Friday, May 16, 2008

A major security hole was discovered in the pseudo-random number generator (PRNG) of the Debian version of OpenSSL. OpenSSL is one of the most used cryptographic software, that allows the creation of secure network connections with the protocols called SSL and TLS. It is included in many popular computer programs, like the Mozilla Firefox web browser and the Apache web server. Debian is one of the most used GNU/Linux distributions, on which are based other distributions, like Ubuntu and Knoppix. The problem affects all the Debian-based distributions that were used to create cryptographic keys since the September 17, 2006. The bug was discovered by Luciano Bello, an argentine Debian package maintainer, and was announced on May 13, 2008.

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

These lines were removed as “suggested” by two audit tools (Valgrind and Purify) used to find vulnerabilities in the software distributed by Debian. These tools warned the Debian maintainers that some data was used before its initialization, that normally can lead to a security bug, but this time it was not the case, as the OpenSSL developers wrote on March 13, 2003. Anyway this change was erroneously applied on September 17, 2006, when the OpenSSL Debian version 0.9.8c-1 was released to the public.

Even though the Debian maintainer responsible for this software released a patch to fix this bug on May 8, 2008, the impact may be severe. In fact OpenSSL is commonly used in software to protect the passwords, to offer privacy and security. Any private key created with this version of OpenSSL is weak and must be replaced, included the session keys that are created and used only temporary. This means that any data encrypted with these keys can be decrypted without a big deal, even if these keys are used (but not created) with a version of the library not affected, like the ones included in other operating systems.

For example any web server running under any operating system may use a weak key created on a vulnerable Debian-based system. Any encrypted connection (HTTPS) to this web server established by any browser can be decrypted. This may be a serious problem for sites that requires a secure connection, like banks or private web sites. Also, if some encrypted connection was recorded in the past, it can be decrypted in the same way.

Another serious problem is for the network security software, like OpenSSH and OpenVPN, that are used to encrypt the traffic to protect passwords and grant the access to an administrative console or a private network protected by firewalls. This may allows hackers to gain unwanted access to private computers, networks or data traveled over the network, even if a not affected version of OpenSSL was used.

The same behavior can be applied to any software or protocol that use SSL, like POP3S, SSMTP, FTPS, if used with a weak key. This is the case of Tor, software used to offer strong anonymity on the TCP/IP, where about 300 of 1,500-2,000 nodes used a weak key. With 15-20% of weak Tor nodes, there is a probability of 0.34-0.8% circa to build a circuit that has all tree nodes weak, resulting in a full loss of anonymity. Also the case of only one weak node begin used may facilitate some types of attack to the anonymity. The Tor hidden services, a sort of anonymous public servers, are affected too. However the issue was speedly addressed on May 14, 2008.

The same problem also interested anonymous remailers like Mixmaster and Mixminion, that use OpenSSL to create the remailer keys for the servers and the nym keys for the clients. Although currently there is no official announcement, at least two remailer changed their keys because were weak.

Sunday, August 8, 2010

The United States unemployment rate remained unchanged at a high 9.5% as employers and companies remained nervous about hiring new workers and the public sector laid off 143,000 temporary 2010 US Census workers during July. State and local governments, facing major budget deficits, also laid off many people.

Overall, the 131,000 jobs lost during July far exceeded economist’s predictions of 65,000 jobs lost. The private sector added just 71,000 jobs during July, also less than the 90,000 economists predicted. Around 200,000 gains each month are needed just to hold the unemployment rate steady against first time entrants into the job market. Including the Census workers, the government laid off 202,000 people at federal, state, and local levels.

Though the unemployment rate remained at 9.5%, many discouraged job-seekers have given up looking for a position. Those who have given up are not counted as unemployed. The workforce participation rate, which counts those people as not participating in the workforce, dropped to 64.6% from 64.7% in June. The underemployment rate, which counts part-time laborers looking for a full-time job and those discouraged workers, was flat at 16.5% from June.

The Labor Department also revised their job report for June. The new version now states that 221,000 jobs were lost in June, worse than the previous estimate of 125,000. The previous estimate also said that 83,000 private sector jobs were created, however the new estimate says that just 31,000 private positions were filled.

