.
@sans_isc
@uscert_gov
@schneierblog
@gcluley
@duckblog
@markrussinovich
@jeremiahg
@briankrebs
@mikko
@hdmoore
@dakami
You can probably find other lists of ...
3
Will my system be secure?
Maybe. While you say you do not browse from the system nor does it communicate with the internet, there are a number of other possible scenarios to contend with:
That the system is already compromised, making this discussion moot. Unlikely, but still possible.
That the system can be attacked from compromised hosts on your ...
3
First of all, never assume that if a system doesn't directly contact the internet that it is safe from malware infection as other systems becoming infected can spread it throughout a network.
Second, new vulnerabilities are still being found on unsupported OSes, meaning that even if your 2003 server is fully up to date at the time support ends it will be ...
2
According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners.
As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more ...
2
NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79.
Currently an already existing package NuGet can only be upgraded by ...
2
I wanted to say that maintaining an SSL site is a higher cost than HTTP especially when you have that many users. It costs more cycles of CPU, it costs more to maintain the certificates, and because SSL cares which order the packets come in, there is a higher bandwidth cost.
In this situation, the user downloading the ISO is concerned that the file has ...
2
Comodohacker, the guy who breached DigiNotar last year, claimed that he is able to issue fake certificates in the identity of Microsoft, and that he could provide fake updates.
http://news.cnet.com/8301-1009_3-20104883-83/comodohacker-i-can-issue-fake-windows-updates/
I haven't heard any confirmation of this happening, and Microsoft moved immediately to ...
2
Are you talking about a decade+ ago when they didn't have a built-in mechanism for updates?
This may sound a bit self-referencing but they did it over a browser because they didn't have a built-in mechanism. They chose that particular way because it was easier and faster to get Windows out the door. Also, at the time most computers weren't constantly ...
1
This is an all too common scenario within the corporate world. I have to deal with exactly this problem and it isn't easy. The apps are business critical and cannot be replaced (last replacement implementation project came in at $15 million). There are firewalls and other layers of protection, but these are PCs used by staff who will also surf the web and ...
1
Among possible updates are updates of the default contents of the trust store itself. If Windows was using the default trust store then any CA in that store could edit a forged update which would evict its competitors. It could also alter about any part of the OS. For an OS, the path for updates is very sensitive. It would be quite risky to give the power of ...
1
I would suggest running a virtual machine with external network disabled, and install a fresh OS from an old ISO image which predates the fix. Disabling external network prevents automatic installation of updates; it also blocks "Windows activation" so you will have only a few days or weeks to try it (but you can "stall" the clock between runs: since the VM ...
1
I would recommend Iszi's answers above, but since you do not have access anymore these may not be feasible. I am not aware of any complete list out there listing all patches for a given platform, since the missing patches would also depend upon some other things installed that are not necessarily required (drivers, .NET, etc.). If you do not have access you ...
1
Firefox 13 was released on June 5th, 2012. Firefox updates to a new major version every ~6 weeks. Firefox 14 was released today. New features include Windows 8 support (Metro interface).
https://en.wikipedia.org/wiki/History_of_Firefox#Version_14
1
Another option is off-loading the SSL computation to a reverse-proxy like Pound. I've used Pound in the past and found it very easy to use. I've only used it for traditional web sites, so I don't know if it will work for you.
A nice thing about Pound is you can roughly load balance by configuring multiple back-ends.
1
I think there is a wide gap between "absolute" security and "good enough" security. Is SSL encryption worth the compute overhead on all of OpenBSD's mirrors? I don't think so. The chance that someone is going to hijack your http download session and patch your iso and then update the checksum is pretty low.
A more likely scenario is that the files get ...
Only top voted, non community-wiki answers of a minimum length are eligible
