Tag Archives: os/2

ArcaOS

We’re celebrating the release of ArcaOS 5.0.3 with a Sale!

The release today of ArcaOS 5.0.3  seems like a great time to celebrate with a sale! How can you lose? Get the best build of ArcaOS to date and at a great price!

If you’ve been waiting to get an ArcaOS license, either as a return to OS/2 after a long absence or because you’ve heard the buzz about the breakthrough Blue Lion distribution, or even if you’re a current ArcaOS licensee and want an additional license or two — or three — for some other systems, now is the time. These are the same low sale prices from our 4th of July sale on this outstanding OS distribution. Why wait?

ArcaOS 5.0 personal edition licenses are on sale for just $109 from now through Wednesday, August 22. Personal edition licenses include six months of support and updates, and after that, annual support renewals are available for a great price, with their own built-in renewal discounts.

ArcaOS 5.0 commercial edition licenses are on sale for just $195 from now through Wednesday, August 22, and include a full year of support and updates. As with personal licenses, annual support is available at a discounted price for timely renewals.

Get your ArcaOS licenses today!

 

ArcaOS

It’s the 4th of July! Time for a Sale!

Arca Noae is launching our first ever 4th of July Sale!

If you’ve been waiting to get an ArcaOS license, either as a return to OS/2 after a long absence or because you’ve heard the buzz about the breakthrough Blue Lion distribution, or even if you’re a current ArcaOS licensee and want an additional license or two — or three — for some other systems, now is the time. These are the lowest prices of the year on this outstanding OS distribution!

ArcaOS 5.0 personal edition licenses are on sale for just $109 from now through Sunday, July 8. Personal edition licenses include six months of support and updates, and after that, annual support renewals are available for a great price, with their own built-in renewal discounts.

ArcaOS 5.0 commercial edition licenses are on sale for just $195 from now through Sunday, July 8, and include a full year of support and updates. As with personal licenses, annual support is available at a discounted price for timely renewals.

Get your ArcaOS licenses today!

 

Arca Noae Package Manager version 1.0.3 has been released

Arca Noae is pleased to announce the immediate availability of an updated Arca Noae Package Manager for ArcaOS, OS/2, and eComStation. (1.0.3)

This is a minor update, featuring various fixes and enhancements:

  • Ability to select specific platform for package installation/replacement.
  • Better filtering of duplicate packages in lists.
  • Improved message formatting.
  • Improved and expanded help guide, with more “how-to” references.
  • Updated included libraries.
  • Various bug fixes and other minor improvements.

Arca Noae Package Manager is available in English with Spanish, French, Italian, German, Dutch, and Swedish language packs. Some have added help file translations in this version.

This open source utility is available to everyone, free of charge, regardless whether you have an Arca Noae software subscription or an ArcaOS license.

Please review the wiki for important first-time installation and upgrade notes and other tips.

Support FreeRDP for OS/2!

If you have a need to access a remote Windows desktop, the best option is using a Remote Desktop Protocol (RDP) client. Using RDP, the local system’s drives may be mapped (redirected) into the remote system to access local files, and even audio from the remote system may be redirected to the local system.

Currently, the RDP client of choice on OS/2 is RDesktop, ported by Andrey Vasilkin. However, RDesktop is showing its age, and a newer, more active project, FreeRDP, has become very well known.

Andrey proposes porting FreeRDP to OS/2, which poses its own set of challenges, so in order to do that, he needs support from the OS/2 user base. This project will take several months, but when he is done, all users of OS/2 warp, eCS, and ArcaOS will have a free, modern, remote access tool.

Sponsoring units for this work may be purchased in the Arca Noae store, in $15, $25, $50, and $100 increments, and of course, it is possible to purchase multiple units at one time.

As with all of the sponsoring collected through Arca Noae 100% of your donation (subject to currency conversion) goes to the project or to the developer. Arca Noae absorbs any related transfer fees.