Despite this, most economists were fairly confident that though there would be slower growth in the future, the country wouldn’t slip into another recession.

“Slower growth looks certain, but it’s not a double dip,” said Wells Fargo economist Mark Vitner. Economists Jim O’Sullivan and Dean Maki say that jobs gains will pick up to 170,000 a month by the fourth quarter. Vitner says that jobs will gain at 87,000 per month for the rest of 2010.

The manufacturing industry has added 183,000 jobs this year including 36,000 in July. Some American companies are shifting overseas manufacturing jobs back to the US, primarily citing rising costs of doing business in China and decreased wages in the US, among other considerations such as long supply lines and difficulty protecting intellectual property rights in Asia. GE has relocated production of their new energy efficient water heaters to the US, while Ford Motor has brought 2,000 jobs to the US from suppliers, including those from overseas.

Sunday, February 17, 2008

In a press release today, California-based Hallmark/Westland Meat Packing Co. indicated that it has voluntarily recalled just over 143 million pounds (65 million kilograms) of raw and frozen beef products, which is considered to be the largest single recall of beef products in U.S. history. The move follows an investigation by the United States Department of Agriculture (USDA) into allegations of animal cruelty and mishandling of cattle destined for the human food chain.

The USDA’s Food Safety and Inspection Service (FSIS) had determined that beef products produced by the Chino, California company were unfit for human consumption as the cattle had not received “complete and proper inspection.”

The recall has been designated as Class II, which the USDA describes as “a health hazard situation where there is a remote probability of adverse health consequences from the use of the product.”

On Friday, Secretary of Agriculture Ed Schafer indicated that charges had been laid against employees of the plant alleged to have taken part in the mistreatment of cattle. “Today [Friday], the San Bernardino District Attorney filed felony animal cruelty charges against two employees who were terminated by Hallmark/Westland Meat Packing Company,” said Schafer. “It is regrettable that these animals were mistreated and I am encouraged and supportive of these actions by the San Bernardino District Attorney in response to this mistreatment.”

The USDA learned of the possible inhumane handling of non-ambulatory (disabled) cattle at the packing plant on January 30 and has since suspended activities at the plant. “We continue to conduct a thorough investigation into whether any violations of food safety or additional humane handling regulations have occurred,” said Secretary Schafer in a press release. “On February 8, our Office of the Inspector General took the lead on the investigation. At that time, USDA extended the administrative hold on Hallmark/Westland Meat Packing Company products for the National School Lunch Program, the Emergency Food Assistance Program and the Food Distribution Program on Indian Reservations while the investigation continues,” said Schafer.

The FSIS reported that Hallmark/Westland had not contacted the FSIS public health veterinarian, as required, when cattle became ill or disabled after undergoing ante-mortem (slaughter) inspection, putting the company out of compliance with FSIS regulations. “Because the cattle did not receive complete and proper inspection FSIS has determined them to be unfit for human food and the company is conducting a recall,” explained Secretary Schafer.

The cruelty charges stem from an undercover video that reportedly showed sick cattle being moved by crews using forklifts.

“Words cannot accurately express how shocked and horrified I was at the depictions contained on the video that was taken by an individual who worked at our facility from October 3 thru November 14, 2007,” said Steve Mendell, President, Westland Meat Co. and Hallmark Meat Packing. “We have taken swift action regarding the two employees identified on the video and have already implemented aggressive measures to ensure all employees follow our humane handling policies and procedures. We are also cooperating with the USDA investigators on the allegations of inhumane handling treatment which is a serious breech of our company’s policies and training.”

The USDA stressed that it is “extremely unlikely” that the cattle involved were at risk for Bovine spongiform encephalopathy (BSE) or mad-cow disease due to the employment of multiple safeguards. The USDA felt the recall was required, however, as the plant had allegedly violated USDA regulations.

The recall involves raw and frozen beef products produced on various dates from February 1, 2006 to February 2, 2008. For further information about the recall, consumers, media, and distributors are encouraged to contact Hallmark/Westland’s Plant Manager Stan Mendell or Food Safety Consultant Steve Sayer at (909) 590-3340 or the FSIS website, www.fsis.usda.gov.

