That, too.

@NattNatt said in Raspberry Pi 2 Look Alike with Quad Core Atom Processor:

@scottalanmiller said in Raspberry Pi 2 Look Alike with Quad Core Atom Processor:

@NattNatt said in Raspberry Pi 2 Look Alike with Quad Core Atom Processor:

It's not bad...but the price is super high when it's not MUCH better than the three (1.2Ghz quad core stock, 1GB RAM for £32) will be interested to see how it develops...

Different architecture, though. Very different possible use cases. AMD64 is a lot more flexible. This will run Windows 10 just fine or a Linux desktop.

ah, didnt think about that...so it's verging on Intel Computestick territory rather than Pi territory..?

Correct. This is a quad core Atom, which is AMD64. So instead of ARM, which is great, this is a PC. So you can run essentially anything you can imagine.

0_1461056825211_936f484101e97584cde67b3f13080456.jpg

@scottalanmiller said:

@JaredBusch said in Ecuador 7.8 Earthquake Kills Hundreds - toll expected to climb:

@scottalanmiller said in Ecuador 7.8 Earthquake Kills Hundreds - toll expected to climb:

It has been a tough week on the ring of fire 😞

Yeah the Kyushu quakes were pretty bad too.

Less damage and lower death toll, thanks to very proactive government better construction over all.

And still a lot dead 😞

Many dead, yes. But by comparison to Ecuador, it is a much less.

Save money by not having to comply? That's not how I read this.

I read it completely differently.

Right now the government uses it's secret courts to create court orders that demand that MS hand over things, all the while the user has no idea.

This suit appears to be a demand on the part of MS to be allowed to tell whomever the account belongs to that the government has requested/required this information.

Right now if you're being investigated, you might have no clue. And while I understand how this is good for case building as it doesn't give a heads up to the bad guys so they have more time to hide, but it's been shown time and time again how the government gets it wrong and good people end up in bad places because of mistakes by the government. So the sooner you are made adware of things like this, and you've done nothing wrong, the sooner you can start solving any problems that brought you to their attention in the first place.

@JaredBusch yeah, the forums have few if any developers. That's volunteers/home users helping each other out...

There's only one true professional open source NLE and that's lightworks. However it's not open source yet. They still haven't released the source code..

https://www.lwks.com/index.php?option=com_lwks&view=download&Itemid=206&tab=1

Updated our slave database servers to 10.3 a couple of weeks ago... we roll out phases since we've got so many damn servers. It's always a nightmare. If no issues for the next couple of weeks or additional patches, we'll roll out to primary database servers (they're all sets of master-master, the slaves are for search primarily, but also are useful for a live test if everything passes staging, and they're a hot backup too if any issues arise) and then web servers. We never go down so it's a painfully slow process.

Could it be going into the nonfree repository and getting a separate license agreement to accept? Canonical made Ubuntu a household name by including other things like this. Anyone else remember having to mess with codecs?

@mlnews said:

The LXD project has announced that LXD 2.0 is now released. This is an LTS release and is the first product release of the technology. LXD 2.0 will be included in Ubuntu 16.04 and will be backported to 14.04 and it is expected to be picked up by other Linux distros shortly.

I really wish Red Hat would do more with LXC. It sucks that you have to use Ubuntu to get the cool features like this.

If you look at the documentation for RHEL Atomic they have you use docker by attaching and using a shell in the container. Why do that incorrectly when you have Linux containers to do that?

Hopefully in RHEL 8 you won't need EPEL to get LXC functionality.

From the Badlock page:

What can attackers gain?

The security vulnerabilities can be mostly categorised as man-in-the-middle or denial of service attacks.

Man-in-the-middle (MITM) attacks:
There are several MITM attacks that can be performed against a variety of protocols used by Samba. These would permit execution of arbitrary Samba network calls using the context of the intercepted user.

Impact examples of intercepting administrator network traffic:
Samba AD server - view or modify secrets within an AD database, including user password hashes, or shutdown critical services.
standard Samba server - modify user permissions on files or directories.

Denial-of-Service (DoS) attacks:
Samba services are vulnerable to a denial of service from an attacker with remote network connectivity to the Samba service.
Who is affected?

Affected versions of Samba are:

3.6.x,
4.0.x,
4.1.x,
4.2.0-4.2.9,
4.3.0-4.3.6,
4.4.0
Earlier versions have not been assessed.

How can I fix my systems?

Please apply the patches provided by the Samba Team and SerNet for EnterpriseSAMBA / SAMBA+ immediately.

Patched versions are (both the interim and final security release have the patches):

4.2.10 / 4.2.11,
4.3.7 / 4.3.8,
4.4.1 / 4.4.2.
With the release of Samba 4.4.0 on March 22nd the 4.1 release branch has been marked DISCONTINUED (see Samba Release Planning). Please be aware that Samba 4.1 and below are therefore out of support, even for security fixes. There will be no official security releases for Samba 4.1 and below published by the Samba Team or SerNet (for EnterpriseSAMBA). We strongly advise users to upgrade to a supported release.

