cURL 接下來的安全性更新...

cURL 的維護老大放話要大家注意接下來的安全性更新:「An alert on the upcoming 7.51.0 release」。

最少 11 個安全性更新:

This release will bundle no less than _eleven_ security advisories and their associated fixes (unless we get more reported in the time we have left).

由於這些 security issue 的特性,會採取不公開的 branch 修正再 merge 回來,再加上這麼大的數量,對於穩定性的衝擊是未知的:

Merging eleven previously non-disclosed branches into master just before a release is not ideal but done so to minimize the security impact on existing users when the problems get known.

所以目前的規劃是會在 release 的 48 個小時前公開 (希望藉由這封信讓有能力的人一起集中來看),藉此來降低衝擊:

My plan is to merge them all into master and push around 48 hours before release, watch the autobuilds closesly, have a few extra coverity scans done and then fix up what's found before the release.

這安全更新的數量好像有點多 orz

Adobe 居然決定加碼投入資源更新 Linux 上 NPAPI 版的 Flash (也就是舊版 API)

在「Beta News – Flash Player NPAPI for Linux」這邊看到 Adobe 要投入資源處理 LinuxNPAPI 版的 Flash Player...

先前 Linux 下是 NPAPI 與 PPAPI 兩個版本都有 Flash Player,但是 NPAPI 維持在 11.2,只做安全性更新:

Linux users have access to both NPAPI and PPAPI versions of Flash Player. However, for the last four years, the NPAPI version has been held at 11.2 and regularly updated with only security fixes while the PPAPI version (used in Chrome and Chromium based browsers), is in line with the standard Windows and Mac releases.

然後決定加碼讓兩邊同步:

Today we are updating the beta channel with Linux NPAPI Flash Player by moving it forward and in sync with the modern release branch (currently version 23). We have done this significant change to improve security and provide additional mitigation to the Linux community.

Flash Player 你趕快退場啊啊啊...

CloudFlare 提供的 SPDY + HTTP/2 patch 可以在 nginx 1.11 上面跑了...

SPDY 對行動裝置還是很重要,尤其是 Android 裝置在 5.0 之後才有支援 HTTP/2,但在 3.0 之後就有支援 SPDY,也就是超過一半的 Android 用戶只有 SPDY 但沒有 HTTP/2 能力:

查資料的時候發現當初 CloudFlare 提供的 SPDY + HTTP/2 patch 本來只能對 nginx 1.9.7 更新 (參考之前寫的「CloudFlare 放出可以同時支援 HTTP/2 與 SPDY 的 nginx patch」),後來有人再更新到 1.9.15,而在留言的地方也可以看到有人回報在 1.11.0 上面可以跑:「Update NGINX SPDY patch for 1.9.15」:

Works fine against nginx 1.11.0 and OpenSSL 1.0.2h (with ChaCha20 patch). I am building nginx as an Ubuntu 16.04 package.

而最新版 1.11.1 只有一個安全性更新,應該也可以跑... 來找看看會不會有人包 ppa 出來。

CloudFlare 放出可以同時支援 HTTP/2 與 SPDY 的 nginx patch

CloudFlare 放出可以同時支援 HTTP/2SPDYnginx patch:「Open sourcing our NGINX HTTP/2 + SPDY code」。

不過 patch 的版本有點舊:

We've extracted our changes and they are available as a patch here. This patch should build cleanly against NGINX 1.9.7.

如同原文下面 comment 提到的問題,nginx 1.9.7 太舊了 (2015/11/17 放出的版本),到現在有出了不少安全性更新,以及對 HTTP/2 的 bugfix。應該會需要再等官方把新版的 patch 拿出來改之後才能用。

MIT 開發出靜態分析工具,找出 23 個 RoR 軟體未被發現的漏洞

MIT 弄出來的新玩意,靜態分析工具叫做 Space:「New MIT Scanner Finds Web App Flaws in a Minute」,MIT 官方的報導在「Patching up Web applications」這邊:

In tests on 50 popular Web applications written using Ruby on Rails, the system found 23 previously undiagnosed security flaws, and it took no more than 64 seconds to analyze any given program.

接下來就是什麼時候會放出來了...

Perl 上的 Monkey Patch

這整個週末都在跟 Net::DNS 奮戰 edns-client-subnet,遇到模組內的一小段程式有 bug,先用 monkey patch 硬上,之後再看看要怎麼丟 patch 回 upstream。

monkey patch 的方法主要是參考「How can I monkey-patch an instance method in Perl?」這邊提供的方法而來的。

由於實際的行為是 subroutine redefined (會產生警告訊息),所以要局部關掉 warnings,然後再把整個 subroutine 換掉:

use BugPackage;

{
    no warnings;
    local *BugPackage::bug_function = sub {
        # new code
    };
}

這樣可以在不修改原始模組程式碼的情況下抽換。

Badlock 安全性問題同時影響 Windows 與 Samba

前幾天發佈了 Windows 與 Samba 共同有的安全性問題,叫做 Badlock:「Hype Around the Mysterious ‘Badlock’ Bug Raises Criticism (WIRED)」。但這個 bug 在 4/12 前不會公佈:

On April 12th, 2016, a crucial security bug in Windows and Samba will be disclosed. We call it: Badlock.

長達三個禮拜的時間可以讓其他人找出問題是很罕見的,主要是因為這已經提供足夠多資訊去挖掘。名稱叫做 Badlock,看起來是某種 lock + race condition 造成的,而 Windows 與 Samba 同時都有問題,應該是 Microsoft 與 Samba 合作後的程式碼,或是某種 protocol workflow 的問題造成的。

It's especially interesting in this case since we have a name "Badlock" so we know it probably involves locking. We know it affects Samba and Windows. And we know who it was found by so we can look at which bits of Samba they've been working on lately. That's a lot of information for a clever person.

我預期這三個禮拜內應該就會有人公佈,目前的資訊真的太多了。更糟糕的有可能不是發 0-day exploit,而是這個漏洞進入黑市被利用。

先發表有漏洞,再給三個禮拜讓 vendor patch 的行為,看起來就是研究團隊為了出名造勢,而搞砸真正的資安問題。

把塗鴉透過深度類神經網路轉成油畫...

看到「Neural Doodle」這個專案,可以把塗鴉轉成帶有油畫筆觸的圖:

看起來是實作新的演算法:

Use a deep neural network to borrow the skills of real artists and turn your two-bit doodles into masterpieces! This project is an implementation of Semantic Style Transfer (Champandard, 2016), based on the Neural Patches algorithm (Li, 2016).

另外一組範例:

程式可以用純 CPU 跑,也可以用 GPU 跑,不管哪種都很吃記憶體 XDDD

沒有檢查 TCP checksum 的 bug 造成的慘案

Twitter 家的工程師努力通靈找靈異現象,最後發現是 kernel bug 造成 veth 沒檢查 TCP checksum 造成的慘案:「Linux kernel bug delivers corrupt TCP/IP data to Mesos, Kubernetes, Docker containers」。

而隔壁棚 PagerDuty 在 2015 年五月也有遇到類似的問題,不過當時看起來沒找出 root cause,只有提出 workaround 解法暫時避開:「The Discovery of Apache ZooKeeper’s Poison Packet」。

這個 bug 已經被 patch 掉了,之後應該會再 backport 回到舊版 kernel

I’m really impressed with the linux netdev group and kernel maintainers in general; code reviews were quite prompt and our patch was merged in within a few weeks, and was back-ported to older (3.14+) -stable queues on various kernel distributions (Canonical, Suse) within a month.

文章中間有寫找 bug 的過程,可以看到都是在通靈...