Labels

Sunday, February 3, 2019

"iOS 12.1.4 is coming to fix the worst iPhone and iPad bug to date" by Adrian Kingsley-Hughes

https://www.zdnet.com/article/ios-12-1-4-is-coming-to-fix-the-worst-iphone-and-ipad-bug-to-date/


iOS 12.1.4 will fix a FaceTime bug that offered a way for another iPhone or iPad user to eavesdrop on another iOS user by activating a FaceTime call without the user's consent. What made this bug all the worse is how trivial it was to implement.

As is expected, this bug already resulted in at least one lawsuit.

Apple has now disable Group FaceTime ability at the server end, putting a stop to this bug. However, this feature will remain disabled for all iOS users not running iOS 12.1.4 or later.

Back in December, Apple fixed another FaceTime bug – this one just an annoyance, and not a major privacy risk – with iOS 12.1.1.

Keep an eye out for iOS 12.1.4, because it could land any time now.

The recommended way to update your devices is to tap Settings > General > Software Update and carry out the update from there. You will need Wi-Fi access and your battery to be charged above 50 percent, or the device will need to be connected to a charger.

Alternatively, if you have Automatic Updates enabled (you can find this setting in Settings > General > Software Update) then you can just wait for it to come in when it's ready.

Or, if you like doing things the long, hard way, you can connect the iPhone to a PC or Mac running iTunes and do the upgrade from there (keep in mind that this makes the download much bigger).


"iOS 13 rumors: Everything you need to know" by Jason Cross

https://www.macworld.com/article/3336145/iphone-ipad/ios-13-rumors-features-release-date.html

Like clockwork, Apple releases a major revision of iOS every year. The company formally unveils the new operating system for iPhone and iPad at WWDC in June, followed by a beta testing period and then a final release in the fall (typically in September, just before the new iPhones hit the shelves).
One never really knows exactly what new features and design changes Apple will bring until the company gets on stage at WWDC, but the rumor mill churns early and often. After all, iOS is one of the widest-used and most influential consumer operating systems in the world. We have our own wishlist of iOS 13 features, but we’ve also collected all the rumors about iOS 13 here.
  1. Dark Mode
  2. CarPlay Improvements
  3. iPad-focused Upgrades

Sunday, November 12, 2017

Linux 4.14 Has Been Released

https://linux.slashdot.org/story/17/11/12/219238/linux-414-has-been-released?utm_source=feedly1.0mainlinkanon&utm_medium=feed

Linux 4.11 has been released. This release adds support for bigger memory limits in x86 hardware (128PiB of virtual address space, 4PiB of physical address space); support for AMD Secure Memory Encryption; a new unwinder that provides better kernel traces and a smaller kernel size; support for the zstd compression algorithm has been added to Btrfs and Squashfs; support for zero-copy of data from user memory to sockets; support for Heterogeneous Memory Management that will be needed in future GPUs; better cpufreq behaviour in some corner cases; faster TBL flushing by using the PCID instruction; asynchronous non-blocking buffered reads; and many new drivers and other improvements.

Tuesday, March 7, 2017

WikiLeaks publishes 'biggest ever leak of secret CIA documents' by Ewen MacAskill

https://www.theguardian.com/media/2017/mar/07/wikileaks-publishes-biggest-ever-leak-of-secret-cia-documents-hacking-surveillance

The 8,761 documents published by WikiLeaks focus mainly on techniques for hacking and surveillance

The US intelligence agencies are facing fresh embarrassment after WikiLeakspublished what it described as the biggest ever leak of confidential documents from the CIA detailing the tools it uses to break into phones, communication apps and other electronic devices.
Thousands of documents focus mainly on techniques for hacking, including how the CIA cooperated with British intelligence to engineer a way to compromise smart televisions and turn them into improvised surveillance devices.
The leak, dubbed “Vault 7” by WikiLeaks, will once again raise questions about the inability of US spy agencies to protect secret documents in the digital age. It follows disclosures about Afghanistan and Iraq by army intelligence specialist Chelsea Manning in 2010 and about the National Security Agency and Britain’s GCHQ by Edward Snowden in 2013.
The documents appear to be from the CIA’s 200-strong Center for Cyber Intelligence and show in detail how the agency’s digital specialists engage in hacking.
According to the documents:

  • CIA hackers targeted smartphones and computers.
  • The Center for Cyber Intelligence is based at the CIA headquarters in Virginia but it has a second covert base in the US consulate in Frankfurt which covers Europe, the Middle East and Africa.
  • A programme called Weeping Angel describes how to attack a Samsung F8000 TV set so that it appears to be off but can still be used for monitoring.

