Flash Player update fixes zero-day vulnerability and 24 other critical flaws

Adobe Systems has released a security update for Flash Player in order to fix a publicly known vulnerability, as well as 24 privately reported security flaws.The company issued a warning about the zero-day -- previously unknown and unpatched -- vulnerability on Tuesday, saying that it is aware of an exploit available in the wild. The flaw, tracked as CVE-2016-4117, was reported by security researchers from FireEye.To read this article in full or to leave a comment, please click here

Half the Web’s traffic comes from bots, and that’s costing you more than you think

Roughly half of all Web traffic comes from bots and crawlers, and that's costing companies a boatload of money.That's one finding from a report released Thursday by DeviceAtlas, which makes software to help companies detect the devices being used by visitors to their websites.Non-human sources accounted for 48 percent of traffic to the sites analyzed for DeviceAtlas's Q1 Mobile Web Intelligence Report, including legitimate search-engine crawlers as well as automated scrapers and bots generated by hackers, click fraudsters and spammers, the company said.To read this article in full or to leave a comment, please click here

Open Data Platform Initiative looks to ease fears

VANCOUVER, BC -- Last year's foundation of the Open Data Platform Initiative (ODPi), a collaborative project of The Linux Foundation that aims to reduce complexity surrounding the Hadoop ecosystem, made waves in certain parts of the Apache Software Foundation (ASF) concerned by the creation of an external organization that could exert influence over Apache projects.At the Apache: Big Data North America conference in Vancouver, BC this week, the ODPi moved to ease those concerns through dialog and sponsorship of the ASF.To read this article in full or to leave a comment, please click here

Google’s cool new natural language tool is called Parsey McParseface

Google has changed the way developers build applications that understand human language -- and in the finest tradition of the Internet, has named the result after Boaty McBoatface. The company announced a new SyntaxNet open-source neural network framework that developers can use to build applications that understand human language. As part of that release, Google also introduced Parsey McParseface, a new English language parser that was trained using SyntaxNet.To read this article in full or to leave a comment, please click here

How to fix Internet security

The Internet is all-encompassing. Between mobile devices and work computers, we live our lives on it -- but our online existence has been tragically compromised by inadequate security. Any determined hacker can eavesdrop on what we say, impersonate us, and perform all manner of malicious activities.Clearly, Internet security needs to be rethought. Retrofitting security and privacy controls onto a global communications platform is not easy, but few would argue that it's less than absolutely necessary.[ Deep Dive: How to rethink security for the new world of IT. | Discover how to secure your systems with InfoWorld's Security newsletter. ] Why should that be? Was the Internet built badly? No, but it was designed for a utopian world where you can trust people. When the fledgling Internet was populated by academics and researchers communicating with trusted parties, it didn’t matter that trust relationships weren’t well-implemented or communications weren’t secure by default. Today it matters very much, to the point where data breaches, identity theft, and other compromises have reached crisis levels.To read this article in full or to leave a comment, please click here

How to fix Internet security

The Internet is all-encompassing. Between mobile devices and work computers, we live our lives on it -- but our online existence has been tragically compromised by inadequate security. Any determined hacker can eavesdrop on what we say, impersonate us, and perform all manner of malicious activities.Clearly, Internet security needs to be rethought. Retrofitting security and privacy controls onto a global communications platform is not easy, but few would argue that it's less than absolutely necessary.[ Deep Dive: How to rethink security for the new world of IT. | Discover how to secure your systems with InfoWorld's Security newsletter. ] Why should that be? Was the Internet built badly? No, but it was designed for a utopian world where you can trust people. When the fledgling Internet was populated by academics and researchers communicating with trusted parties, it didn’t matter that trust relationships weren’t well-implemented or communications weren’t secure by default. Today it matters very much, to the point where data breaches, identity theft, and other compromises have reached crisis levels.To read this article in full or to leave a comment, please click here

How to fix Internet security

The Internet is all-encompassing. Between mobile devices and work computers, we live our lives on it -- but our online existence has been tragically compromised by inadequate security. Any determined hacker can eavesdrop on what we say, impersonate us, and perform all manner of malicious activities.Clearly, Internet security needs to be rethought. Retrofitting security and privacy controls onto a global communications platform is not easy, but few would argue that it's less than absolutely necessary.[ Deep Dive: How to rethink security for the new world of IT. | Discover how to secure your systems with InfoWorld's Security newsletter. ] Why should that be? Was the Internet built badly? No, but it was designed for a utopian world where you can trust people. When the fledgling Internet was populated by academics and researchers communicating with trusted parties, it didn’t matter that trust relationships weren’t well-implemented or communications weren’t secure by default. Today it matters very much, to the point where data breaches, identity theft, and other compromises have reached crisis levels.To read this article in full or to leave a comment, please click here

House GOP seeks $120M for visa fraud-catching software

House Republican lawmakers have introduced legislation intended to bolster the scrutiny of people entering this country. Its impetus is last year's terrorist attack by a married couple who killed 14 people in San Bernardino, Calif. and wounded 22. But the bill's provisions will affect all visas, including the H-1B.The legislation, submitted Thursday and led by Rep. Bob Goodlatte  (R-Va.), the chair of the House Judiciary Committee, specifically requires analytics software "to ensure proactive detection of fraud" in the immigration process.The software analysis requires the government "to utilize social media and other publicly available information" to determine whether an applicant is a security threat. One of the San Bernardino attackers, Tashfeen Malik, had allegedly posted allegiance to ISIL on Facebook, something which wasn't revealed until after the attack. She and her husband, Syed Rizwan Farook, were killed by police in a shootout.To read this article in full or to leave a comment, please click here

