Domain: gitlab.com
Stories and comments across the archive that link to gitlab.com.
Stories · 11
-
'We Will Never Sell-out or Compromise Our Principles. That Would Be Like Murder': The Slashdot Interview With CEO and Founder of Minds.com Social Network
You asked, he answered!
Bill Ottman, founder and CEO of social networking site Minds.com, has answered more than a dozen questions that Slashdot readers sent his way. Ottman has addressed a wide-range of queries surrounding how Minds.com makes use of tokens; how many users the platform has; and, who is Minds.com aimed for. You can read his answers below. For those of you who are going to give Minds.com a try, you can find Slashdot there. Question, by anonymous reader: So Minds uses karma points. This could potentially have a real consequence where some might find a way to trade these points for real money. People with loads of money might then arrive and use this trick to to gain influence. Have you thought of this? And if so, how are you tackling it?
Bill: Ultimately you have to ask, would you rather the community be rewarded for their contributions or not? We believe people deserve to be rewarded for successfully participating on Minds. Of course certain users will try to game the system, but we have some pretty good tools in place to minimize this such as rate limits and parcel limits on buying tokens.
Tokens can be used on advertising via token and boost. Being able to purchase influence isn't inherently a negative thing, you just don't want it to dominate the network. This is why we also allow users to earn, and we are committed to maintaining balance so that those with money cannot drown others out.
Question by sinij :How are you going to sell a combination of microtransactions (i.e. points) and social media, two least consumer-friendly trends in tech, to users?
Bill: Our crypto-token system is extremely popular along with the ability to tip and subscribe to others monthly on recurring bases. People love earning tokens and then boosting posts with them. 1 token gets 1,000 impressions extra.
Social media focused on transparency, privacy, reach, rewards and monetization is becoming very popular as people are disillusioned with the digital rights abuses of big tech.
Question by anonymous reader: How many monthly or daily active users does Minds have?
Bill: Around 250,000 MAU.
Question by anonymous reader: How does minds make money? Is it hoping the cost of the token will go up?
Bill: We sell tokens which are used to buy our products, Minds Plus, Boost, Wire, or even to launch your own social network nodes.
Question by anonymous reader: What coins/tokens does Minds use? Does Minds.com use its own token? If so what is the name of it? Bill: Yes, the Minds token is an ERC-20.
Question by anonymous reader: Minds.com sounds like a good idea. What kind of reception are you seeing from users? I have one more question: What's the philosophy behind this points based system?
Bill: Here are some recent user testimonials -- 1, and 2.
Please check out our whitepaper [PDF] for more philosophy, but it's all about contributionism and giving people a way to have their voices heard.
Question by anonymous reader: The problem I see with many startups and companies these days is that they have a good idea and strong principles. But eventually the big shark in their category buys them. What would you do if Facebook offered you a billion dollar tomorrow?
Bill: We will never sell-out our and compromise our principles. It would be like murder.
Question by anonymous reader: What differentiates Minds.com from Steemit?
Bill: Minds has many more features and mobile apps https://minds.com/mobile. Additionally, our reward system doesn't give you more voting power for having more tokens. Everyone's vote is the same worth and your daily rewards are based on the total unique engagement you are receiving from the community, not getting the attention of large token holders. We also don't run everything on a blockchain, which has scaling issues.
Question by anonymous reader: Fundamentally speaking, won't you say Minds is basically just Reddit with crypto?
Bill:It's much more than that. We are entirely free and open source which Reddit is not. https://gitlab.com/minds. We host many more types of content, we have video conferencing, blogs, videos, etc. That being said we do have similarities with ranking feeds, voting and categories, but hashtag categories on Minds aren't moderated by individuals. Groups are.
Question by anonymous reader: What will prevent Minds.com from becoming the next Facebook? I mean, do you have things or procedure or guideline in place to prevent your site from becoming a capitalist dominated data aggregation tool for those who have money to use as a tool to control/subdue the mass? What will prevent Minds from being taken over by a CA or Board that will dictate new rules aimed at making Minds the next Facebook?
