OSP

סימפל אקס (SimpleX) פלטפורמת ההודעות הראשונה שאין לה מזהי משתמש, אפילו לא מספרים אקראיים!

"הערכת אבטחה נעשתה על ידי Trail of Bits בנובמבר 2022."

"תכונות SimpleX Chat: • הודעות מוצפנות מקצה לקצה, עם עריכה, תשובות ומחיקת הודעות. • שליחת תמונות וקבצים מוצפנים מקצה לקצה. • כתובות משתמש חד פעמיות וארוכות טווח. • קבוצות צ'אט סודיות - רק חברי הקבוצה יודעים שהיא קיימת ומי החבר. • שיחות שמע ווידאו מוצפנות מקצה לקצה. • הודעות מיידיות פרטיות. • פרופיל צ'אט נייד - אתה יכול להעביר את אנשי הקשר וההיסטוריה של הצ'אט שלך למכשיר אחר (מסוף או נייד). יתרונות SimpleX Chat: • פרטיות מלאה של הזהות, הפרופיל, אנשי הקשר והמטא נתונים שלך: שלא כמו כל פלטפורמת הודעות קיימת אחרת, SimpleX לא משתמשת במספרי טלפון או בכל מזהה אחר שהוקצה למשתמשים - אפילו לא במספרים אקראיים. זה מגן על הפרטיות של מי שאתה מתקשר איתו, מסתיר אותה משרתי פלטפורמת SimpleX ומכל צופה. הגנה מלאה מפני דואר זבל וניצול לרעה: מכיוון שאין לך מזהה בפלטפורמת SimpleX, לא ניתן ליצור איתך קשר אלא אם תשתף קישור להזמנה חד פעמית או כתובת משתמש זמנית אופציונלית. בעלות מלאה, שליטה ואבטחה של הנתונים שלך: SimpleX מאחסן את כל נתוני המשתמש במכשירי הלקוח, ההודעות נשמרות באופן זמני רק בשרתי ממסר SimpleX עד לקבלתן. רשת מבוזרת: אתה יכול להשתמש ב-SimpleX עם השרתים שלך ועדיין לתקשר עם אנשים באמצעות השרתים המוגדרים מראש באפליקציות או בכל שרתי SimpleX אחר. אתה יכול להתחבר לכל מי שאתה מכיר באמצעות קישור או לסרוק קוד QR (בשיחת הווידאו או באופן אישי) ולהתחיל לשלוח הודעות באופן מיידי - אין צורך במיילים, מספרי טלפון או סיסמאות. הפרופיל ואנשי הקשר שלך מאוחסנים רק באפליקציה במכשיר שלך - לשרתים שלנו אין גישה למידע זה. כל ההודעות מוצפנות מקצה לקצה באמצעות פרוטוקול קוד פתוח ראצ'ט כפול (double-ratchet); ההודעות מנותבות דרך השרתים שלנו באמצעות קוד פתוח SimpleX Messaging Protocol" https://f-droid.org/packages/chat.simplex.app/ #SimpleX #Chat #Messaging_Protocol

JFrog and GitHub unveil open source security integrations By | ⁨⁨Alex Scroxton⁩ |

"Software security specialist JFrog and open source development community service GitHub are unveiling integrations that bring the capabilities of JFrog’s Software Supply Chain Platform to bear within GitHub’s code development platform.

[...] "Single platform to secure workflows At its heart, the partners expect the integration to offer developers an easier and safer way to trace the provenance of open source code from source to the resulting binaries across both platforms. The tie-up will accomplish this via three key methodologies, they explained. The first of these, dubbed Bidirectional Code Navigation and Job Visibility, will help developers navigate from GitHub Actions Workflows to JFrog Artifactory,  and back again, using a list of packages created under the output of the build to where it’s ultimately deposited. This will extend to software bill of material (SBOM) packages, which may help teams get a better grasp of code provenance, dependencies and so on. The second methodology, Unified, Secure Single Sign-On (SSO), will help address problems that arise when switching between development environments. Traditionally, this process relied on tokens that can accidentally bring with them tremendous risk. Using OpenID Connect SSO support, GitHub Actions and the JFrog Platform will establish a trusted relationship and automate token management to verify developers’ identification, letting them hop from one environment to the other quickly and easily. Finally, Consolidated Security Status Dashboards will provide developers with unified dashboards, letting them see security scan results from the respective GitHub and JFrog tools, along with permissions and identity management, to help them identify problems faster.

