Wayland is the fancy new standard that never seems to stably work for me on any of my machines :( Thanks for letting me revert to X in the login screen, GNOME.
No, it comes together with a CLA being required to contribute. In other words, Canonical (and only Canonical) is still allowed to sell exceptions to the AGPL.
Quite the same case as with matrix. I very much prefer AGPL over all the other permissive licences, but I don’t know, the CLA leaves a bad taste in the mouth
I tried reading through it and I don’t understand completely if they reserve the right to relicense in a way that is against the interest of contributor.
They say that the contributor retains the copyright and can do whatever they want with the code they contributed, which is good, they also say that they can sublicense your contributions, which, as far as I know, means they couldn’t make it more permissive, but only more restrictive, at least that is the case with Creative Commons
Thanks so much for this post! Ventoy is really the tool I never knew I really needed. Up to now, I have been reflashing and juggling sticks with various ISOs.
But even better, now I could finally update the BIOS on my Framework 13!
If you want something user-friendly, use Linux Mint. There’s really no reason to choose Ubuntu over this. And for any other use it’s outclassed by other distros, it does not fill a niche. And I personally think that GNOME is crap and quite hideous.
I’m at college at the moment, so printing is essential for me, right now I can’t print on my desktop but my laptop can do it fine, but yeah that was the final step fot the shift
I get your point that the exploit existed before it was identified, but an unmitigated exploit that people are aware of is worse than an unmitigated exploit people aren't aware of. Security through obscurity isn't security, of course, but exploiting a vulnerability is easier than finding, then exploiting a vulnerability. There is a reason that notifying the company before publicizing an exploit is the standard for security researchers.
You're right that it's never an OK title, because fuck clickbait, but until it's patched and said patch propagates into the real world, more people being aware of the hole does increase the risk (though it doesn't sound like it's actually a huge show stopper, either).
Weakness and risk are distinct things, though—and while security-through-obscurity is dubious, “strength-through-obscurity” is outright false.
Conflating the two implies that software weaknesses are caused by attackers instead of just exploited by them, and suggests they can be addressed by restricting the external environment rather than by better software audits.
In my opinion Dan Goodin always reports as an alarmist and rarely gives mitigation much focus or in one case I recall, he didn't even mention the vulnerable code never made it to the release branch since they found the vulnerability during testing, until the second to last paragraph (and pretended that paragraph didn't exist in the last paragraph). I can't say in that one case, it wasn't strategic but it sure seemed that way.
For example, he failed to note that the openssh 9.6 patch was released Monday to fix this attack. It would have went perfectly in the section called "Risk assessment" or perhaps in "So what now?" mentioned that people should, I don't know, apply the patch that fixes it.
Another example where he tries scare the reading stating that "researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice." which is fine to show how prevalent the algorithms are used but does not mention that the attack would have to be complicated and at both end points to be effective on the Internet or that the attack is defeated with a secure tunnel (IPSec or IKE for example) if still supporting the vulnerable key exchange methods.
He also seems to love to bash FOSS anything as hard as possible, in what to me, feels like a quest to prove proprietary software is more secure than FOSS. When I see his name as an author, I immediately take it with a grain of salt and look for another source of the same information.
Even the researcher who reported this doesn’t go as far as this headline.
“I am an admin, should I drop everything and fix this?”
Probably not.
The attack requires an active Man-in-the-Middle attacker that can intercept and modify the connection’s traffic at the TCP/IP layer. Additionally, we require the negotiation of either ChaCha20-Poly1305, or any CBC cipher in combination with Encrypt-then-MAC as the connection’s encryption mode.
[…]
“So how practical is the attack?”
The Terrapin attack requires an active Man-in-the-Middle attacker, that means some way for an attacker to intercept and modify the data sent from the client or server to the remote peer. This is difficult on the Internet, but can be a plausible attacker model on the local network.
It definitely receives more clicks. I’ve posted this link here a day ago, but arstechnicas title is more engaging. My first thought was whether there’s been another vulnerability found.
That said, this headline isn’t as bad as it could’ve been.
Yeah, if the attacker is in a position to do a MitM attack you have much larger problems than a ssh vulnerability that so far can at most downgrade the encryption of your connection in nearly all cases
Personally I don’t really hate Ubuntu, but I tend to find that everything it does, there’s something else that does it slightly better.
For example, it’s supposed to be a good ‘beginner’ distro or good for something that ‘just works’, but IMO things like Mint or Pop!OS do it a little better these days. Snap is supposed to be a nice simple way to manage packages without worrying about dependencies, but Flatpak does it better and so on.
So yeah I don’t hate it, I just don’t see any particular reason to really use it. Opinions may vary though of course.
Just checked my own sshd configs and I don’t use CBC in them. I’ve based the kex/cipher/Mac configs off of cipherlist.eu and the mozilla docs current standards. Guess it pays to never use default configs for sshd if it’s ever exposed to the Internet.
Edit: I read it wrong. It’s chacha20 OR CBC. I rely heavily on the former with none of the latter.
linux
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.