Bill: Good questions. First, we are working on a fully decentralized network at gitlab.com/minds/nomad and gitlab.com/minds/nomad-mobile. We share the goal of putting as much control in the user's hands as possible. We don't require any personal information. We are community-funded via WeFunder and have partial community ownership. The best we can do is be as transparent as possible, share our code and work closely with the community to develop something that is symbiotic.
Question by anonymous reader: It seems like Minds incentivizes quality over quantity, at the end of the day. I can see how quality can be beneficial, but what de-incentivizes someone from pumping out tons of quantity in order to achieve the same rewards?
Bill: We have rate limits to prevent this type of behavior.
Question by anonymous reader: Were you aware of Slashdot's comment moderation and meta-moderation system? Did it inspire Minds moderation/incentive system at all?
Bill: No, but we are about to roll-out a community moderation feature where juries of users can vote on reports and appeals, which is very exciting for digital democracy.
Question by pecosdave : I've noticed that most new social media platforms based on crypto tend to attract crypto people. Steemit, for example, is so cryptoed up there's almost no one talking about anything else - and that drives people away.
Minds, so far I've liked, it doesn't appear to be a crypto fanatic hangout like other crypto based sites are, but it still has the issue that it's going to confuse average users. What kind of users are you hoping to see on your platform? Optimistically, how many users are you hoping to see on Minds by end of next year?
Bill: We want as diverse a community as possible, and obviously want to appeal to mainstream. I think the reward system to increase your social reach is something all social app users want. People want to be heard. We also are working on simplifying the crypto system to demystify it and make it feel like a game. It's not really worth throwing out numbers. We want orders of magnitude growth.
Question by anonymous reader: It sounds like a permanent record of down-/up-votes. How is this different from a credit history or a criminal record? Where's the right to be forgotten, or at least, have historical stupidity discounted? Will Minds.com have some means of flexible content-filtering of posts I see?
Bill: I don't really see the connection. We allow users to delete their accounts. And yes, we have filters for NSFW and the ability to subscribe to hashtag feeds.
Question by alternative_right : Open discussion standards are those which protect the user from censorship and deletion of their work on the site. They generally permit removal of illegal material or grossly offensive images and slurs, but do not permit censorship by content type or topic.
Will Minds.com adopt one of these, and if so, will that make it hard for it to become a popular social network since most people "seem" to want a steady stream of inoffensive palaver and kitty pictures instead of substantive issues, debates, articles, discussions, etc.?
Bill: You can read our Bill of Rights. We allow most anything lawful in the US and want to be as uncensored as possible while obviously not risking user safety at all. -
'We Will Never Sell-out or Compromise Our Principles. That Would Be Like Murder': The Slashdot Interview With CEO and Founder of Minds.com Social Network
You asked, he answered!
Bill Ottman, founder and CEO of social networking site Minds.com, has answered more than a dozen questions that Slashdot readers sent his way. Ottman has addressed a wide-range of queries surrounding how Minds.com makes use of tokens; how many users the platform has; and, who is Minds.com aimed for. You can read his answers below. For those of you who are going to give Minds.com a try, you can find Slashdot there. Question, by anonymous reader: So Minds uses karma points. This could potentially have a real consequence where some might find a way to trade these points for real money. People with loads of money might then arrive and use this trick to to gain influence. Have you thought of this? And if so, how are you tackling it?
Bill: Ultimately you have to ask, would you rather the community be rewarded for their contributions or not? We believe people deserve to be rewarded for successfully participating on Minds. Of course certain users will try to game the system, but we have some pretty good tools in place to minimize this such as rate limits and parcel limits on buying tokens.
Tokens can be used on advertising via token and boost. Being able to purchase influence isn't inherently a negative thing, you just don't want it to dominate the network. This is why we also allow users to earn, and we are committed to maintaining balance so that those with money cannot drown others out.