Policy statement concerning Spectre and Meltdown exploits

Spectre and Meltdown are terms used to describe two potential exploits in a class of security attacks commonly termed “timing attacks” because they access data which may be sensitive in nature (passwords and other information) from areas of memory which may only be available at specific times (either moved elsewhere or removed entirely at other times). They belong to the more general class termed “side-channel attacks,” because they exploit the hardware itself, rather than breaking encryption or utilizing a software flaw. For more technical information regarding these exploits, please refer to the links section, below.

Arca Noae engineers are monitoring the situation, and while there is still much contradictory information crossing the internet at this time, we believe we have been able to assess at least some of the risk and provide some guidance to users of the OS/2 platform (OS/2 Warp, eComStation, and ArcaOS). As further reliable information becomes available, this post will be updated to reflect any change in Arca Noae’s position and any actions we may plan to take.

General information

In order to gain access to any information in privileged memory using one of these exploits, a user-level application must be launched on the specific machine to be compromised. This means that presently, an OS/2 executable must be used as the attack vector. As of this writing, we are not aware of any such code which executes on the OS/2 platform.

Browser-based attacks (running JavaScript) appear to require greater precision in a high-resolution timer than is currently available on OS/2, making such exploits more difficult than on other platforms, if not altogether impossible. It should also be noted that any such JavaScript-based attack would have to also be specifically designed to handle access to memory regions as managed by OS/2 (in other words, a malicious JavaScript program must be written for OS/2 and specifically to run in the OS/2 browser version in which it is running; a JavaScript program written for Windows or Linux will not work on OS/2). Realistically, the chance of this level of coding detail is extremely small.

Risks – virtual installations vs bare metal

By far, virtualized environments (running OS/2 as a guest under some other more vulnerable platform) are at the greatest risk, because the host system may rightly have access to the guest’s memory and virtualized processor. A host running a vulnerable operating system with an exploitable CPU which remains unpatched is the greatest concern. Arca Noae believes bare metal installations of OS/2-based operating systems are at much less risk.

Arca Noae’s current strategy

To date, we have not identified a need for a kernel patch to mitigate the risk of any hypothetical Spectre or Meltdown attack against OS/2-based systems. We continue to monitor the available information and will adjust our strategy as conditions require.

Arca Noae’s current recommendations

For virtualized and bare metal installations, Arca Noae recommends only running software obtained from trusted sources. Per stand practice, reasonable security precautions should be taken when accessing the internet, particularly when visiting unfamiliar or untrusted sites, and browser cache should be cleared regularly. The use of a NAT firewall is also encouraged (either a separate one, as built into a broadband router or at a minimum, a software firewall running on the local OS/2 system, such as InJoy Firewall).

Because a malicious application designed to utilize one of these exploits would have to be downloaded or copied to the target OS/2 system and then executed locally, normal malware protections remain the best first line of defense.

For virtualized installations, Arca Noae recommends applying to the host system whatever patches are made available and recommended by the developer of the host operating system.

Updates

2019-02-14: Security researchers apparently conclude in this whitepaper that Spectre cannot be entirely mitigated at the software level.

2019-10-07: Intel engineers have proposed (official/latest Intel PDF, here) a new memory type, speculative-access protected memory (SAPM), to mitigate a common factor in side-channel attacks which access cache/memory.

Links

Official information

Spectre CVEs:

CVE-2017-5753

CVE-2017-5715

Meltdown CVE:

CVE-2017-5754

Mozilla Security Blog

CERT: CPU hardware vulnerable to side-channel attacks

Intel: Facts about side-channel analysis and Intel products

AMD: An update on AMD processor security

ArcaOS

Our first ever Black Friday Sale!

Arca Noae is launching our first ever Black Friday Sale!

If you’ve been waiting to get an ArcaOS license, either as a return to OS/2 after a long absence or because you’ve heard the buzz about the breakthrough Blue Lion distribution, or even if you’re a current ArcaOS licensee and want an additional license or two — or three — for some other systems, now is the time.

ArcaOS 5.0 personal edition licenses are on sale for just $109 from now through the end of 2017. Personal edition licenses include six months of support and updates, and after that, annual support renewals are available for a great price.

ArcaOS 5.0 commercial edition licenses are on sale for just $195 from now through the end of 2017, and include a full year of support and updates.

Get your ArcaOS licenses while they’re available at these great discounts!