OK, it's time to stop trusting SourceForge

Well, it's official.

SourceForge is putting paid third party code into projects, similar to the junk that Oracle puts into Java, or Adobe into Flash.    No surprise, since they're now owned by a job hunting site Dice, or DHI group inc (note the category warning announcement)

They're backtracking on the insertion of some really bad stuff into GIMP (Ars Technica), saying that they thought GIMP was dead, and that listening to their user [outcry] they'll now only do it on certain projects.

They are saying it's opt-in only,but both things are only a bad quarter and a policy change away.

Unfortunately I'm putting them in the AVOID category, like Tucows and CNET :-(

Update: They Definitely time to untrust them - they hijacked NMap!

Perry

Change to Uber in July wants to track users all the time and spam their contacts?

More here:

http://www.itworld.com/article/2928515/security/uber-revises-privacy-policy-wants-more-data-from-users.html

Maybe it's a false alarm and I'll have to add it back

Voting Machines use Unpatched WIndows XP, WEP, simple passwords, instantly decertified

Ars finds:

Virginia election officials have decertified an electronic voting system after determining that it was possible for even unskilled people to surreptitiously hack into it and tamper with vote counts.
The AVS WINVote, made by Advanced Voting Solutions, passed necessary voting systems standards and has been used in Virginia and, until recently, in Pennsylvania and Mississippi. It used the easy-to-crack passwords of "admin," "abcde," and "shoup" to lock down its Windows administrator account, Wi-Fi network, and voting results database respectively, according to a scathing security review published Tuesday by the Virginia Information Technologies Agency. The agency conducted the audit after one Virginia precinct reported that some of the devices displayed errors that interfered with vote counting during last November's elections.

http://arstechnica.com/tech-policy/2015/04/meet-the-e-voting-machine-so-easy-to-hack-it-will-take-your-breath-away/

How many times do I have to say it - Electronic voting is a BAD IDEA

US Secretary of State exclusively uses private Email, pleads ignorance

Coming to the attention of the public when one of her closest advisors gets hacked by a Romanian hacker "Guccifer",  Hillary Clinton did not use public email during her whole term as secretary of state

http://www.thesmokinggun.com/documents/investigation/hillary-clinton-private-e-mail-account-897531

While the contents of only some of the emails have been made public, the list of subjects that is published shows some that clearly might contain classified information.

I guess Hillary doesn't really get the "protect information from enemies of the state" thing.  Hillary, when using private internet services, there's really no way to know who's reading the information.

I'm really surprised this didn't come out earlier.  Is there something (special) about the providers that she and her circle of friends are using?

Funny how they forced an ambassador who did the same thing to resign
http://thefederalist.com/2015/03/05/hillarys-state-dept-forced-the-resignation-of-an-ambassador-for-using-private-e-mail/


In other news, thanks to Popehat, Gen David Petraeus won't be getting jail time for leaking more-secret-than TS information to his biographer/mistress/girlfriend

Uber is worth a gazillion dollars, and is putting the Taxi industry out of business - how can they be such idiots? Again!

By Dan Goodin

Ars Techica

March 2, 2015

Uber is trying to force GitHub to disclose the IP address of every person that accessed a webpage connected to a database intrusion that exposed sensitive personal data for 50,000 drivers. The court action revealed that a security key unlocking the database was stored on a publicly accessible place, the online equivalent of stashing a house key under a doormat.[ but more visible - pe]

Uber officials have yet to say precisely what information was contained in the two now-unavailable GitHub gists. But in a lawsuit filed Friday against the unknown John Doe intruders, Uber lawyers said the URLs contained a security key that allowed unauthorized access to the names and driver's license numbers of about 50,000 Uber drivers. The ride-sharing service disclosed the breach on Friday, more than two months after it was discovered.

more...

 http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensitive-database-key-on-public-github-page/

Intuit is accused of deliberately allowing fraudulent returns for increased market share

Brian Krebs writes that Intuit is accused, apparently with proof  like audio, video, or email, that Intuit made the conscious decision to reduce fraud detection when criminals went to their competitors and caused them to lose market share.

http://krebsonsecurity.com/2015/02/turbotaxs-anti-fraud-efforts-under-scrutiny/

Question:  If a criminal files a fraudulent return from a web site , and pays with a percentage of the refund, then the refund can't be recovered, will the web site operator have to return the fee?  What's the penalty?  What if they're found to be doing it deliberately?  Losing their ability to file?

People:  Friends don't let friends overpay their taxes.

Think Superfish isn't a big deal?

Well, first off, remember that it compromises the whole IE/Firefox infrastructure
(and possibly code signing =8-0 ) of the whole machine  [perry]

Second, there are lots of Non-Lenovo (14) (+?) apps that use it and it's getting easier to break

Now it's breakable and exploitable over by a Raspberry PI (with instructions)

Oh there is a true virus that exploits it and Komodia, the company behind the MITM-by-local-internal-proxy is under DDOS attack.  Did we mention that the password is Komodia?  And that many commercial companies use products from Komodia?

And, while Lenovo has apologized, (they still have a business), and has updated auto and manual removal instructions

Of course Superfish says it's not so bad
 
Understandable, but no.

And a movie that shows how to remove Superfish.A from Chrome - from Jul 2014