GitHub Copilot Alongside the main announcement, JFrog has also unveiled its participation in GitHub’s existing Copilot Extensions programme, which is designed to unlock developer productivity via a chat feature that helps answer common questions relevant to their JFrog and GitHub environments, eliminating the need to sift through reams of documents or spend time searching forums." [...]

#JFrog #GitHub #Unveil #Open_Source #Security #Integration

Safe, Secure Open-Source Software: A Trillion Dollar Dream Or A Reality? By | Maria Anhalt |

[...] "Synergy Takes Center Stage With so much on the line, what is the best way to face challenges in the era of software-defined mobility? The answer has been with us since the late '90s and is only now stepping into the limelight for mobility.

The open-source community exemplifies the principles necessary for scalable collaborative efforts throughout its ecosystem. Developers and organizations work together to address common issues, threats and responses. This community understands the cooperation needed to achieve greater results together, accelerating innovation and ensuring solutions are strong and continually tested. For example, the Linux Foundation's Automotive Grade Linux (AGL) project brings together carmakers, suppliers and technology companies to develop an open software platform for all connected car technologies. This collaboration has resulted in secure, flexible and cost-effective solutions widely adopted in the industry worldwide. This advance, however, came neither easily nor quickly. Open-Source Software In Safety-Critical Applications Historically, open-source software (OSS) was viewed with skepticism when it came to safety-critical applications. This is not to say many have not tried and tried again. However, up until recently, concerns about reliability, security and the lack of formal support yielded failures. However, recent pioneering breakthroughs have made OSS a viable option within the mobility sector. Progress in this context shows up as advancements in code quality, security practices and support structures, which all contribute to shifting toward responsible acceptance." [...] #Safe_Secure #Open_Source_Software #OSS #Trillion_Dollar_Dream #Or_Reality

An open-source tool for automated human-level circling behavior detection By | Scientific Reports |

[...] "Abstract Quantitatively relating behavior to underlying biology is crucial in life science. Although progress in keypoint tracking tools has reduced barriers to recording postural data, identifying specific behaviors from this data remains challenging. Manual behavior coding is labor-intensive and inconsistent, while automatic methods struggle to explicitly define complex behaviors, even when they seem obvious to the human eye."

"Here, we demonstrate an effective technique for detecting circling in mice, a form of locomotion characterized by stereotyped spinning. Despite circling's extensive history as a behavioral marker, there currently exists no standard automated detection method. We developed a circling detection technique using simple postprocessing of keypoint data obtained from videos of freely-exploring (Cib2−/−;Cib3−/−) mutant mice, a strain previously found to exhibit circling behavior. Our technique achieves statistical parity with independent human observers in matching occurrence times based on human consensus, and it accurately distinguishes between videos of wild type mice and mutants. Our pipeline provides a convenient, noninvasive, quantitative tool for analyzing circling mouse models without the need for software engineering experience." [...] #Open_Source #Tool #Automated #Human_Level #Circling_Behavior #Detection

Open Source Web Scanners "A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below. Note that some large projects have multiple repos - in which case the second most relevant repo is included immediately after and is indented." [...] License Apache-2.0 license 858 stars 114 forks " [...] https://github.com/psiinon/open-source-web-scanners #List #Open_Source #Web_Security #Scanners #GitHub #GitLab #Ordered_by_Stars

Black & White (2001) open source game engine sees a first release By | Liam Dawe |

''Black & White from Lionhead Studios released originally back in 2001 went on to great reviews, and won various awards. Sadly, it's one game that has also been lost to time but the openblack project plans to revive it with open source.''

[...] ''I originally covered this project way back in 2019, and it seems it's come a long way since then, although still heavily under development. Yesterday, September 4th, the openblack project had a first actual release.'' ''Features implemented: Camera movement system which matches Black & White. Landscape with higher resolution thanks to intermediate rendering of the landscape texture. Model rendering and animation. Morphable mesh rendering. Audio support. Dynamic sky controls. Pathfinding for villagers. Physics using bullet physics. Early AI state machine. The LHVM virtual machine is integrated and reverse engineered. Runs on modern Windows, MacOS and Linux. Experimental Android, iOS, web assembly support. There are some known issues like some colours being off and no launcher or global configuration options, so you need to launch it with command line arguments to find the assets. All of this of course will be improved as the project matures. See more on the GitHub. You need a copy of the original game to run it which sadly is not easily available since Lionhead Studios no longer exist and the publisher Electronic Arts hasn't put it up anywhere.'' #Native_Linux #New_Release #Open_Source #Reimplementation #Simulation #Strategy #Game

