HackerNews Summary (2023-06-12 06AM)

Source: halting problem :: Dev v Ops

Summary
In his presentation at GUADEC 2017, Richard Brown presented objections to new packaging systems such as AppImage, Snap and Flatpak, from the perspective of a Linux distribution integrator. The talk received positive feedback, and attendees acknowledged the need for improvements in application development and distribution on Linux. However, the issue seems to boil down to a disconnect between developers and system administrators for Linux distributions.

Fact

💻 Linux distributions are not usually made by the people who write the software they distribute, leading to a disconnect between developers and system administrators.

---

Source: Why millions of usable hard drives are being destroyed

Summary
Cryptographic erase takes only a few seconds and is a secure way to delete data from modern encrypted drives, making them safe for resale.

Fact

🔒 Encrypted drives have built-in encryption to secure the data, and can only be read with an encryption key.

♻️ Cryptographic erase is a fast and secure way to delete data from encrypted drives.

💰 Reselling a drive after a cryptographic erase is safe, because the data can’t be recovered without the encryption key.

---

Source: Every Signature is Broken: On the Insecurity of Microsoft Office’s OOXML Signatures

Summary
Security researchers have uncovered five new attack classes that allow attackers to modify the content in Microsoft Office documents while still displaying valid signatures. All tested versions on Windows, macOS, and Linux are vulnerable. A universal signature forgery attack allows an attacker to create an arbitrary document and sign it with a signature extracted from a different source. Microsoft has acknowledged and awarded the researchers for their findings.

Fact

🔍 Security researchers have uncovered five new attack classes that allow attackers to modify the content in Microsoft Office documents while still displaying valid signatures.

🐛 All tested versions on Windows, macOS, and Linux are vulnerable to the attacks.

🖋️ A universal signature forgery attack allows an attacker to create an arbitrary document and sign it with a signature extracted from a different source.

💰 Microsoft has acknowledged and awarded the researchers for their findings with a bug bounty program.

---

Source: Desktop Linux Hardening

Summary
Linux can be hardened and made more secure by enabling LUKS full-disk encryption and encrypted swap, reducing trackability with NetworkManager, and being cautious with system identifiers.

Fact

🔒 LUKS full-disk encryption can be enabled during installation.

🔑 Encrypted swap or ZRAM should be used instead of unencrypted swap to avoid potential security issues with sensitive data.

🕵️‍♀️ NetworkManager can be configured to reduce trackability by randomizing MAC addresses and setting the hostname to localhost.

🆔 Other system identifiers, such as username and machine ID, should be carefully considered to determine if they need to be anonymized or made generic.

📊 System counting telemetry data can be disabled in some Linux distributions, such as Fedora and openSUSE, depending on your threat model.

---

Source: US Supreme Court’s dog toy ruling puts parody products on notice

Summary
The US Supreme Court has ruled in a trademark infringement case between Jack Daniel’s whiskey and a dog-toy manufacturer. The makers of “Bad Spaniels,” toys that were meant to be a spoof on the alcoholic drink were sued by Brown-Forman, Jack Daniel’s parent company, for trademark infringement. The Supreme Court stated that the toys were in violation since the Rogers test for assessing the use of trademarks in artistic expression did not apply to the toys.

Fact

🐶 The US Supreme Court rules in favor of whisky maker JD when they claim that dog toys made to be a parody of their products does indeed infringe on their trademark.

🎭 Legal experts predict the case will set a precedent and force companies to be more careful when creating parody products that mimic other brands.

🏆 The “Bad Spaniels” dog toys were made by VIP Products. 

---