Myside's Spew - Blog of Spontaneous Combustible Spew
SPEW FILE ALBUMS MYSIDE'S PICS!

Firefox Now Does a Rapid Release (Backport) on Ubuntu

27 January, 2012 16:42 CST6CDT

This morning I noticed APT had a new version of Firefox waiting to be updated.  Firefox 9.0.1 was a welcomed update for my 10.04 LTS Xubuntu installation.  Ubuntu will now be releasing the browser upgrades as Mozilla rolls out it's web browser application with the next generation of Internet technology, such as enhanced HTML5 support, and security enhancements.

"The upstream Mozilla Firefox web browser has moved to a rapid release cycle. New Firefox versions are being released every six weeks and contain new features and security enhancements. Until now, Ubuntu 10.04 LTS and Ubuntu 10.10 have been getting 3.6 point releases of Firefox. As such, users have not been benefiting from new features, support for new web technologies, security enhancements, and performance improvements. Firefox 3.6 will be reaching its end of life soon, so we need to migrate users to rapid release so that they will continue to receive security updates in a timely fashion."

The roll-out was announced to start January 17th, though I thought from the start it was to be the 27th - and it turned out to be so, for me.  Ubuntu 10.04 LTS and Ubuntu 10.10 installations are now on a rapid release cycle as is the latest Ubuntu distribution sets available.  I am sure it is relieving a lot of stress now not having to patch Firefox 3.6 as security issues arise, as this is the default and once permanent version of these older maintained Ubuntu distribution sets.

APT repository add-ons for the previous Ubuntu Firefox branded version will be migrated to the new Firefox version through Mozilla's add-on service, addons.mozilla.org.

Day to Day  Software  Article & Comments

Kwik Trip Coffee

25 January, 2012 14:52 CST6CDT

Kwik Trip is predominantly a Wisconsin and Minnesota convenience store and gas station.  It is king of gas in my area and once the king-quick-stop for morning coffee.

Up until about 3 years ago Kwik Trip brewed a fine roast of well tasting caffeine filled coffee to kick-start the morning.  Out of no where the company decided to package and re-sell their meagerly roasted blends in ground and whole bean packages called Cafe Karuba Coffee.  Around this time is when the grounds went stale.

From what I can see, the employees are now forbidden to put any love into our cup of Joe.  Coffee grounds are grounded exact as well as brew baskets swelled to the bottoms of hell where brewing only turns the color of the water into a hazy brown.  Kwik Trip is no Cafe, even in Karuba, a village in Nord-Kivu, Democratic Republic of the Congo.

It took a good year before I gave up completely drinking Kwik Trip Coffee, now opting to buy a half of a pound of Folgers at the same establishment for a justified 68 cents more.  Woe is an actual refill of a cup of Kwik Trip Java - especially with these fine establishments selling quality cups of coffee on the go: coffee shops near La Crosse, Wisconsin

A year ago I was writing...

Destroy Heater & Air Conditioning Filter Odors
Vikings vs. Packers Loyalty

Day to Day  Article & Comments

Are you ready for SOPA? - January 18th!

17 January, 2012 16:38 CST6CDT

The Stop On-line Piracy Act (SOPA) is in a full forced backlash from Internet giants such as WikipediA and our beloved BoingBoing whom are participating in the SOPA Strike, a 12 hour period in which volunteer domain owners will turn the electric off to their sites.  The SOPA Strike page link above provides several parked pages to point your domains to among information on how to contact your congressional representatives to voice your opinion.

"January 18th is going to be amazing. Sites are striking in all different ways, but they are united by this: do the biggest thing you possibly can, and drive contacts to Congress. Put this on your site or automate it by putting this JS into your header (the Javascript link is available @ http://sopastrike.com/), which will start the blackout at 8AM EST and end at 8PM EST." - http://sopastrike.com/

The SOPA Strike website contains a list of validated participants along with a list of unfiltered participants of the Internet Blackout.  I will not be participating in the blackout, however I wish to make this unfetchable downfall of our existence on the Internet - to be voted on by Congress January 24th (SOPA), and PIPA which is currently in discussion in the Senate, stop DEAD with help from those that this post may help.  Also see: Internet Blacklist for a video and in depth information in relation to SOPA and PIPA.

"On Jan 24th, Congress will vote to pass Internet censorship in the Senate, even though the vast majority of Americans are opposed. We need to kill the bill - PIPA in the Senate and SOPA in the House - to protect our rights to free speech, privacy, and prosperity. We need Internet companies to follow Reddit's lead and stand up for the web, as we Internet users are doing every day." - http://sopastrike.com/

Here is a small list of 3rd party templates and the official sopastrike.com web page and Javascript code available and ready to use during the protest tomorrow:

  1. Black out your website for 12 hours with this page's HTML, or by putting this Javascript into your site's theme (the Javascript link is available @ http://sopastrike.com/). Tucows is doing this and so is BoingBoing.
  2. Other people have made tools to strike. Some other ways to strike:

A year ago I was writing...