Question by sinij :How are you going to sell a combination of microtransactions (i.e. points) and social media, two least consumer-friendly trends in tech, to users?
Bill: Our crypto-token system is extremely popular along with the ability to tip and subscribe to others monthly on recurring bases. People love earning tokens and then boosting posts with them. 1 token gets 1,000 impressions extra.
Social media focused on transparency, privacy, reach, rewards and monetization is becoming very popular as people are disillusioned with the digital rights abuses of big tech.
Question by anonymous reader: How many monthly or daily active users does Minds have?
Bill: Around 250,000 MAU.
Question by anonymous reader: How does minds make money? Is it hoping the cost of the token will go up?
Bill: We sell tokens which are used to buy our products, Minds Plus, Boost, Wire, or even to launch your own social network nodes.
Question by anonymous reader: What coins/tokens does Minds use? Does Minds.com use its own token? If so what is the name of it? Bill: Yes, the Minds token is an ERC-20.
Question by anonymous reader: Minds.com sounds like a good idea. What kind of reception are you seeing from users? I have one more question: What's the philosophy behind this points based system?
Bill: Here are some recent user testimonials -- 1, and 2.
Please check out our whitepaper [PDF] for more philosophy, but it's all about contributionism and giving people a way to have their voices heard.
Question by anonymous reader: The problem I see with many startups and companies these days is that they have a good idea and strong principles. But eventually the big shark in their category buys them. What would you do if Facebook offered you a billion dollar tomorrow?
Bill: We will never sell-out our and compromise our principles. It would be like murder.
Question by anonymous reader: What differentiates Minds.com from Steemit?
Bill: Minds has many more features and mobile apps https://minds.com/mobile. Additionally, our reward system doesn't give you more voting power for having more tokens. Everyone's vote is the same worth and your daily rewards are based on the total unique engagement you are receiving from the community, not getting the attention of large token holders. We also don't run everything on a blockchain, which has scaling issues.
Question by anonymous reader: Fundamentally speaking, won't you say Minds is basically just Reddit with crypto?
Bill:It's much more than that. We are entirely free and open source which Reddit is not. https://gitlab.com/minds. We host many more types of content, we have video conferencing, blogs, videos, etc. That being said we do have similarities with ranking feeds, voting and categories, but hashtag categories on Minds aren't moderated by individuals. Groups are.
Question by anonymous reader: What will prevent Minds.com from becoming the next Facebook? I mean, do you have things or procedure or guideline in place to prevent your site from becoming a capitalist dominated data aggregation tool for those who have money to use as a tool to control/subdue the mass? What will prevent Minds from being taken over by a CA or Board that will dictate new rules aimed at making Minds the next Facebook?
Bill: Good questions. First, we are working on a fully decentralized network at gitlab.com/minds/nomad and gitlab.com/minds/nomad-mobile. We share the goal of putting as much control in the user's hands as possible. We don't require any personal information. We are community-funded via WeFunder and have partial community ownership. The best we can do is be as transparent as possible, share our code and work closely with the community to develop something that is symbiotic.
Question by anonymous reader: It seems like Minds incentivizes quality over quantity, at the end of the day. I can see how quality can be beneficial, but what de-incentivizes someone from pumping out tons of quantity in order to achieve the same rewards?
Bill: We have rate limits to prevent this type of behavior.
Question by anonymous reader: Were you aware of Slashdot's comment moderation and meta-moderation system? Did it inspire Minds moderation/incentive system at all?
Bill: No, but we are about to roll-out a community moderation feature where juries of users can vote on reports and appeals, which is very exciting for digital democracy.
Question by pecosdave : I've noticed that most new social media platforms based on crypto tend to attract crypto people. Steemit, for example, is so cryptoed up there's almost no one talking about anything else - and that drives people away.