Friday, March 3, 2017

Researchers Store Computer OS, Short Movie On DNA

https://hardware.slashdot.org/story/17/03/02/210247/researchers-store-computer-os-short-movie-on-dna?utm_source=feedly1.0mainlinkanon&utm_medium=feed

In a new study published in the journal Science, a pair of researchers at Columbia University and the New York Genome Center (NYGC) show that an algorithm designed for streaming video on a cellphone can unlock DNA's nearly full storage potential by squeezing more information into its four base nucleotides. They demonstrate that this technology is also extremely reliable. Erlich and his colleague Dina Zielinski, an associate scientist at NYGC, chose six files to encode, or write, into DNA: a full computer operating system, an 1895 French film, "Arrival of a train at La Ciotat," a $50 Amazon gift card, a computer virus, a Pioneer plaque and a 1948 study by information theorist Claude Shannon. They compressed the files into a master file, and then split the data into short strings of binary code made up of ones and zeros. Using an erasure-correcting algorithm called fountain codes, they randomly packaged the strings into so-called droplets, and mapped the ones and zeros in each droplet to the four nucleotide bases in DNA: A, G, C and T. The algorithm deleted letter combinations known to create errors, and added a barcode to each droplet to help reassemble the files later. In all, they generated a digital list of 72,000 DNA strands, each 200 bases long, and sent it in a text file to a San Francisco DNA-synthesis startup, Twist Bioscience, that specializes in turning digital data into biological data. Two weeks later, they received a vial holding a speck of DNA molecules. To retrieve their files, they used modern sequencing technology to read the DNA strands, followed by software to translate the genetic code back into binary. They recovered their files with zero errors, the study reports.

The study also notes that "a virtually unlimited number of copies of the files could be created with their coding technique by multiplying their DNA sample through polymerase chain reaction (PCR)." The researchers also "show that their coding strategy packs 215 petabytes of data on a single gram of DNA."

Tuesday, February 21, 2017

Unpatched Python and Java Flaws Let Hackers Bypass Firewall Using FTP Injection by Swati Khandelwal

http://thehackernews.com/2017/02/python-java-ftp-protocol-injection.html


This newly discovered bugs in Java and Python is a big deal today.

The two popular programming languages, Java and Python, contain similar security flaws that can be exploited to send unauthorized emails and bypass any firewall defenses.

And since both the flaws remain unpatched, hackers can take advantage to design potential cyber attack operations against critical networks and infrastructures.

The unpatched flaws actually reside in the way Java and Python programming languages handle File Transfer Protocol (FTP) links, where they don't syntax-check the username parameter, which leads to, what researchers call, protocol injection flaw.




Java/Python FTP Injection to Send Unauthorized SMTP Emails


In a blog post published over the past week, security researcher Alexander Klink detailed the FTP protocol injection vulnerability in Java's XML eXternal Entity (XXE) that allows attackers to inject non-FTP malicious commands inside an FTP connection request.

To demonstrate the attack, Alexander showed how to send an unauthorized email via SMTP (Simple Mail Transfer Protocol) in an FTP connection attempt, even though the FTP connection failed, as FTP servers does support authentication, but doesn't check for the present of carriage returns (CR) or line feeds (LF) in usernames.
"This attack is particularly interesting in a scenario where you can reach an (unrestricted, maybe not even spam- or malware-filtering) internal mail server from the machine doing the XML parsing," Alexander concluded.

Java/Python FTP Injections Allow to Bypass Firewall

 However, two days later in a separate security advisory, security researcher Timothy Morgan from Blindspot Security came forward with his findings, showing more threatening exploitation scenario where the FTP URL handlers in both Java and Python can be used to bypass firewalls.


Morgan said such FTP protocol injection flaw could be used to trick a victim's firewall into accepting TCP connections from the web to the vulnerable host's system on its "high" ports (from 1024 to 65535).

