The problem with nerd politics (The Guardian)
Over at the Guardian, Cory Doctorow writes about two
problems that govern the relationship between politics and technically oriented
folks ("nerds" in Doctorow-speak): "nerd determinism" and "nerd fatalism". "But,
while it's true that geeks can get around this sort of thing – and other bad
network policies, such as network-level censorship, or vendor locks on our
tablets, phones, consoles, and computers – this isn't enough to protect us, let
alone the world. It doesn't matter how good your email provider is, or how
secure your messages are, if 95% of the people you correspond with use a free
webmail service with a lawful interception backdoor, and if none of those people
can figure out how to use crypto, then nearly all your email will be within
reach of spooks and control-freaks and cops on fishing expeditions."
Security advisories for Thursday
Debian has updated openoffice.org (code execution) and
ikiwiki (cross-site scripting). Mandriva has updated imagemagick (2010.1, ES
5.0; 2011.: multiple vulnerabilities).
SUSE has updated openssl (SLE 11: two
vulnerabilities).
Ubuntu has updated sudo (privilege escalation).
Security vulnerability in sudo's netmask function patched (The H)
The H reports on a vulnerability in sudo when it is
configured for IP-based restrictions on users (typically only for centrally
managed sudoers files). "When the developers added IPv6 support, they
inadvertently made the matching routine used for IPv4 networks call the IPv6
matching routines when no IPv4 match was found. Because the IPv6 fields would be
uninitialised, it was possible for the system to think it had found a match
where there wasn't one. Finding a match would, in turn, mean permission would be
granted for whatever command the rule was controlling, even when the system was
on a different network."
[$] LWN.net Weekly Edition for May 17, 2012
The LWN.net Weekly Edition for May 17, 2012 is
available.
Lotus Symphony code for OpenOffice coming soon
IBM has announced that the paperwork has been signed and
that the contribution of the Lotus Symphony code to OpenOffice will happen
shortly.
"The successful delivery of Apache OpenOffice 3.4 has enabled us to
finalize our grant with the the Apache Software Foundation and initiate this new
phase of effort within the community. This is about envisioning a future for
Apache OpenOffice that builds on the best code we can offer together with the
best developers who have mastered it." For those wondering about what this code
offers, there is a Symphony Contribution wiki page describing the most
interesting features.