Open Source

  • Crowdfunding for Tails

    Steve WoodsLinux, Open Source, Tech

    Tails logoTails is a live Linux operating system (based on Debian. Ed.), that can be booted on almost any computer from a DVD, USB stick or SD card. Tails aims at preserving its users’ privacy and anonymity, as well as helping them to:

    • use the Internet anonymously and circumvent censorship; all connections to the internet are forced to go through the Tor network;
    • leave no trace on the computer being used without your requesting it;
    • use state-of-the-art cryptographic tools to encrypt your files, emails and instant messaging.

    A crowdfunding campaign to support encryption tools for journalists has been launched by The Freedom of the Press Foundation; this campaign will last for two months and is collecting funds for Tails, Tor, the encrypted mobile communication tools RedPhone and TextSecure, plus the LEAP encrypted email platform.

  • Anti-brute force attack tool DenyHosts locks admins out

    Steve WoodsOpen Source, Tech

    DenyHosts logoAttackers can force the DenyHosts security tool to block any IP addresses they want due to a security hole, according to German IT news site Heise. To all intents and purposes, the tool ensures that IP addresses are added to a blacklist after a certain number of failed ssh log-in attempts. However, if a specially formatted user name is entered when logging in, any IP address the user wants can be added to the blacklist, including that of the administrator if the worst comes to the worst.

    The vulnerability was discovered by Helmut Grohne of Cygnus Networks. He wrote on the oss-sec mailing list that entering ssh connections using the following pattern was sufficient to implement the exploit:

    ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21

    The following line, amongst others, is then added to the log:

    sshd[123]: input_userauth_request: invalid user Invalid user root from 123.123.123.123 [preauth]

    According to Grohne this results in the specified user name (parameter -l) being blocked in addition to the attacker’s actual IP address.

    However, Grohne hasn’t just drawn attention to the problem, but has also provided a solution: a patch he has developed the tightens up DenyHosts’ regular expressions for matching log file entries so that the user names specified in the example above is not wrongly interpreted any more.

    Patched versions of DenyHosts are already being distributed via the Debian repositories. Yves-Alexis Perez from the Debian Security Team is advising DenyHosts users to switch to alternatives such as fail2ban since DenyHosts has not been actively maintained since 2008.

  • Crowdfunding campaign for GnuPG

    Steve WoodsOpen Source, Tech

    GNU PG logoHeise reports that the GnuPG project has launched a crowdfunding campaign to raise €24,000 for the further development of the free encryption software. According to chief developer Werner Koch, the aim of the campaign is to make GnuPG easier to use and understand for the general public. GnuPG has seen a sharp increase in popularity in the wake of Edward Snowden’s disclosures about the activities of the US’ National Security Agency (NSA) and Britain’s GCHQ.

    GnuPG implements the OpenPGP and S/MIME standards (the latter with effect from version 2.0. Ed.) The software is used mainly for email encryption. Due to its open source code, the software is free of backdoors and is used amongst others by NSA whistleblower Edward Snowden, security expert Bruce Schneier and PGP inventor Phil Zimmermann.

    The developers want to get version 2.1 of GnuPG ready and released with the crowdfunding monies. Major changes to the GnuPG website are also planned: pages will be adapted for viewing on mobile devices and the developers also want to link to third party instructions, videos and manuals, to provide a user-friendly download page for all devices and enable anonymous access via Tor. A new server for web services and the creation of an infrastructure for processing regular donations are also planned.

    According to Joinup, GnuPG’s crowdfunding campaign will run for 40 days. The campaign was launched at 10.00 am on Thursday morning. By 5.00 pm donors had already pledged over half the requested amount. Donors can choose between donating €5 in exchange for their name being mentioned on the site, €12 in exchange for a sticker, whilst those pledging €35 euro will receive a t-shirt and those giving €60 or more will receive an email address at the GnuPG.net domain.

