Steven J. Vaughan-Nichols writes in »FFmpeg to Google: Fund Us or Stop Sending Bugs« for thenewstack.io

Lorenc added, in an e-mail to me, that “Creating and publishing software under an open source license is an act of contribution to the digital commons. Finding and publishing information about security issues in that software is also an act of contribution to the same commons.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The text was automatically translated from German into English. The German quotations were also translated in sense.

IONOS writes in »Why digital sovereignty is key public sector transformation« for theregister.com

If administrative IT infrastructure comes under the control of other countries or depends on opaque technology stacks, then sovereignty is nothing more than a facade. Only when both the infrastructure and IT operations remain fully under European control can public institutions guarantee genuine digital sovereignty.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The text was automatically translated from German into English. The German quotations were also translated in sense.

What’s at stake

• Public package registries like Maven Central, PyPI, crates.io, or Packagist underpin the software supply chains
• Running them requires people, hosting, and security — costs that have so far often been borne by a few organizations or volunteers
• Expectations are rising, for example around availability, signing, compliance, and protection against abuse
• What’s being called for are models where large users contribute more, without restricting openness

I can empathize with the pain described and at the same time see the dilemma. Those who invest time or money take on responsibility, but by doing so also put themselves at a competitive disadvantage compared with those who use everything for free. That’s manageable for large companies, but barely feasible for small firms in fierce competition. Still, it remains indisputable that the infrastructure — and the ecosystem — will not be sustainable in the long run without contributions.

The text was automatically translated from German into English. The German quotations were also translated in sense.

Felix Reda writes in »We need a European Sovereign Tech Fund« on github.blog:

There is a profound mismatch between the importance of open source maintenance and the public attention it receives. The demand-side value of open source software to the global economy is estimated at $8.8 trillion, and the European Commission’s own research shows that OSS contributes a minimum of €65-95 billion to the EU economy annually. Basic open source technologies, such as libraries, programming languages, or software development tools, are used in all sectors of the economy, society, and public administrations.

I reproduced the following table because I found the numbers interesting.

GitHub cites a study that they commissioned themselves.

The text was automatically translated from German into English. The German quotations were also translated in sense.

What’s also alarming, researchers said, is that the hackers have gained access to keys that may allow them to regain entry even after a system is patched.

Once again, a security vulnerability in Microsoft’s software was exploited. And of course: no system is completely secure. But when almost everyone uses the same software, a single flaw becomes a widespread risk. That’s exactly the case with Microsoft Office, SharePoint, or Windows.

That such dominant software poses a security problem is no accident, but a direct consequence of market concentration. A monoculture system is efficient, but fragile. Microsoft’s position in the market is not the result of superior technology, but of decades of dependency.

Digital sovereignty begins with diversity. Anyone who seriously talks about security must also talk about alternatives—and use them. Because only a diverse market truly makes attacks harder.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The Rise of Fake GitHub Stars: A Growing Security Threat for cyberinsider.com

That being said, it is recommended that repository activity be verified beyond star counts. Look for meaningful contributions like issues, pull requests, and active discussions. Additionally, reputation metrics, such as OpenSSF Scorecards, should be considered, as they provide a holistic evaluation of software security.

GitHub is also responsible for tackling this problem. The paper suggests the implementation of weighted popularity metrics that account for account authenticity and activity diversity. Also, it is recommended that the platform enhances moderation systems to correlate fake star activity with malicious repositories for timely takedowns.

The text was automatically translated from German into English. The German quotations were also translated in sense.

Some think that open source software is generally more secure, but is it? Open source software mainly made in the West has well-documented security issues of its own, due in part to its heavy reliance on overworked and volunteer maintainers. Securing open source software requires time, energy and diligence. Unfortunately, many projects are very thinly resourced and lack the expertise required to look for security risks diligently.

The text was automatically translated from German into English. The German quotations were also translated in sense.

In their statement »Ethical Web Principles« they really put it succinctly: the web should be for everyone.

The web should be a platform that helps people and provides a positive social benefit. As we continue to evolve the web platform, we must therefore consider the consequences of our work. The following document sets out ethical principles that will drive W3C’s continuing work in this direction.

I think this document is great! It underlines how important it is to keep developing the web as an open, inclusive, and positive platform.

The text was automatically translated from German into English. The German quotations were also translated in sense.

Tom Warren writes in ‘Every Microsoft employee is now being judged on their security work’ for theverge.com

Kathleen Hogan, Microsoft’s chief people officer, has outlined what the company expects of employees in an internal memo obtained by The Verge. “Everyone at Microsoft will have security as a Core Priority,” says Hogan. “When faced with a tradeoff, the answer is clear and simple: security above all else.”

The text was automatically translated from German into English. The German quotations were also translated in sense.

We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study’s results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

The text was automatically translated from German into English. The German quotations were also translated in sense.

The GrayKey itself is a small, 4×4 inches box with two lightning cables for connecting iPhones, according to photographs published by cybersecurity firm Malwarebytes. The device comes in two versions: a $15,000 one which requires online connectivity and allows 300 unlocks (or $50 per phone), and an offline, $30,000 version which can crack as many iPhones as the customer wants. Marketing material seen by Forbes says GrayKey can unlock devices running iterations of Apple’s latest mobile operating system iOS 11, including on the iPhone X, Apple’s most recent phone.

So it’s advisable to replace the numeric PIN with an alphanumeric passcode.

You can find the setting on iOS as follows:

Einstellung > Touch ID & Code > Pin eingeben > Code ändern > alten Pin eingeben > Codeoptionen > Neuen Pincode eingeben > noch einmal eingeben > fertig.

Thanks tarah

The text was automatically translated from German into English. The German quotations were also translated in sense.

Mobile vendors have established fingerprints as a biometric feature to unlock smartphones. Now they turn to iris recognition, as do hackers. This video demonstrates how to circumvent the iris recognition of the Samsung Galaxy S8 flagship phone only using basic tools.

The linked video clearly shows that you don’t need expensive hardware to bypass the iris scanner.

The text was automatically translated from German into English. The German quotations were also translated in sense.

It’s impressive how prophetic George Orwell already was in 1948.

In many respects his theories are still applicable to today’s fear of constant surveillance.

A really great story that everyone should read.

“The old civilizations claimed to be founded on love or justice. Ours is founded on hatred.” — “1984” by George Orwell

The text was automatically translated from German into English. The German quotations were also translated in sense.