Minds, so far I've liked, it doesn't appear to be a crypto fanatic hangout like other crypto based sites are, but it still has the issue that it's going to confuse average users. What kind of users are you hoping to see on your platform? Optimistically, how many users are you hoping to see on Minds by end of next year?
Bill: We want as diverse a community as possible, and obviously want to appeal to mainstream. I think the reward system to increase your social reach is something all social app users want. People want to be heard. We also are working on simplifying the crypto system to demystify it and make it feel like a game. It's not really worth throwing out numbers. We want orders of magnitude growth.
Question by anonymous reader: It sounds like a permanent record of down-/up-votes. How is this different from a credit history or a criminal record? Where's the right to be forgotten, or at least, have historical stupidity discounted? Will Minds.com have some means of flexible content-filtering of posts I see?
Bill: I don't really see the connection. We allow users to delete their accounts. And yes, we have filters for NSFW and the ability to subscribe to hashtag feeds.
Question by alternative_right : Open discussion standards are those which protect the user from censorship and deletion of their work on the site. They generally permit removal of illegal material or grossly offensive images and slurs, but do not permit censorship by content type or topic.
Will Minds.com adopt one of these, and if so, will that make it hard for it to become a popular social network since most people "seem" to want a steady stream of inoffensive palaver and kitty pictures instead of substantive issues, debates, articles, discussions, etc.?
Bill: You can read our Bill of Rights. We allow most anything lawful in the US and want to be as uncensored as possible while obviously not risking user safety at all. -
Why Sleep Apnea Patients Rely On a Lone, DRM-Breaking CPAP Machine Hacker (vice.com)
Jason Koebler writes: "SleepyHead" is a free, open-source, and definitely not FDA-approved piece of software for sleep apnea patients that is the product of thousands of hours of hacking and development by a lone Australian developer named Mark Watkins, who has helped thousands of sleep apnea patients take back control of their treatment from overburdened and underinvested doctors. The software gives patients access to the sleep data that is already being generated by their CPAP machines but generally remains inaccessible, hidden by DRM and proprietary data formats that can only be read by authorized users (doctors) on proprietary pieces of software that patients often can't buy or download. SleepyHead and community-run forums like CPAPtalk.com and ApneaBoard.com have allowed patients to circumvent medical device manufacturers, who would prefer that the software not exist at all. Medical device manufacturers fought in 2015 to prevent an exemption to the Digital Millennium Copyright Act to legalize hacking by patients who wanted to access their own data, but an exemption was granted, legalizing SleepyHead and software like it. -
ESR's Newest Project: An Open Hardware/Open Source UPS (ibiblio.org)
An anonymous reader writes: Last month Eric S. Raymond complained about his choices for a UPS (Uninterruptible Power Supply), adding that "This whole category begs to be disrupted by an open-hardware [and open-source] design that could be assembled cheaply in a makerspace from off-the-shelf components, an Arduino-class microcontroller, and a PROM...because it's possible, and otherwise the incentives on the vendors won't change." It could be designed to work with longer-lasting and more environmentally friendly batteries, using "EV-style intelligent battery-current sensors to enable accurate projection of battery performance" (along with a text-based alert system and a USB monitoring port).
Calling the response "astonishing," Raymond noted the emergence within a week of "the outlines of a coherent design," and in an update on GitLab reported that "The response on my blog and G+ was intense, almost overwhelming. It seems many UPS users are unhappy with what the vendors are pushing" -- and thus, the UPSide project was launched. "We welcome contributors: people with interest in UPSes who have expertise in battery technology, power-switching electronics, writing device-control firmware, relevant standards such as USB and the DMTF battery-management profile. We also welcome participation from established UPS and electronics vendors. We know that consumer electronics is a cutthroat low-margin business in which it's tough to support a real R&D team or make possibly-risky product bets. Help us, and then let us help you!"