  • Recommended: Scribus

    Steve WoodsLinux, Open Source, Tech

    In the immediate aftermath of my mother’s recent death, I offered to prepare the order of service for her funeral. I felt this was one small service I could perform for her, as well as presenting me with an ideal opportunity to re-acquaint myself with Scribus, the free and open source desktop publishing (DTP) package.

    screenshot of Scribus
    My mother’s order of service being edited in Scribus. Click on image for full-sized version

    When it comes to operating systems, Scribus will run on Linux, other Unix-like operating systems, Mac OS X, Haiku, Microsoft Windows, OS/2 and eComStation; and that’s pretty impressive for a start.

    Scribus is designed for layout, typesetting and preparing files for professional quality image setting equipment. It can also create animated and interactive PDF presentations and forms. Example of its use include writing small newspapers, brochures, newsletters, posters and books.

    Scribus supports most major bitmap formats, including TIFF, JPEG and Adobe Photoshop. Vector drawings can either be imported or directly opened for editing. The long list of supported formats includes Encapsulated PostScript, SVG, Adobe Illustrator, and Xfig. Professional type/image setting features include CMYK colors and ICC color management. It has a built-in scripting engine using Python.

    Text can be imported from OpenDocument (ODF) text documents, such as those produced by LibreOffice Writer, Microsoft Word, PDB (Palm OS) and HTML formats, although some limitations apply. OpenDocument text (.odt) files can typically be imported along with their paragraph styles, which are then created in Scribus. HTML tags which modify text, such as bold or italic will also be handled pretty well.

    Scribus is available in more than 24 languages and is released under the GNU General Public Licence (GPL).

  • Canonical forks Gnome Control Centre*

    Steve WoodsLinux, Open Source, Tech

    Ubuntu logoRobert Ancell of Canonical, the company behind the popular Ubuntu Linux distribution, has announced on the Ubuntu desktop mailing list that Canonical is forking the Gnome Control Centre.

    Robert’s email is reproduced in full below.

    Hi all,

    Ubuntu makes use of a heavily patched gnome-control-center (61 patches) and we will in future move to the new Ubuntu System Settings [1] once we achieve convergence. We are already running an old version of gnome-control-center (3.6) and the value for Ubuntu in upgrading this is low since it would take a lot of work to update our changes. Running an old version until convergence blocks those who do use GNOME (i.e. Ubuntu GNOME).

    For these reasons it has been discussed that we should fork gnome-control-center 3.6 for Unity into unity-control-center [2].

    To be very clear, this is a fork with a limited lifespan. We don’t expect to make significant changes to it outside of stability and security fixes.

    This change affects a number of packages, and I have attempted to find and fix all the side-effects (See bug 1257505 [3]). The proposed changes are in a PPA [4].

    Please test this PPA and post any problems in the bug report. I’d like to land this change into the archive if there are no reasons to block it.

    I also have a fork of gnome-settings-daemon for the same reasons which I am running successfully, I will do a similar call for testing when we have landed the control center changes.

    Thanks,
    –Robert

    [1] https://launchpad.net/ubuntu-system-settings
    [2] https://launchpad.net/ubuntu-control-center
    [3] https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/1257505
    [4] https://launchpad.net/~ubuntu-desktop/+archive/unity-control-center

    * = Spelling in title and author’s text localised to EN-GB! 🙂

  • An open source framework for the “internet of things”

    Steve WoodsLinux, Open Source, Open Standards, Tech

    Today’s Le Monde Informatique reports that the AllSeen Alliance, an umbrella group for major consumer electronics manufacturers, is working on an open source framework with which it will be possible to connect almost anything to the internet.

    Household electrical goods, cars and computers could soon communicate with each other thanks to an open source framework developed by the AllSeen Alliance with the support of the Linux Foundation. This group of major consumer electronics manufacturers includes Cisco, D-Link, Haier, LG Electronics, Qualcomm, Panasonic and Sharp. According to the Linux Foundation, “the framework, originally developed by Qualcomm under the name of the AllJoyn Project, will enable different systems to see each other, to connect and to interact transparently, irrespective of their manufacturer or the operating system they use”. Members of the alliance will contribute to the framework by providing engineering resources and software resources to enable developers, manufacturers and suppliers to provide interoperable services and devices. “Qualcomm has contributed to the AllJoyn code under the aegis of the AllSeen Alliance. This will hold the copyright, offering the project a broader reach,” said Jim Zemlin, Executive Director of the Linux Foundation. “The open source community can also contribute to this code,” he added.