Packers Game, CSS Modifications, & Verizon Hoopla
Verizon Admits iPhone Network Hiccups
freenode New Year's Chat Room Channel Logs (#freenode-newyears) 2011

Technology  Software  Article & Comments

Dumbest Company Decision of 2011

30 December, 2011 15:55 CST6CDT

Verizon announced yesterday (December 29th, 2011) that they will be adding a $2.00 charge for paying your wireless bill on-line (paperless) starting January 15th, 2012.  Snail mail (USPS) processing of paper checks, money orders, or wired checking account transfers do not apply.  Today, December 30th, 2011 they retracted this decision after customer complaints including discontinuation of service threats and the FCC stating they are "concerned" about the additional fee and will look into the matter.

Most utility companies give consumers discounts or credits for paperless billing as it saves cost of paper, postage, and reduces billing departments processing overhead.

Dumbfound are the "year in review" articles already published, as Verizon (Verizon Communications Inc and Vodafone Group Plc.) within just 3 days of the new year has distinguished themselves as making the dumbest company decision of 2011.

Cheers!

A year ago I was writing...

North American Squirrel Association (N.A.S.A.)

Bullshit  Article & Comments

A FreeBSD Christmas Advisory

25 December, 2011 12:26 CST6CDT

On December 23rd, 2011 FreeBSD administrators were blessed with 5 high severity security advisories.  With some humor of a very unusual increase in fear on a single day, 5 security advisories total, the FreeBSD foundation sent out a follow-up after the advisories posted:

Hi all,

No, the Grinch didn't steal the FreeBSD security officer GPG key, and your eyes aren't deceiving you: We really did just send out 5 security advisories.

The timing, to put it bluntly, sucks.  We normally aim to release advisories on Wednesdays in order to maximize the number of system administrators who will be at work already; and we try very hard to avoid issuing advisories any time close to holidays for the same reason.  The start of the Christmas weekend -- in some parts of the world it's already Saturday -- is absolutely not when we want to be releasing security advisories.

Unfortunately my hand was forced: One of the issues (FreeBSD-SA-11:08.telnetd) is a remote root vulnerability which is being actively exploited in the wild; bugs really don't come any worse than this.  On the positive side, most people have moved past telnet and on to SSH by now; but this is still not an issue we could postpone until a more convenient time.

While I'm writing, a note to freebsd-update users: FreeBSD-SA-11:07.chroot has a rather messy fix involving adding a new interface to libc; this has the awkward side effect of causing the sizes of some "symbols" (aka. functions) in libc to change, resulting in cascading changes into many binaries.  The long list of updated files is irritating, but isn't a sign that anything in freebsd-update went wrong.

--
Colin Percival

The first security advisory is a remote denial of service in the Bind DNS server affecting all maintained versions of FreeBSD.  If Bind were able to cache an invalid DNS record, a DOS is possible if a local user could be tricked into querying the record in an inappropriate way through browsing an external web page in which a resource for the domain is needed, for example, or by self purpose.  If Bind is an open DNS resolver, any external specially crafted query would also blow Bind 9 up.  Authoritative only Bind 9 DNS servers do not 'seem' to be affected.  A freebsd-update or a ports update to bind96-9.6.3.1.ESV.R5.1 should mitigate the security vulnerability.

Second security advisory (affecting all maintained versions of FreeBSD): if ftpd uses a chroot environment and nsdispatch.  nsdispatch has the ability to reload its configuration on demand, and nsdispatch has no ability to notify itself if it is running in a chrooted environment allowing an ftpd user to gain elevated privileges, being that nsdispatch does not know the paths where configuration files and libraries are untrustworthy.  Elevated ("root") privileges is possible.

The workaround is a mess as it adds a new API, __FreeBSD_libc_enter_restricted_mode() to the C library (libc).  A freebsd-update should scare you sufficiently.

The third security advisory is telnetd (affecting all maintained versions of FreeBSD), not kidding:

II.  Problem Description

When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer.

III. Impact

An attacker who can connect to the telnetd daemon can execute arbitrary code with the privileges of the daemon (which is usually the "root" superuser).

On to the fourth security advisory (affecting all maintained versions of FreeBSD): if your SSH server (secure shell server) uses the pam_ssh authentication module, non encrypted SSH private keys, SSH inappropriately grants user access.  "By default, the pam_ssh module rejects SSH private keys with no pass-phrase.  A "nullok" option exists to allow these keys."  The SSH PAM module is not enabled in default FreeBSD installations and SSH is not affected unless PAM authentication is explicitly enabled.

Holiday cheer security advisory number 5: pam_start() does not validate service names (affecting all maintained versions of FreeBSD) - users are able to define PAM policies with a path relative to /etc/pam.d or /usr/local/etc/pam.d, allowing the user define out of scope policies and execute their own modules.  "If an application that runs with root privileges allows the user to specify the name of the PAM policy to load, users who are permitted to run that application will be able to execute arbitrary code with root privileges."

Software  Article & Comments

1 2 3 ... 106 107 108  Next»
Land where drunk cows swim and home to my daily hand