There's already a Wiki with design documents -- plus a process document -- and Raymond says the project now even has a hardware lead with 30 years experience as a power and signals engineer, plus "a really sharp dev group. Half a dozen experts have shown up to help spec this thing, critique the design docs, and explain EE things to ignorant me." And he's already touting "industry participation! We have a friendly observer who's the lead software architect for one of the major UPS vendors." Earlier Raymond identified his role as "basically, product manager -- keeper of the requirements list and recruiter of talent" -- though he admits on his blog that he's already used a "cute hack" to create a state/action diagram for the system, "by writing a DSL to generate code in another DSL and provably correct equivalent C application logic."
He adds to readers of the blog that if that seems weird to you, "you must be new here." -
ESR's Newest Project: An Open Hardware/Open Source UPS (ibiblio.org)
An anonymous reader writes: Last month Eric S. Raymond complained about his choices for a UPS (Uninterruptible Power Supply), adding that "This whole category begs to be disrupted by an open-hardware [and open-source] design that could be assembled cheaply in a makerspace from off-the-shelf components, an Arduino-class microcontroller, and a PROM...because it's possible, and otherwise the incentives on the vendors won't change." It could be designed to work with longer-lasting and more environmentally friendly batteries, using "EV-style intelligent battery-current sensors to enable accurate projection of battery performance" (along with a text-based alert system and a USB monitoring port).
Calling the response "astonishing," Raymond noted the emergence within a week of "the outlines of a coherent design," and in an update on GitLab reported that "The response on my blog and G+ was intense, almost overwhelming. It seems many UPS users are unhappy with what the vendors are pushing" -- and thus, the UPSide project was launched. "We welcome contributors: people with interest in UPSes who have expertise in battery technology, power-switching electronics, writing device-control firmware, relevant standards such as USB and the DMTF battery-management profile. We also welcome participation from established UPS and electronics vendors. We know that consumer electronics is a cutthroat low-margin business in which it's tough to support a real R&D team or make possibly-risky product bets. Help us, and then let us help you!"
There's already a Wiki with design documents -- plus a process document -- and Raymond says the project now even has a hardware lead with 30 years experience as a power and signals engineer, plus "a really sharp dev group. Half a dozen experts have shown up to help spec this thing, critique the design docs, and explain EE things to ignorant me." And he's already touting "industry participation! We have a friendly observer who's the lead software architect for one of the major UPS vendors." Earlier Raymond identified his role as "basically, product manager -- keeper of the requirements list and recruiter of talent" -- though he admits on his blog that he's already used a "cute hack" to create a state/action diagram for the system, "by writing a DSL to generate code in another DSL and provably correct equivalent C application logic."
He adds to readers of the blog that if that seems weird to you, "you must be new here." -
ESR's Newest Project: An Open Hardware/Open Source UPS (ibiblio.org)
An anonymous reader writes: Last month Eric S. Raymond complained about his choices for a UPS (Uninterruptible Power Supply), adding that "This whole category begs to be disrupted by an open-hardware [and open-source] design that could be assembled cheaply in a makerspace from off-the-shelf components, an Arduino-class microcontroller, and a PROM...because it's possible, and otherwise the incentives on the vendors won't change." It could be designed to work with longer-lasting and more environmentally friendly batteries, using "EV-style intelligent battery-current sensors to enable accurate projection of battery performance" (along with a text-based alert system and a USB monitoring port).
Calling the response "astonishing," Raymond noted the emergence within a week of "the outlines of a coherent design," and in an update on GitLab reported that "The response on my blog and G+ was intense, almost overwhelming. It seems many UPS users are unhappy with what the vendors are pushing" -- and thus, the UPSide project was launched. "We welcome contributors: people with interest in UPSes who have expertise in battery technology, power-switching electronics, writing device-control firmware, relevant standards such as USB and the DMTF battery-management profile. We also welcome participation from established UPS and electronics vendors. We know that consumer electronics is a cutthroat low-margin business in which it's tough to support a real R&D team or make possibly-risky product bets. Help us, and then let us help you!"
