Early Friday the principal author of GNU Privacy Guard (the free encryption software) warned that version 1.9.0 of its cryptographic library Libgcrypt, released January 19, had a “severe” security vulnerability and should not be used.

A new version 1.9.1, which fixes the flaw, is available for download, Help Net Security reports:
He also noted that Fedora 34 (scheduled to be released in April 2021) and Gentoo Linux are already using the vulnerable version… [I]t’s a heap buffer overflow due to an incorrect assumption in the block buffer management code. Just decrypting some data can overflow a heap buffer with attacker controlled data, no verification or signature is validated before the vulnerability occurs.

It was discovered and flagged by Google Project Zero researcher Tavis Ormandy and affects only Libgcrypt v1.9.0.

“Exploiting this bug is simple and thus immediate action for 1.9.0 users is required…” Koch posted on the GnuPG mailing list. “The 1.9.0 tarballs on our FTP server have been renamed so that scripts won’t be able to get this version anymore.”

Read more of this story at Slashdot.

Source: Slashdot – A ‘Severe’ Bug Was Found In Libgcrypt, GnuPG’s Cryptographic Library

“Twenty five years ago I made a bet in the pages of Wired. It was a bet whether the world would collapse by the year 2020.” So writes the 68-year-old founding executive editor of Wired magazine, Kevin Kelly.

He’d made the bet with a “Luddite-loving doomsayer,” according to Wired — author Kirkpatrick Sale. “Sale while a student in the 1950s co-wrote a musical with Thomas Pynchon about escaping a dystopian America ruled by IBM,” remembers Slashdot reader joeblog.

This month a new article in Wired re-visits that 25-year bet:
They argued about the Amish, whether printing presses denuded forests, and the impact of technology on work. Sale believed it stole decent labor from people. Kelly replied that technology helped us make new things we couldn’t make any other way. “I regard that as trivial,” Sale said. Sale believed society was on the verge of collapse. That wasn’t entirely bad, he argued. He hoped the few surviving humans would band together in small, tribal-style clusters. They wouldn’t be just off the grid. There would be no grid. Which was dandy, as far as Sale was concerned…

Kelly then asked how, in a quarter century, one might determine whether Sale was right. Sale extemporaneously cited three factors: an economic disaster that would render the dollar worthless, causing a depression worse than the one in 1930; a rebellion of the poor against the monied; and a significant number of environmental catastrophes… “I bet you $1,000 that in the year 2020, we’re not even close to the kind of disaster you describe,” Kelly said. Sale barely had $1,000 in his bank account. But he figured that if he lost, a thousand bucks would be worth much less in 2020 anyway. He agreed… “Oh, boy,” Kelly said after Sale wrote out the check. “This is easy money.”

Twenty-five years later, the once distant deadline is here. We are locked down. Income equality hasn’t been this bad since just before the Great Depression. California and Australia were on fire this year. We’re about to find out how easy that money is… Sale failed to account for how human ingenuity would keep us from getting tossed into forests and caves. Kelly didn’t factor in tech companies’ reckless use of power or their shortcomings in solving (or sometimes stoking) tough societal problems…

Sale believes more than ever that society is basically crumbling — the process is just not far enough along to drive us from apartment blocks to huts. The collapse, he says, is “not like a building imploding and falling down, but like a slow avalanche that destroys and kills everything in its path, until it finally buries the whole village forever.”

“I cannot accept that I lost,” he wrote… “The clear trajectory of disasters shows that the world is much closer to my prediction. So clearly it cannot be said that Kevin won…”

Kelly warns Sale that history will recall him as a man who doesn’t honor his word. But Sale doesn’t believe that there will be a history.

Kelly responded by offering Sale a second double-or-nothing bet:

I believe that we are in fact on the eve of a 25-year period of global progress and prosperity, the likes of which we have not seen before on this planet. In 25 years, poverty will be rare, and middle class lifestyle the norm. War between nations will also be rare. A bulk of our energy will be renewables, slowing down climate warming. Lifespans continue to lengthen. I’ll bet on it.

Kelly added later that his rival “did not take me up on the double or nothing offer.”

Read more of this story at Slashdot.

Source: Slashdot – A 25-Year-Old Bet Comes Due: Has Tech Destroyed Society?