Open-Source Intelligence (OSINT) Software and Tools Market Size, Future Consumer Behavior and Market Dynamics (2024-2034) By | Daily News Mirror | "Download Full PDF Sample Copy of Reseach Report @ https://www.mraccuracyreports.com/report-sample/656468

[...] "Who is the largest manufacturers of Open-Source Intelligence (OSINT) Software and Tools Market worldwide? Toll Holdings Limited, DB Schenker, KERRY LOGISTICS NETWORK LIMITED, MOMART, NIPPON EXPRESS CO., LTD., Hasenkamp, SAE RELOCATION, PACK & SEND, Craters & Freighters, Crozier Fine Arts, Fine Art Shippers, UOVO, PACART, Artpack, Vulcan Fine Art, Onarto, Ship Smart, Art Work FAS, Pak Mail, Arrow Express, Queen’s Fine Art, Elite Anywhere Corp, IAS Fine Art Logistics, Armstrong Fine Art Services, Zhongzhan Union, Huaxie International Precious Freight Service Co., Ltd. "

"Open-Source Intelligence (OSINT) Software and Tools Market Market Analysis: Among the important insights provided are market and segment sizes, competitive settings, current conditions, and emerging trends. Comprehensive cost analyses and supply chain evaluations are also included in the report. Technological developments are predicted to boost product performance and promote broader adoption in a variety of downstream applications. Understanding market dynamics, which include opportunities, challenges, and drives, as well as consumer behavior, is also essential to understanding the Open-Source Intelligence (OSINT) Software and Tools Market environment." [...] #Open_Source_Intelligence #OSINT #Software #Tools #Market_Size #Future_Consumer_Behavior #Market_Dynamics

Elastic announces open source license for elasticsearch and kibana source code By | ET Edge Insights | "Elastic (NYSE: ESTC), the Search AI Company, today announced that it is adding the GNU Affero General Public License v3 (AGPL) as an option for users to license the free part of the Elasticsearch and Kibana source code that is available under Server Side Public License 1.0 (SSPL 1.0) and Elastic License 2.0 (ELv2). With the addition of AGPL, an open source license approved by the Open Source Initiative (OSI), Elasticsearch and Kibana will be officially considered open source and enable Elastic’s customers and community to use, modify, redistribute, and collaborate on Elastic’s source code under a well-known open source license." [...] #Elastic #Open_Source #License #Elasticsearch #Kibana #Source_Code

Pinkary is now fully open source By | Paul Redmond | [...] "Pinkary is already a thriving project, with over 400+ submitted pull requests, and is encouraging open-source contributions and giving you the installation instructions you need to go from project setup to pull request. Pinkary is already using Pest 3, and as the creator of Pest, the code has plenty of examples you can learn from to level up your testing skills. On the user side of this project, Pinkary is a landing page for all your links And a place where you can connect with like-minded people without the noise of other social media applications. It went from a new project to over a thousand users very quickly And is known for using a SQLite database for application data, sessions, queues, cache, etc. Start learning from the Pinkary source code today! Visit pinkary-project/pinkary.com on GitHub and join this exciting open-source project." [...] #Pinkary #Now_Fully #Open_Source #SQLite_Database #Application_Data #Sessions #Queues #Cache

Open-source data platforms as lifelines during disasters By | Harilal Bhaskar |

"Transparency is a cornerstone of open-source platforms. Since anyone can access the code and algorithms in these platforms, it encourages scrutiny and continuous improvement.

Surveys reveal that a significant majority of respondents trust open-source platforms more than proprietary systems due to their transparency. This open approach is especially critical in disaster management, where public trust is crucial." [...]

[...] "Emerging Tech Further, emerging technologies like AI, IoT and blockchain can accurately predict disasters, enabling timely activation of early warning systems.