There's already a Wiki with design documents -- plus a process document -- and Raymond says the project now even has a hardware lead with 30 years experience as a power and signals engineer, plus "a really sharp dev group. Half a dozen experts have shown up to help spec this thing, critique the design docs, and explain EE things to ignorant me." And he's already touting "industry participation! We have a friendly observer who's the lead software architect for one of the major UPS vendors." Earlier Raymond identified his role as "basically, product manager -- keeper of the requirements list and recruiter of talent" -- though he admits on his blog that he's already used a "cute hack" to create a state/action diagram for the system, "by writing a DSL to generate code in another DSL and provably correct equivalent C application logic."
He adds to readers of the blog that if that seems weird to you, "you must be new here." -
Volunteers Around the World Build Surveillance-Free Cellular Network Called 'Sopranica' (vice.com)
dmoberhaus writes: Motherboard's Daniel Oberhaus spoke to Denver Gingerich, the programmer behind Sopranica, a DIY, community-oriented cell phone network. "Sopranica is a project intended to replace all aspects of the existing cell phone network with their freedom-respecting equivalents," says Gingerich. "Taking out all the basement firmware on the cellphone, the towers that track your location, the payment methods that track who you are and who owns the number, and replacing it so we can have the same functionality without having to give up all the privacy that we have to give up right now. At a high level, it's about running community networks instead of having companies control the cell towers that we connect to." Motherboard interviews Gingerich and shows you how to use the network to avoid cell surveillance. According to Motherboard, all you need to do to join Sopranica is "create a free and anonymous Jabber ID, which is like an email address." Jabber is slang for a secure instant messaging protocol called XMPP that let's you communicate over voice and text from an anonymous phone number. "Next, you need to install a Jabber app on your phone," reports Motherboard. "You'll also need to install a Session Initiation Protocol (SIP) app, which allows your phone to make calls and send texts over the internet instead of the regular cellular network." Lastly, you need to get your phone number, which you can do by navigating to Sopranica's JMP website. (JMP is the code, which was published by Gingerich in January, and "first part of Sopranica.") "These phone numbers are generated by Sopranica's Voice Over IP (VOIP) provider which provides talk and text services over the internet. Click whichever number you want to be your new number on the Sopranica network and enter your Jabber ID. A confirmation code should be sent to your phone and will appear in your Jabber app." As for how JMP protects against surveillance, Gingerich says, "If you're communicating with someone using your JMP number, your cell carrier doesn't actually know what your JMP number is because that's going over data and it's encrypted. So they don't know that that communication is happening." -
ESR Announces The Open Sourcing Of The World's First Text Adventure (ibiblio.org)
An anonymous reader writes: Open source guru Eric S. Raymond added something special to his GitHub page: an open source version of the world's first text adventure. "Colossal Cave Adventure" was first written in 1977, and Raymond remembers it as "the origin of many things; the text adventure game, the dungeon-crawling D&D (computer) game, the MOO, the roguelike genre. Computer gaming as we know it would not exist without ADVENT (as it was known in its original PDP-10 incarnation...because PDP-10 filenames were limited to six characters of uppercase)...
"Though there's a C port of the original 1977 game in the BSD game package, and the original FORTRAN sources could be found if you knew where to dig, Crowther & Woods's final version -- Adventure 2.5 from 1995 -- has never been packaged for modern systems and distributed under an open-source license. Until now, that is. With the approval of its authors, I bring you Open Adventure."
Calling it one of the great artifacts of hacker history, ESR writes about "what it means to be respectful of an important historical artifact when it happens to be software," ultimately concluding version control lets you preserve the original and continue improving it "as a living and functional artifact. We respect our history and the hackers of the past best by carrying on their work and their playfulness."
