Recherche avancée

Sur d’autres sites (9254)

• Matomo will now pay researchers 5,000 USD for a critical security vulnerability

  7 mai 2020, par Matomo Core Team
  Matomo Analytics is the leading open-source web analytics solution, designed to give you conclusive insights while respecting your user’s privacy, and keeping your data secure. We’re so proud Matomo is trusted with the analytics data of more than 1 million sites worldwide.

  Although we have had an excellent security track record so far, we recognise security is an ongoing challenge and requires constant vigilance. With this announcement we’re showing our commitment to reward those who help us maintain the highest security in Matomo.

  New bounty of 5,000 USD for a CRITICAL security issue responsibly disclosed to us

  We’re now paying 5,000 USD or 4,700 EUR for each critical vulnerability found, and responsibly disclosed to us. (Previously this bounty was less than 1,000USD.) 

  A Critical Issue in Matomo means an issue in our latest official release at : builds.matomo.org/latest.zip as installed on a typical server (and possibly using any of our official plugins by Matomo or InnoCraft from the Marketplace).

  If you can gain remote code execution on the server (i.e. RCE), or if you’re able to delete data with an HTTPS request (i.e. SQL Injection), this may qualify as a Critical Issue. Please report it on Hackerone.

  Matomo keeps your data secure

  The Matomo team has always been committed to achieving the highest standard of security. For example, Matomo was one of the first open-source projects in the world to launch a public bug bounty in January 2011. Every year many researchers, users and customers review the Matomo source code, and overall we’ve rewarded dozens of researchers over the years for their work in keeping Matomo data safe.

  How to make your Matomo server even more secure ?

  Check out our recommendations in How to configure Matomo for Security

   

• What is this "fixing the build scripts" for compiling x264 ?

  29 mai 2020, par Blake Senftner

  I am trying to compile an all static build of source-customized ffmpeg libraries with the additional codecs from VideoLAN, such as their x264 codec. I am ultimately building for use in Windows with Visual Studio 2015 C++, so I am comparing a few compiling guides for my instructions.

  



  In the guide linked below (I located via Google searches) shows how to compile x264 with the VS2015 toolchain in MSYS2 without any special steps :
https://gist.github.com/RangelReale/3e6392289d8ba1a52b6e70cdd7e10282

  



  While in this other guide, offered by the compiling guide pages from ffmpeg's web site, it includes steps for "fixing the build scripts" for x264 :
https://www.roxlu.com/2019/062/compiling-ffmpeg-with-x264-on-windows-10-using-msvc

  



  Problem being, when I "fix the build scripts" the configure script no longer finds a C compiler. Building with the first guide seems to work, but it was also written nearly 2 years ago, so perhaps the ffmpeg guide is doing some important fix ? I don't know.

  



  I am :

  



  

  1. Running a "VS2015 x64 Native Tools Command Prompt"

  


  2. launching a pacman loaded msys2 shell via "msys2_shell.cmd -mingw64 -use-full-path"

  


  3. git cloning http://git.videolan.org/git/x264.git

  


  



  and at this point the two compiling guides vary, the first guide just cd's into x264 and runs configure while the other guide does some curl download of a config.guess file and then some sed manipulation of ./configure. Considering these instructions are "endorsed" by the ffmpeg site, I am left wondering what that is doing and how critical is it that these "special" steps cause my x264 configure to fail.

  


• What is this "fixing the build scripts" for compiling x264 ?

  29 mai 2020, par Blake Senftner

  I am trying to compile an all static build of source-customized ffmpeg libraries with the additional codecs from VideoLAN, such as their x264 codec. I am ultimately building for use in Windows with Visual Studio 2015 C++, so I am comparing a few compiling guides for my instructions.

  



  In the guide linked below (I located via Google searches) shows how to compile x264 with the VS2015 toolchain in MSYS2 without any special steps :
https://gist.github.com/RangelReale/3e6392289d8ba1a52b6e70cdd7e10282

  



  While in this other guide, offered by the compiling guide pages from ffmpeg's web site, it includes steps for "fixing the build scripts" for x264 :
https://www.roxlu.com/2019/062/compiling-ffmpeg-with-x264-on-windows-10-using-msvc

  



  Problem being, when I "fix the build scripts" the configure script no longer finds a C compiler. Building with the first guide seems to work, but it was also written nearly 2 years ago, so perhaps the ffmpeg guide is doing some important fix ? I don't know.

  



  I am :

  



  

  1. Running a "VS2015 x64 Native Tools Command Prompt"

  


  2. launching a pacman loaded msys2 shell via "msys2_shell.cmd -mingw64 -use-full-path"

  


  3. git cloning http://git.videolan.org/git/x264.git

  


  



  and at this point the two compiling guides vary, the first guide just cd's into x264 and runs configure while the other guide does some curl download of a config.guess file and then some sed manipulation of ./configure. Considering these instructions are "endorsed" by the ffmpeg site, I am left wondering what that is doing and how critical is it that these "special" steps cause my x264 configure to fail.