Open Source at SF State University - Security

Building firewalls in Debian/Ubuntu

Tue, 31 Mar 2009 14:04:21 -0700

I came across a nice step-by-step article on how to build firewalls using Debian or Ubuntu. Firewall Builder is available from the libfwbuilder and fwbuilder packages in both Debian and Ubuntu (in Universe). Read the article in full at http://www.debian-administration.org/articles/632

Open source and poisonous people

Wed, 18 Mar 2009 16:59:20 -0700

More like how to keep poisonous people from crashing your efforts. Watch on...

P.S. Thanks to Faisal Khan for pointing out this terrific resource on OLPC Support Gang list.

Sugar/GNU/Linux XO machines are being shipped every month to kids all over the world. This is a generation getting ready to break the bonds of digital dependencies and building a commons for themselves on free and open source software and open content and standards. In the meantime, Microsoft announced a pilot study to run Windows XP on these very machines.

So, let's do a quick comparison:

Sugar is built on top of Fedora 9, the current and cutting edge version of Linux from RedHat, which then in turn creates its commercial platform based on Fedora releases. So, with Sugar, you get fresh code. Windows XP is from 2001. I was much younger then and had no grey hair Even at that, it is some specialized version of XP that you can get only if you are a third worlder. Its called Windows XP UP where UP stands for Unlimited Potential. Unlimited potential for whom? The users or the company? XP is no longer sold in the US, so the revenue er, I mean "potential" has to come from someplace else.

Response time for bug fixing

Sat, 29 Sep 2007 17:55:08 -0700

Here's an example for response turnaround time for fixing bugs. This one has to do with a buffer overflow in OpenSSL. The vulnerability was reported on September 27 in this thread. This morning (Sept 29), Ubuntu had two patches waiting for me. One is for OpenSSL, and the other is for libssl, the library that implements SSL. The vulnerability is the same. The update was actually released 17 hours ago, so It was no more than a day after the vulnerability was revealed.

Of course, there are bugs that don't get patched for a long, long time, but in most of the cases, we see quick turnaround times in open source. This is yet another case where "many eyeballs make bugs shallow".

OSSIM: A framework for Information Security Management

Wed, 26 Sep 2007 05:32:24 -0700

I came across OSSIM in a post earlier this evening. OSSIM stands for Open Source Security Information Management. It features projects like Arpwatch, Nessus, Snort,Ntop, and Nagios.

From their website:

Ossim stands for Open Source Security Information Management. Its goal is to provide a comprehensive compilation of tools which, when working together, grant a network/security administrator with detailed view over each and every aspect of his networks/hosts/physical access devices/server/etc...

Clipperz - Online password manager with source code to go

Wed, 27 Jun 2007 15:53:01 -0700

There are plenty of OpenSource clients for Windows, Linux, and Mac but what about an online one that works in your browser? Clipperz is one such beast that went live in March. The source code is in Google Code and you can build the same file that's loaded to your browser when you log in to Clipperz.

Mozilla Firefox update fixes 7 holes

Sun, 17 Sep 2006 12:17:12 -0700

Mozilla this week pushed out a new version of its Firefox Web browser to mend at least seven security holes in the program, including at least four flaws that attackers could use to install software on vulnerable computers.

http://blog.washingtonpost.com/securityfix/2006/09/new_firefox_version_fixes_seve_1.html

Gendarmes dump IE

Sun, 05 Feb 2006 18:10:06 -0800

OPEN SOURCE supporters have been given a shot in the arm by news the French police are abandoning Microsoft's Internet Explorer for Mozilla Firefox.

The gendarmerie's 70,000 desktops were being converted to Firefox and its email client Thunderbird because of the navigator's "reliability, security and inter-operability with other state services," said General Christian Brachet, IT director of the police force.

Read the rest here