Artificial intelligence can analyse vast datasets to predict disaster risks, optimise resource allocation and identify patterns in disaster response. For example, AI-powered image analysis can quickly assess damage from aerial imagery. Internet of Things (IoT) devices can collect real-time data on environmental conditions, infrastructure and population movement and provide critical insights for disaster response and prevention. And blockchain technology can ensure the transparency and security of supply chains, prevent fraud and track the distribution of aid." [...] #Open_Source #Data_Platforms #Lifelines #During_Disasters #IoT #Blockchain #AI

העניקו בוסט BOOST לערוץ OSP ( Open Source Planet )

ערוץ שכולו קוד פתוח בשיתוף @termuxisrael2

😎 https://t.me/boost/OSPopensourceplanet

KubeCon China - how China is more open and collaborative than many believe By | Chris Middleto | #KubeCon #China #More #Open_and_Collaborative

Malicious North Korean packages appear again in open source code repository By | Daryna Antoniuk |

[...] "Recently observed a renewed surge of activity on npm from North Korean groups tracked as Contagious Interview and Moonstone Sleet. The npm repository allows developers to publish and share JavaScript packages, libraries and tools."

"Moonstone Sleet has targeted software companies and defense firms with custom ransomware variants and elaborate scams." [...] "Phylum said the malicious packages posted to npm are named temp-etherscan-api, ethersscan-api, telegram-con, helmet-validate, and qq-console." [...]

“These attacks are characterized by multi-stage obfuscated JavaScript that downloads additional malware components from remote servers,” the researchers said.

The hackers’ goals likely include “exfiltrating sensitive data from cryptocurrency wallet browser extensions while establishing persistence on the victim's machine.”  “These adversaries continuously exploit the inherent trust in the npm ecosystem to compromise developers, infiltrate companies, and steal cryptocurrency or any other assets that could lead to illicit financial gains,” Phylum said." [...] #Malicious #North_Korean #Packages #Appear_Again_In #Open_Source_Code #Repository #Moonstone_Sleet

"OpenJS Foundation’s Leader Details the Threats to Open Source" #Video https://youtu.be/Po47Hh_eoh0 #OpenJS #Foundations #Leader_Details #Threats #Open_Source #OpenJS #XZ

OpenJS Foundation’s Leader Details the Threats to Open Source By | Heather Joslyn |

[...] "Too Many Single-Maintainer Projects The XZ vulnerability, Ginn said, is “likely not an isolated incident.” In the days after the news about XZ broke, her foundation and the Open Source Security Foundation (OpenSSF) released a joint statement saying they had foiled a hacker’s attempt to gain access to the OpenJS software library last November.

“The XC Utils had the one person identified. In our case, we saw multiple GitHub IDs, overlapping emails, avatars and things like that,” Ginn told Williams. “But they are real people, probably some bad actor somewhere who is not only getting close to understanding the code, but they’re also understanding how our open source communities work.” The New Stack has previously written about the crisis in recruiting and compensating open source project maintainers. With nearly all websites using JavaScript, it’s especially alarming, Ginn said, that its maintainers remain so overmatched." [...] #OpenJS #Foundations #Leader_Details #Threats #Open_Source #OpenJS #XZ

Cryptomator: Open-source cloud storage encryption By | Mirko Zorz | "Cryptomator offers open-source, client-side encryption of your files in the cloud. It’s available for Windows, Linux, macOS and iOS. Cryptomator works with Dropbox, Google Drive, OneDrive, MEGA, pCloud, ownCloud, Nextcloud, and any other cloud storage service that synchronizes with a local directory. Key features The developers of Cryptomator highlighted the following features for Help Net Security readers: Client-side encryption: Cryptomator encrypts your data on your device before it is uploaded to the cloud. This ensures your sensitive information remains private and protected from unauthorized access, even if the cloud provider’s security is compromised. Transparent encryption: The tool uses a transparent encryption approach, meaning you can continue using your familiar workflows. Thanks to the 1:1 mapping between each plaintext file and its corresponding encrypted file, it enables fast use of data in the cloud. Ease of use: Despite its strong encryption capabilities, Cryptomator is designed to be user-friendly. It requires no technical expertise to set up and use, and users can create a secure file vault with just a few clicks. Transparency: Cryptomator’s source code is publicly available and has been vetted by the security community. This transparency ensures that there are no hidden backdoors, giving users confidence in the security of their data." [...]

"Compatibility with cloud providers"

"Cross-platform availability"

"No account required: Cryptomator does not require creating an account or providing personal information. This reinforces its privacy-first approach, ensuring your identity is not linked to encrypted data. Modular and extendable: The solution’s modular design allows for easy extensions and integrations, enabling developers to build additional features or integrate the encryption capabilities into other applications. Cryptomator is available for free on GitHub." [...] #Open_Source #Cloud_Storage_Encryption