SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
With slick marketing, catchy taglines and some pretty bold claims about their security, nomx claim to have cracked email security.
This thorough article tells all about the device, and it doesn't measure up at all to its marketing.
It would be very easy to conclude that this is a scam. The device is running standard mail server software running on a Raspberry Pi, most of which is outdated. They have presented at countless tech shows and can be constantly found making bold statements of 'absolute security' yet didn't pick up a CSRF vulnerability in their web interface.
Source: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/
Nomx has issued a reply on their main page in a post titled 'nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx'. In that reply nomx states the following results:
No nomx user was affected by this threat. No nomx user could be affected by this threat in the future. No nomx data was compromised, and the blogger has (finally) reluctantly verified this. He still has not publicly shared these statements, except via an email response to the BBC when directly asked on April 25 the response was:
From the BBC to nomx: "I understand from your replies that you state categorically that no nomx accounts have been affected by this hack. I have put your questions to [blogger] who has confirmed to me that he cannot say that any have."
While nomx is no longer based on Raspberry devices, we still maintain that the users' data is secured as we've demonstrated to the blogger, the media and our customers.
Also at Ars Technica
(Score: 1, Insightful) by Anonymous Coward on Sunday April 30 2017, @08:21AM (3 children)
Here I came to think it would be about some new secure open source protocol... yet, it is a about an obscured hardware/software solution. That's at least 2 things to not trust their security for: 1) outdated software (even if there are no security issues there yet, how is their update policy?) and 2) Raspberries use closed blobs and even the hardware could contain unknown backdoors in various chips inside the device.
(Score: 2) by The Mighty Buzzard on Sunday April 30 2017, @10:29AM
Yeah, me and everyone else who can sudo -i on production systems had a huge laugh reading it so it had to go in the sub queue.
My rights don't end where your fear begins.
(Score: 1, Offtopic) by TheB on Sunday April 30 2017, @11:55AM (1 child)
https://github.com/raspberrypi/firmware/issues/791 [github.com]
When they take a month and still have no answer to a serious question like this, I loose faith in raspberry pi developers.
(Score: 0, Offtopic) by noneof_theabove on Sunday April 30 2017, @02:46PM
or forgot when just be silent.
Microsoft Closes Word/Wordpad Hole—6 Months after Report
https://soylentnews.org/article.pl?sid=17/04/29/1353210 [soylentnews.org]
Something about rocks, houses and glass.
The Tao of Programming states: Although the program is only 3 lines long, eventually it will have to be maintained.