OpenSSL fixes high-severity flaw that allows hackers to crash servers

The widely used code library is also purged of a certificate verification bypass.

Stylized image of a floating padlock.

Enlarge (credit: Getty Images)

OpenSSL, the most widely used software library for implementing website and email encryption, has patched a high-severity vulnerability that makes it easy for hackers to completely shut down huge numbers of servers.

OpenSSL provides time-tested cryptographic functions that implement the Transport Layer Security protocol, the successor to Secure Sockets Layer that encrypts data flowing between Internet servers and end-user clients. People developing applications that use TLS rely on OpenSSL to save time and avoid programming errors that are common when noncryptographers build applications that use complex encryption.

The crucial role OpenSSL plays in Internet security came into full view in 2014 when hackers began exploiting a critical vulnerability in the open-source code library that let them steal encryption keys, customer information, and other sensitive data from servers all over the world. Heartbleed, as the security flaw was called, demonstrated how a couple lines of faulty code could topple the security of banks, news sites, law firms, and more.

Read 9 remaining paragraphs | Comments

Linus Torvalds weighs in on Rust language in the Linux kernel

“Memory managed languages? In my kernel?” It’s more likely than you think.

Rust coats a pipe in an industrial construction site.

Enlarge / No, not that kind of Rust. (credit: Heritage Images via Getty Images)

This week, ZDNet's Steven J. Vaughan-Nichols asked Linus Torvalds and Greg Kroah-Hartman about the possibility of new Linux kernel code being written in Rust—a high performance but memory-safe language sponsored by the Mozilla project.

C versus Rust

As of now, the Linux kernel is written in the C programming language—essentially, the same language used to write kernels for Unix and Unix-like operating systems since the 1970s. The great thing about C is that it's not assembly language—it's considerably easier to read and write, and it's generally much closer to directly portable between hardware architectures. However, C still opens you up to nearly the entire range of catastrophic errors possible in assembly.

In particular, as a nonmemory-managed language, C opens the programmer up to memory leaks and buffer overflows. When you're done with a variable you've created, you must explicitly destroy it—otherwise, old orphaned variables accumulate until the system crashes. Similarly, you must allocate memory to store data in—and if your attempt to put too much data into too-small an area of RAM, you'll end up overwriting locations you shouldn't.

Read 11 remaining paragraphs | Comments

Court Hears Arguments in Canadian Pirate Site Blocking Appeal

TekSavvy went up against major media companies including Bell and Rogers in Canada’s Federal Court of Appeal this week. The Court, which has to decide whether the country’s first pirate site blocking order can stay in place, heard arguments from both sides and intervening parties including the Canadian domain name registry.

From: TF, for the latest news on copyright battles, piracy and more.

canada flagTwo years ago, Canadian broadcasting giants Groupe TVA, Bell, and Rogers took the relatively small pirate IPTV service GoldTV to court.

What started as a straightforward copyright lawsuit soon transformed into something much more than that. With the pirate site not responding, the rightsholders requested an injunction requiring local ISPs to block the service.

Canada’s Site Blocking Order

Fast forward a few months and Canada became the first North American country to implement a court-ordered Internet provider blockade of a pirate site.

This was a big win for the three companies whose plan for a Government-sanctioned pirate site blocking scheme was previously denied. And, given the interest in site-blocking orders around the world, it was likely just the start.

TekSavvy Appeals

While most ISPs accepted the order without protest, TekSavvy appealed. This appeal gained the interest of other rightsholders and third parties such as Canada’s domain registry and CIPPIC, who all decided to intervene.

This week the Federal Court of Appeals heard the arguments from both camps over the span of two days. Due to the Covid pandemic, the hearing was virtual, with the attorneys from various parties making their appearances through a Zoom call.

Blocking Opponents

First up was attorney Justin Baxtor, who represents TekSavvy in this matter. He went over the various legal angles and where site-blocking is running into issues with the law and net neutrality. As is often the case in site blocking discussions, the US SOPA debacle was mentioned as well.

When SOPA was discussed in the US there were calls for site-blocking in Canada as well, Baxtor notes. Interestingly, however, companies including Bell rejected these proposals at the time. Today they sit on the other side of the table.

TekSavvy is not the only opposing party. During the hearing, it received support from Canada’s domain registry CIRA and the University of Ottowa’s legal clinic CIPPIC. Both argued against court-imposed pirate site blockades.

Blocking Supporters

On the other side, Bell, Rogers, and other rightsholders such as the Music Industry Coalition, defended the decision to block pirate sites and services. They view blocking as a limited measure that is narrowly targeted at services that are clearly copyright infringing.

They agree that site blocking isn’t explicitly mentioned in the Copyright Act, but note that courts are allowed to issue any type of injunction if a party’s copyrights are at stake. Net neutrality isn’t an issue either, as long as the court approves the blockade and it targets unlawful content, they argue.

The rightsholders see site blocking as one of the few viable options they have to stop pirate sites and services. Therefore, it should stay in place.

The Federal Court of Appeal hearings on Wednesday and Thursday highlighted these and many other issues. It is now up to the judges to decide whether the blocking measure stays in place, or if it should be scrapped.