Some vendors may choose to ship 4.4.1, 4.3.7, and 4.2.10 versions and add regression patches on top of them, due to wide scale and complexity of this release. Some may also just backport the patches to older releases. Please contact your Samba supplier for details.

What further improvements after patching are suggested?

Mitigations for man-in-the-middle (MITM) attacks:
Network protections that could be used MITM attacks include DHCP snooping, ARP Inspection and 802.1x.

It is recommended that administrators set these additional options, if compatible with their network environment:

server signing = mandatory
ntlm auth = no

Without server signing = mandatory, Man in the Middle attacks are still possible against our file server and classic/NT4-like/Samba3 Domain controller. (It is now enforced on Samba's AD DC.) Note that this has heavy impact on the file server performance, so you need to decide between performance and security. These man in the Middle attacks for smb file servers are well known for decades.

Without 'ntlm auth = no', there may still be clients not using NTLMv2, and these observed passwords may be brute-forced easily using cloud-computing resources or rainbow tables.

Mitigations for denial-of-service (DoS) attack:
Apply firewall rules on the server to permit connectivity only from trusted addresses.

Will encryption protect against these attacks?

The SMB protocol, by default, only encrypts credentials and commands while files are transferred in plaintext. It is recommended that in security / privacy sensitive scenarios encryption is used to protect all communications.

Samba added encryption in version 3.2 in 2008, but only for Samba clients. Microsoft added SMB encryption support to SMB 3.0 in Windows 8 and Windows Server 2012. However, both of these types of encryption only protect communications, such a file transfers, after SMB negotiation and commands have been completed. It is this phase that contains the fixed vulnerabilities.

Samba/SMB encryption is good practice but is not sufficient for protection against these vulnerabilities. Network-level encryption, such as IPSec, is required for full protection as a workaround.

How bad is Badlock?

The severity of Badlock according to the Common Vulnerability Scoring System (CVSS):

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Base: 7.1 (High); Temporal: 6.4 (Medium)

Is this vulnerability exploited currently?

It may be possible since we already have several PoC (none of them will be released in the near future).

What does "Badlock" stand for?

"Badlock" was meant to be a rather generic name and does not point to any specifics.

Yet Another Bug With A Logo?

What branded bugs are able to achieve is best said with one word: Awareness. Furthermore names for bugs can serve as unique identifiers, other than different CVE/MS bug IDs.

It is a thin line between drawing attention to a severe vulnerability that should be taken seriously and overhyping it. This process didn't start with the branding - it started a while ago with everyone working on fixes. The main goal of this announcement was to give a heads up. Vendors and distributors of Samba are being informed before a security fix is released in any case. This is part of any Samba security release process.

Who found the Badlock Bug?

Badlock was discovered by Stefan Metzmacher. He's a member of the international Samba Core Team and works at SerNet on Samba. He reported the bug to Microsoft and has been working closely with them to fix the problem.

@tonyshowoff said:

@scottalanmiller said:

@Dashrender said:

@scottalanmiller said:

@Dashrender said:

what are the settings I should set my Windows command prompt to to get that view? Currently using curl on Windows, I just get garbage.

You can connect from PuTTY to a better OS that is easier to use 😉

When connecting from PuTTY, what would I be connecting to? Currently BASH isn't available with a SSH connection on Windows 10.

Linux of course. Windows is the problem. Bypass it.

Ronald Reagan should've said that.

He probably did.

@tonyshowoff said:

@scottalanmiller said:

@tonyshowoff said:

@Dashrender said:

@scottalanmiller said:

@Dashrender said:

Frankly, I'm frustrated that ICANN has allows so many registrars and SSL cert providers. There are over 1400 CAs trusted by Windows in 2010.

Any one of those CAs can be compromised and their root cert used to sign fake certs for any site on the internet, instantly having Windows trust those certs.

The whole security model on the internet is just broken. We don't have secure DNS or reliable Certificate Pinning.

It would be a monopoly if they didn't make it basically open. Or monopoly-ish. Not an open market.

Frankly, in this case, a monopoly, like you want for healthcare, seems like the better play. The fees should either be free or extremely low, only enough to handle the costs of administration and hardware required.

Universal coverage does not imply monopolistic treatment. Further, most countries with universal health coverage also have private systems too.

Like Panama... good healthcare for free or suckers can pay for private American healthcare from Johns Hopkins.

Or Bosnia, the only place I know of where the "free" is way worse than private to an insane degree, and that's because of a war so at least that's an excuse.

Johns Hopkins is the hospital that thought that nut job who thinks the pyramids were grain stores and all kinds of whacky things led their surgical department. You'd have to be insane to get treated at a hospital letting crazies like that even work there let alone run departments.

(Working there as a janitor would be okay, just not in healthcare portions of the business.)

That's the kind of hospital that removes your spleen because "if God wanted you to have it, he'd not have made it make you sick." Those people scare me.

Of course it exists (awesome things tend to get ported 😉 ), I use it all the time, and I have for years. It's pretty great. Not only that but you can get a lot of tools on Windows:

http://gnuwin32.sourceforge.net/

I can't use Windows without this, that is the base and a lot of the packages (wget especially; yes I use both wget and curl :P)