    internet of things graphic

    The framework runs on Linux, Android, iOS, Windows and other OS variants involved. “Developers can download the code already and find details of APIs using the reference source allseenalliance.org and start working,” the Foundation announced. “Once APIs comprising an interoperability layer are supplied to the open source community, it will be possible to graft all sorts of services onto them,” Zemlin stated in an email. For example, the framework could enable users to play music easily because there are various wireless loudspeakers nearby. “Today this would be difficult because the majority of consumers have audio systems from different manufacturers, they store their music on various media and use different cloud storage services,” Zemlin explained. “This framework will therefore enable easy playing of music on compatible loudspeakers near these sources,” he added. “Engineers are already at work writing this code and implementing it in existing products. We are expecting several announcements of this type at the next CES (7th -10th January 2014), ” he stated.

    A truly universal framework

    The framework could also be used to enable a domestic electrical system to turn of a home’s heating system when the house is empty and thus contribute to reducing household energy bills. “Such a system could be adapted to different scenarios; for example, to put household equipment on standby when its occupants are out and turn them on gradually before their return,” Zemlin declared. “The same system could enable the family car to be detected when it’s a mile away, switch on the lights and start up the heating or even open the garage door automatically when the car is approaching,” he added. “All these communications could work with existing transmission technologies – wifi, Bluetooth – and future ones, such as those based on radio waves,” Zemlin also stated.

    The AllSeen Alliance is the Linux Foundation’s 11th collaborative project. “As companies create more products integrating this code, the developer community devoting time to extending and improving this code will grow, just like what happened with other projects based on Linux or OpenStack,” Zemlin stated.

  • USL Umbria 1 migrates 300 workstations to LibreOffice

    Steve WoodsOpen Source, Open Standards, Tech

    USL Umbria 1 logoItalian regional health organisation USL Umbria 1 has completed the first phase of its migration to Libre Office, Libre Umbria reports.

    USL Umbria 1’s territory includes the districts of Perugia, Assisi, Trasimeno, the middle and upper Tiber valley and the upper Chiasco valley (the Chiasco is a tributary of the Tiber. Ed.).

    LibreOffice menu screen
    LibreOffice start centre

    After some two months from the start of the migration, USL Umbria 1 has already converted 300 stations from running proprietary office suites to LibreOffice and is scheduled to migrate the rest of its PC pool within the next few months.

    In parallel with the LibreOffice installation, users are being offered training in the new software; those who’ve already been switched to the open source office suite should complete their training by the end of the year.

    In the opinion of the LibreUmbria project, USL Umbria 1 is a good example of how it is possible for public sector organisations to adopt free and open source software.

  • Phishing email deceives WordPress administrators

    Steve WoodsOpen Source, Tech

    WordPress logoGermany’s Heise Online reports that security firm Sucuri is warning of a wave of phishing emails intended to trick WordPress administrators into installing a plug-in which serves up malware to site visitors. The email ostensibly offers site administrators the Pro version of the popular All in One SEO Pack plug-in free of charge.

    However, anyone clicking on the email’s download link isn’t taken to the official WordPress plug-in page, but to a spammer-infested domain in Australia (.com.au) or Brazil (.com.br). At least administrators should be taken aback by now! According to Sucuri, some of their customers have nevertheless actually installed the malicious plug-in. This results in the malicious code opening a backdoor on the server giving the attackers full access and replacing the infected blog’s index.php file.

    Once installed, the criminals behind the fake plug-in can insert any code they like into their victim’s website and attempt to attack visitors’ computers. Several versions of the malicious plug-in relay visitors to pornography site or other servers which also attempt to install malware on victims’ computers.

    Due to its widespread use, WordPress is a favourite target for hackers who attempt to misuse others’ websites for spam distribution or for DDoS attacks. There was such a DDoS attack recently on a forum in which thousands of legitimate WordPress sites were misused as part of the attack wave without the knowledge of their owners.

Posts navigation