TekSavvy and CIRA Comments

TorrentFreak reached out to Bell, which didn’t reply to our request for comment. The Canadian domain registry CIRA did respond. While it couldn’t comment on any specifics, the organization stresses the importance of this case.

“This week’s hearing reminds us that we stand at a fork in the road for Canada’s internet. Blocking different parts of the web has become a burning issue amongst Canadian courts, policymakers, and regulators. Gone are the days of the ‘anything goes’ web,” says CIRA president and CEO Byron Holland.

“CIRA believes there are more appropriate control points in the internet’s architecture for addressing alleged copyright infringement than DNS blocking. Blocking should never be used when a more proportionate response is available.”

TekSavvy’s vice-president of regulatory affairs, Andy Kaplan-Myrth, wasn’t able to respond in detail. However, he pointed us to a statement he released earlier this week.

Some argue that TekSavvy is digging its heels into the sand to defend pirates, but Kaplan wholeheartedly disagrees. The ISP is defending its role as a neutral carrier. If there’s a need for Internet providers to police the Internet, the Government should make this decision, not the court.

“We’re defending our role as common carriers. It’s the same position that all telecom companies argue until they get to the point where they become more interested in enforcing their copyright than net neutrality,” Kaplan said.

From: TF, for the latest news on copyright battles, piracy and more.

Microsoft begins removing paid Xbox Live requirement for free-to-play games

Move will bring Xbox in line with PlayStation and Switch’s online subscriptions.

Xbox Live gamers will soon have a new reason to rejoice.

Xbox Live gamers will soon have a new reason to rejoice. (credit: Xbox)

Xbox owners soon won't need to pay for an Xbox Live Gold subscription to enjoy otherwise free-to-play games on their consoles. Wednesday's update to the Xbox Alpha Insiders Update Preview program (version 2104.210323-0000) notes that "Multiplayer in Free-to-play games, Looking 4 Groups and Party Chat on Xbox no longer requires an Xbox Live Gold membership." These features are being tested with Insiders "ahead of general availability," according to the update.

Microsoft first announced this move back in January as the company was busy rolling back a controversial planned increase in Xbox Live Gold prices. Back then, Microsoft said the free-to-play change was coming "as soon as possible in the coming months," but the rollout to Insiders suggests it will be reaching all Xbox players imminently.

Microsoft's decision here brings the service in line with its major console competitors. When Sony started charging for multiplayer gameplay on PlayStation Network in 2014, it included a specific carve-out for "a selection of free-to-play multiplayer titles [that] will be available without a PS Plus membership." Nintendo included a similar carve-out for free-to-play titles like Fortnite when it started charging for its Switch Online service in 2018.

Read 3 remaining paragraphs | Comments

Lilbits: Windows, Linux, and Intel news

This week Microsoft released Windows Insider Preview Build 21343 which introduces new icons for File Explorer and brings improvements for the Windows Sandbox and Microsoft Defender Application Guard. It turns out there are also a few features Microsof…

This week Microsoft released Windows Insider Preview Build 21343 which introduces new icons for File Explorer and brings improvements for the Windows Sandbox and Microsoft Defender Application Guard. It turns out there are also a few features Microsoft didn’t mention – including an option to restart currently running apps after you sign out and sign […]

The post Lilbits: Windows, Linux, and Intel news appeared first on Liliputing.

Daily Deals (3-25-2021)

Amazon is running a sale on Aukey true wireless earbuds, with some models selling for as little as $21. The sale also includes some of the best prices I’ve seen to date on earbuds with active noise cancellation. One pair is selling for just $30,…

Amazon is running a sale on Aukey true wireless earbuds, with some models selling for as little as $21. The sale also includes some of the best prices I’ve seen to date on earbuds with active noise cancellation. One pair is selling for just $30, while a set with hybrid ANC using external and internal […]

The post Daily Deals (3-25-2021) appeared first on Liliputing.

Today’s best tech deals: Razer gaming mice, Sony headphones, and more

Dealmaster also has deals on Away suitcases, Half-Life: Alyx, and portable SSDs.

Today’s best tech deals: Razer gaming mice, Sony headphones, and more

Enlarge (credit: Ars Technica)

Today's Dealmaster includes a solid discount on the Razer Viper Ultimate, which is currently down to $93 at Amazon. That's about $25 off its usual street price online, almost $40 off Razer's MSRP and, outside of a couple of brief drops to $80, the second-lowest price we've tracked. While it's still pretty expensive, the Viper Ultimate is currently our top recommendation among wireless gaming mice: it offers an ultralight (74 g) and ambidextrous design, a number of easily customizable settings, and supremely accurate performance. If you're interested in a premium wireless mouse but would prefer a less flat design, Razer's Basilisk Ultimate offers similar performance and is also on sale for about $30 off. Just note that neither mice connects over Bluetooth, so you'll need a free USB-A port to use either device's wireless receiver.

Elsewhere, our deals roundup includes an ongoing sale on Sony's outstanding WH-1000XM4 noise-canceling headphones, a rare 30 percent off sale on Away luggage gear, the lowest price we've tracked on the excellent VR game Half-Life: Alyx, deals on good portable SSDs, and much more. You can take a look at the full rundown below.

Note: Ars Technica may earn compensation for sales from links on this post through affiliate programs.

Read 1 remaining paragraphs | Comments