House GOP seeks $120M for visa fraud-catching software

House Republican lawmakers have introduced legislation intended to bolster the scrutiny of people entering this country. Its impetus is last year's terrorist attack by a married couple who killed 14 people in San Bernardino, Calif. and wounded 22. But the bill's provisions will affect all visas, including the H-1B.The legislation, submitted Thursday and led by Rep. Bob Goodlatte  (R-Va.), the chair of the House Judiciary Committee, specifically requires analytics software "to ensure proactive detection of fraud" in the immigration process.The software analysis requires the government "to utilize social media and other publicly available information" to determine whether an applicant is a security threat. One of the San Bernardino attackers, Tashfeen Malik, had allegedly posted allegiance to ISIL on Facebook, something which wasn't revealed until after the attack. She and her husband, Syed Rizwan Farook, were killed by police in a shootout.To read this article in full or to leave a comment, please click here

SWIFT warns of malware attack on another of its customers

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.To read this article in full or to leave a comment, please click here

SWIFT warns of malware attack on another of its customers

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.To read this article in full or to leave a comment, please click here

New build of Windows 10 Anniversary Update preview tweaks Edge, Wi-Fi Sense

The march towards the release of this summer's Windows 10 Anniversary Update continues with the May 10th release of the latest preview: build 1432. It's a minor update focusing primarily on improving the Edge browser's extension installation process and launching four new extensions.There's also a surprise in this build: The death of the most controversial aspect of Wi-Fi Sense, the feature that some people worried could invade their privacy by sharing their Wi-Fi passwords with their friends and contacts.To read this article in full or to leave a comment, please click here

Open sourcing our NGINX HTTP/2 + SPDY code

In December, we released HTTP/2 support for all customers and on April 28 we released HTTP/2 Server Push support as well.

The release of HTTP/2 by CloudFlare had a huge impact on the number of sites supporting and using the protocol. Today, 50% of sites that use HTTP/2 are served via CloudFlare.

CC BY 2.0 image by JD Hancock

When we released HTTP/2 support we decided not to deprecate SPDY immediately because it was still in widespread use and we promised to open source our modifications to NGINX as it was not possible to support both SPDY and HTTP/2 together with the standard release of NGINX.

We've extracted our changes and they are available as a patch here. This patch should build cleanly against NGINX 1.9.7.

The patch means that NGINX can be built with both --with-http_v2_module and --with-http_spdy_module. And it will accept both the spdy and http2 keywords to the listen directive.

To configure both HTTP/2 and SPDY in NGINX you'll need to run:

./configure --with-http_spdy_module --with-http_v2_module --with-http_ssl_module

Note that you need SSL support for both SPDY and HTTP/2.

Then it will be possible to configure an NGINX server to support both HTTP/2 and SPDY on Continue reading

Technology Short Take #66

Welcome to Technology Short Take #66! In this post you’ll find a collection of links to articles about the major data center technologies. Hopefully something I’ve included here will be useful to you. Enjoy!

Networking

  • I recently spoke at Interop 2016 in Las Vegas, and while I was there I scribbled down some notes pertaining to how decomposing applications into microservices-based architectures was similar in some respects to decomposing networks into an overlay network and an underlay (physical) network. It’s still something I’m exploring, but I hope to get something written up soon. In the meantime, I’d love to hear your thoughts about it. Feel free to hit me up on Twitter or drop me an e-mail.
  • While I’m talking about the overlay/underlay model, I found this article by Tom Nolle discussing how using the overlay/underlay model could enable agile infrastructure. It’s a good post, well worth reading (in my opinion).

Servers/Hardware

Nothing this time around. Maybe next time?

Security

  • In the event you’re interested in an idea of how much latency the use of in-kernel hypervisor firewalling (such as that offered by VMware NSX) adds, have a look at this article by Sean Howard.

Cloud Computing/Cloud Management

Docker at OSCON: The Highlights

OSCON is the largest open source conference of the year, and Docker has a big presence again this year. OSCON starts with Open Container Day because of the importance the container ecosystem has taken on for the open source world. There will … Continued

DHS Inspector General lambasts TSA’s IT security flaws

The Transportation Security Administration’s IT department has persistent security problems including unpatched software, inadequate contractor oversight, physical security and inadequate vulnerability reporting.+More on Network World: 26 of the craziest and scariest things the TSA has found on travelers+Those were the main conclusions outlined in a report this week from the Department of Homeland Security’s Office of Inspector General which specifically took a look at the TSA’s Security Technology Integrated Program (STIP) which it defines as a “mission-essential data management system that connects airport transportation security equipment to servers. Connection to a centralized server allows remote management of passenger and baggage screening equipment and facilitates equipment maintenance, including software changes in response to emerging threats.”To read this article in full or to leave a comment, please click here

1 … 2,894 2,895 2,896 2,897 2,898 … 3,767