"Despite all the energy Crowther and Woods had to spend fighting ancient constraints, ADVENT was a tremendous imaginative leap; there had been nothing like it before, and no text adventure that followed it would be innovative to quite the same degree." -
GitLab Acquires Software Chat Startup Gitter, Will Open-Source the Code (venturebeat.com)
According to VentureBeat, "GitLab, a startup that provides open source and premium source code repository software that people use to collaborate on software, is announcing today that it has acquired Gitter, a startup that provides chat rooms that are attached to repositories of code so that collaborators can exchange messages." From the report: GitLab won't bundle it in its community edition or its enterprise edition yet, but it will open-source the Gitter code for others to build on, GitLab cofounder and CEO Sid Sijbrandij told VentureBeat in an interview. What's happening now, though, is that as part of GitLab, Gitter is launching a new feature called Topics, where people will be able to ask and answer questions -- sort of like Stack Overflow. "Although Gitter is best in class with indexing things, it's still sometimes hard to find things," Sijbrandij said. "In this Q&A product, it's a lot easier to structure the Q&A. You're not dealing so much with a chronological timeline where people have different conversations that cross each other. There's a location for every piece of knowledge, and it can grow over time." That technology is already available in beta in Gitter rooms on GitHub, and it will become available on GitLab's Gitter pages over time, Sijbrandij said. -
Cryptsetup Vulnerability Grants Root Shell Access On Some Linux Systems (threatpost.com)
msm1267 quotes a report from Threatpost: A vulnerability in cryptsetup, a utility used to set up encrypted filesystems on Linux distributions, could allow an attacker to retrieve a root rescue shell on some systems. From there, an attacker could have the ability to copy, modify, or destroy a hard disk, or use the network to exfiltrate data. Cryptsetup, a utility used to setup disk encryption based on the dm-crypt kernel module, is usually deployed in Debian and Ubuntu. Researchers warned late last week that if anyone uses the tool to encrypt system partitions for the operating systems, they're likely vulnerable. Two researchers, Hector Marco of the University of the West of Scotland and Ismael Ripoll, of the Polytechnic University of Valencia, in Spain, disclosed the vulnerability on Friday at DeepSec, a security conference held at the Imperial Riding School Renaissance Vienna Hotel in Austria. According to a post published to the Full Disclosure mailing list, the vulnerability (CVE-2016-4484) affects packages 2.1 and earlier. Systems that use Dracut, an infrastructure commonly deployed on Fedora in lieu of initramfs -- a simple RAM file system directory, are also vulnerable, according to the researchers. The pair say additional Linux distributions outside of Debian and Ubuntu may be vulnerable, they just haven't tested them yet. The report adds: "The problem stems from the incorrect handling of a password check when a partition is ciphered with LUKS, or Linux Unified Key Setup, a disk encryption specification that's standard for Linux. Assuming an attacker has access to the computer's console, when presented with the LUKS password prompt, they could exploit the vulnerability simply by pressing 'Enter' over and over again until a shell appears. The researchers say the exploit could take as few as 70 seconds. After a user exceeds the maximum number of three password tries, the boot sequence continues normally. Another script in the utility doesn't realize this, and drops a BusyBox shell. After carrying out the exploit, the attacker could obtain a root initramfs, or rescue shell. Since the shell can be executed in the initrd, or initial ram disk, environment, it can lead to a handful of scary outcomes, including elevation of privilege, information disclosure, or denial of service." -
GitLab Acquires Gitorious
New submitter sckirklan writes with news that code repository GitLab has purchased rival service Gitorious. Gitorious users are now able to import their projects into GitLab. They must do so by the end of May, because Gitorious will shut down on June 1st. Rolf Bjaanes, Gitorious CEO, gives some background on the reasons for the acquisition: “At Gitorious we saw more and more organizations adopting GitLab. Due to decreased income from on-premises customers, running the free Gitorious.org was no longer sustainable. GitLab was solving the same problem that we were, but was solving it better.” “This acquisition will accelerate the growth of GitLab. With more than 100,000 organizations using it, it is already the most used on-premise solution for Git repository management, and bringing Gitorious into the fold will significantly increase that footprint.” says Sytse Sijbrandij, GitLab CEO.