“Huawei, the crown jewel of China’s technology industry, has suffered from a sustained American campaign to keep its equipment from being used in new 5G networks around the world,” reports the New York Times. Now they’ve identified “a covert pro-Huawei influence campaign in Belgium about 5G networks.” [Alternate URL here]

It began when trade lawyer Edwin Vermulst was paid to write an article criticizing a Belgian policy that would block Huawei from lucrative contracts:
First, at least 14 Twitter accounts posing as telecommunications experts, writers and academics shared articles by Mr. Vermulst and many others attacking draft Belgium legislation that would limit “high risk” vendors like Huawei from building the country’s 5G system, according to Graphika, a research firm that studies misinformation and fake social media accounts. The pro-Huawei accounts used computer-generated profile pictures, a telltale sign of inauthentic activity. Next, Huawei officials retweeted the fake accounts, giving the articles even wider reach to policymakers, journalists and business leaders. Kevin Liu, Huawei’s president for public affairs and communications in Western Europe, who has a verified Twitter account with 1.1 million followers, shared 60 posts from the fake accounts over three weeks in December, according to Graphika. Huawei’s official account in Europe, with more than five million followers, did so 47 times…

Twitter said it had removed the fake accounts after Graphika alerted it to the campaign on Dec. 30… Many of their followers appeared to be bots…

The effort suggests a new twist in social media manipulation, said Ben Nimmo, a Graphika investigator who helped identify the pro-Huawei campaign. Tactics once used mainly for government objectives — like Russia’s interference in the 2016 American presidential election — are being adapted to achieve corporate goals. “It’s business rather than politics,” Mr. Nimmo said. “It’s not one country targeting another country. It looks like an operation to promote a major multinational’s interests — and to do it against a European state.”

Though the social media campaign had little impact on Belgian policymakers, one telecom consultancy noted Huawei’s fear that similar legislation “could spread to other parts of the world.” (The article points out Belgium is the headquarters of both NATO and the European Union.)

But Phil Howard, the director of the Oxford Internet Institute, see a future where disinformation will become increasingly commercialized. “The flow of money is increasingly there,” he tells the Times. “Large-scale social media influence operations are now part of the communications tool kit for any large global corporation.”

Read more of this story at Slashdot.

Source: Slashdot – Corporate Trolls? A Covert, Pro-Huawei Influence Campaign on Social Media

Was Nextdoor’s impact on the world exemplified by a crucial funding referendum for the Christina School District of Newark, Delaware? Medium’s tech site OneZero reports:

As the 2019 referendum approached, I saw Nextdoor posts claiming that the district was squandering money, that its administrators were corrupt, and that it already spent more money per student than certain other districts with higher test scores. The last of those was true — but left out the context that Christina hosts both the state’s school for the deaf and its largest autism program. District advocates told me later that they had wanted to post counterarguments to the platform, but were hindered by Nextdoor’s decentralized structure. Some district officers, for instance, couldn’t even access the posts and discussions happening in the city of Newark, because they were only visible to other Newark residents, and they lived outside the city’s borders. (The district’s headquarters are actually in nearby Wilmington.) After the referendum failed, some pointed to misinformation on Nextdoor as a factor in its defeat….

A month after the failed Christina School District referendum in 2019 the school board voted 4-3 to eliminate 63 jobs, with the alternative being bankruptcy and a bid for a state bailout. Some parents gave up hope; a neighbor of mine who had been among the district’s staunch supporters abruptly sold her house and moved her family to suburban Pennsylvania, where public schools are better-funded. Others who could afford it moved their children to private schools, furthering one of the trends that had put the district in tough shape to begin with. The district and its backers started planning another referendum campaign for 2020, with the stakes now desperate…

This time, their strategy included arming supporters with facts and counter-arguments to post whenever they encountered criticism on their respective Nextdoor networks around the district… On election day, June 9, polling places had lines out the door — a rarity for a single-issue local election. Turnout was unprecedented, nearly doubling that of 2019. And the result was a landslide: Some 70% of voters approved all four funding requests, with more people voting “yes” than the total number who had voted the year before. Suddenly, the district’s future looked hopeful again.

Exactly what role Nextdoor played in that dramatic turnaround is hard to disentangle. The option to vote by mail due to Covid-19 may have helped; the sense of urgency for the district certainly did. Claire O’Neal [a parent who won appointment to the school board later that year], believes the informal Nextdoor information campaign made a difference. “I do think it was a factor in its passing,” she told me. The lesson for the district, and other public agencies, she believes, is that they can no longer win the battle of public opinion on their own. They have to actively enlist advocates in the community to wage it on their behalf on Nextdoor and other hyperlocal online networks.

“It just requires more of individual citizens,” the schoolboard member added. “It’s a lot more work because there’s just so much information out there, and it’s up to you to decide what’s right and what’s wrong.

“There’s a part of that that’s beautiful, and there’s a part of that that’s really scary.”

Read more of this story at Slashdot.

Source: Slashdot – Is Misinformation on Nextdoor Impacting Local Politics?