Friday, November 30, 2007

Christine Comer resigned this month as the director of the science curriculum for the Texas Education Agency‘s (TEA) director after more than nine years. Comer said her resignation was due to pressure from officials who claimed she had given the appearance of criticizing the teaching of intelligent design.

According to documents obtained by the Austin American-Statesman, “Comer was put on 30 days paid administrative leave shortly after she forwarded an e-mail in late October announcing a presentation by Barbara Forrest, a critic of the intelligent design/creationist movement. Forrest served as an expert witness at the Kitzmiller v. Dover Area School District trial. At Dover, intelligent design was ruled “a religious view, a mere re-labeling of creationism, and not a scientific theory.” There is widespread scientific support for evolution, while creationism has been described as pseudoscience by the scientific community.

Comer’s resignation comes shortly ahead of the TEA’s State Board of Education (SBOE) reviews of the Texas Essential Knowledge and Skills (TEKS), which determine what should be taught in the classrooms and what textbooks are bought.

The advocacy group Texas Citizens for Science have released a statement saying, in part, “The real reason [Comer] was forced to resign is because the top TEA administrators and some SBOE members wanted her out of the picture before the state science standards—the science TEKS—were reviewed, revised, and rewritten next year. Plans are underway by some SBOE members and TEA administrators to diminish the requirement to teach about evolutionary biology in the Biology TEKS and to require instead that biology instructors ‘Teach the Controversy’ about the ‘weaknesses’ of evolution, that is, teach the Creationist-inspired and -created bogus controversy about evolution that doesn’t exist within legitimate science.”

Professor PZ Myers, biology professor at the University of Minnesota, Morris, wrote that Forrest is “exactly the kind of person boards of education ought to consult before going down the road of attempting to legislate religion into the public schools.”

In reaction to the news Forrest told National Center for Science Education, “In my talk, I simply told the truth — about the history of the ‘intelligent design’ movement, about the complete rejection of its claims by the scientific community, and about the Kitzmiller trial and my involvement in it. Maybe the TEA can’t afford to take a position on what constitutes good science education — maybe it must remain neutral on whether or not to lie to students about evolution — but if so, that’s just sad.”

Agency officials declined to comment, saying it was a personnel issue.

Monday, October 12, 2015

Wikinews interviewed Australian painter Pricasso on his unique artwork created using his penis, and how his art relates to freedom of expression and issues of censorship. He is to be featured at the upcoming adult entertainment event Sexpo Australia in Melbourne this November 5 to November 8.

Saturday, April 17, 2010

Seventeen insurgents were killed in clashes with security troops in the Orakzai region of the North-West Frontier Province of Pakistan. Several rebels were injured in the attack according to officials. None of the soldiers were injured in the attack.

Security personnel alleged that they had arrested a senior Taliban leader in the attack. Meanwhile, elders of various tribes demanded the government to bar security forces to carry out operations affecting the people of the Mishti Mela, Sanghra and Mishti Bazaar areas. They said that the government should have allowed the people some time to shift from the area before launching such attacks, claiming the air strikes in the region also killed some civilians.

Also, three people were kidnapped in Ghalo Cheena area of Hangu on Friday according to witnesses. The three people were on their way home when unidentified men held them at gunpoint and kidnapped them. Police said they had not heard about the incident.

Sunday, January 6, 2008

On the morning of January 4, 2008, while at the 2008 World Junior Ice Hockey Championships, 19-year-old goalie Steve Mason received a phone call from Canada informing him that he was traded by the Ontario Hockey League’s London Knights to the Kitchener Rangers.

In a press release Friday, Kitchener Rangers Head coach and General Manager Peter DeBoer announced the trade to the Knights. In return for obtaining Mason, the Rangers have sent the Knights, Centre Phil Varone, Defenceman Steve Tarasuk along with 2nd, 3rd and 4th round draft picks in 2011 and a 2nd round pick in 2012.

Mason said that he had an enjoyable time playing for the London Knights, but nonetheless, he believes that he has a bright future playing for the Kitchener Rangers. He also notes that he doesn’t want the trade to distract him from playing in the Gold Medal Game, against Team Sweden.

Team Canada won the game in overtime 3-2.