Weekly Digest – Week 16, 2021

Articles and News

Computer Security World in Mourning Over Death of Dan Kaminsky, Aged 42

https://www.theregister.com/2021/04/25/dan_kaminsky_obituary/

#dan-kaminsky #sony #dns #ssl #conficker

The Infrastructural Power Beneath the Internet as We Know It

» I’ve lately been trying an exercise where, when reading anything by or about tech companies, I replace uses of the word “infrastructure” with “means of production.” «

https://thereboot.com/the-infrastructural-power-beneath-the-internet-as-we-know-it/

#big-tech #platform #society #politics

Exploiting Vulnerabilities in Cellebrite UFED and Physical Analyzer From an App’s Perspective

Moxie Marlinspike takes a closer look at the Cellebrite UFED equipment: »By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me.«

https://signal.org/blog/cellebrite-vulnerabilities/

#signal #cellebrite #hardware-security #moxie-marlinspike

Disasters I’ve Seen in a Microservices World

The author illustrates some recurring issues that often arise in architectures based on microservices.

https://world.hey.com/joaoqalves/disasters-i-ve-seen-in-a-microservices-world-a9137a51

#microservice

CocoaPods Trunk: Remote Code Execution Found

The vulnerability that allowed it to execute arbitrary shell commands on the trunk server was introduced six years ago.

https://blog.cocoapods.org/CocoaPods-Trunk-RCE/

#rce #macos

Remote Code Execution in Homebrew by Compromising the Official Cask Repository

It was possible to merge malicious pull requests and execute arbitrary Ruby codes on users’ machines.

https://blog.ryotak.me/post/homebrew-security-incident-en/

#macos #homebrew #macos-security #rce

YouTube Is Now Building Its Own Video-Transcoding Chips

YouTube will gain up to 33 times the performance with its custom-built video transcoding units compared to optimized software on traditional servers.

https://arstechnica.com/gadgets/2021/04/youtube-is-now-building-its-own-video-transcoding-chips/

#youtube #hardware

Don’t Leak Your Docker Image’s Build Secrets

In this post, the author gives practical tips on how not to leak secrets when building container images.

https://pythonspeed.com/articles/docker-build-secrets/

#container

We Live Migrated 900 VMs!

The author reports on the challenges of live-migrating 900 Openstack Compute nodes.

https://techblog.web.cern.ch/techblog/post/we-live-migrated-900-vms/

#openstack #cern

Projects and Releases

OpenSSH 8.6

The release notes of OpenSSH 8.6 again start with the deprecation notice for the SHA-1 “ssh-rsa” signature scheme. The new release comes with security and feature improvements.

https://www.openssh.com/txt/release-8.6

#openssh #type:release