Besides the FTP protocol injection attack, there's reside a decade old security issue in FTP protocol called classic mode FTP – an insecure mechanism of client-server FTP interactions, but many firewall vendors still support it by default.

When a classic mode FTP connection is initiated, the firewall temporarily opens a port – typically between 1024 and 65535 – specified in the PORT command, which introduces security risks.

Using the FTP protocol injection issue in Java and Python, an attacker who knows the targeted host’s internal IP address can start a classic mode FTP connection, which attackers can use for nefarious purposes.

Morgan has determined that an attacker can open up one port in the targeted firewall with only three requests:
  1. Identify the victim's internal IP address – this requires an attacker to "send an URL, see how the client behaves, then try another until the attack is successful."
  2. Determine packet alignment and ensure that the PORT command is injected at the right moment, making the attack work.
  3. Exploit the vulnerability.

Each additional request can be used to open up another TCP port.


Easily Exploitable Protocol Injection Flaw


However, the researcher warned that his exploit could be used for man-in-the-middle (MitM) attacks, server-side request forgery (SSRF), an XEE attack and more – and once bypassed the firewall, desktop hosts can be attacked even if they do not have Java installed.

All an attacker need is to convince victims into accessing a malicious Java or Python applications installed on a server to bypass the entire firewall.
"If a desktop user could be convinced to visit a malicious website while Java is installed, even if Java applets are disabled, they could still trigger Java Web Start to parse a JNLP (Java Network Launch Protocol) file," Morgan said. "These files could contain malicious FTP URLs which trigger this bug."
"Also note, that since Java parses JNLP files before presenting the user with any security warnings, the attack can be entirely successful without any indication to the user (unless the browser itself warns the user about Java Web Start being launched)."
According to Morgan, a nearly identical flaw also exists in Python's urllib2 and urllib libraries, although "this injection appears to be limited to attacks via directory names specified in the URL."


Protocol Injection Flaw Is Still Unpatched


Morgan said the FTP protocol injection flaw was reported to the Python team in January 2016 and Oracle in November 2016 by his company, but neither of the two has issued any update to address the issue.

Morgan has developed a proof-of-concept (PoC) exploit but is currently holding back publication of his exploit until Oracle and Python respond to the disclosure and release patches.

The Morgan's exploit has successfully been tested against Palo Alto Networks and Cisco ASA firewalls, though researchers believe many commercial firewalls are also vulnerable to FTP stream injection attacks.

So until patches become available, Morgan suggests users uninstall Java on their desktops and in browsers, as well as disable support for "classic mode" FTP on all firewalls.

Monday, February 20, 2017

Windows wins the desktop, but Linux takes the world By Steve Ranger

http://www.zdnet.com/article/windows-wins-the-desktop-but-linux-takes-the-world/

The city with the highest-profile Linux desktop projects is turning back to Windows, but the fate of Linux isn't tied to the PC anymore.

After a nearly decade-long project to move away from Windows onto Linux, Munich has all but decided on a dramatic u-turn. It's likely that, by 2021, the city council will start to replace PCs running LiMux (its custom version of Ubuntu) with Windows 10.
Going back maybe 15 or 20 years, it was seriously debated as to when Linux would overtake Windows on the desktop. When Ubuntu was created in 2004, for example, it was with the specific intention of replacing Windows as the standard desktop operating system.
Spoiler: it didn't happen.
Linux on the desktop has about a two percent market share today and is viewed by many as complicated and obscure. Meanwhile, Windows sails on serenely, currently running on 90 percent of PCs in use. There will likely always be a few Linux desktops around in business -- particularly for developers or data scientists.
But it's never going to be mainstream.
There has been lots of interest in Munich's Linux project because it's one of the biggest around. Few large organizations have switched from Windows to Linux, although there are some others, like the French Gendarmerie and the city of Turin. But Munich was the poster child: losing it as a case study will undoubtedly be a blow to those still championing Linux on the desktop.
But the reality is that most companies are happy to go with the dominant desktop OS, given all of the advantages around integration and familiarity that come with it.
It's not entirely clear how much of the problems that some staff have complained about are down to the LiMux software and how much the operating system is being blamed for unrelated issues. But whatever Munich finally decides to do, Linux's fate is not going to be decided on the desktop -- Linux lost the desktop war years ago.
That's probably OK because Linux won the smartphone war and is doing pretty well on the cloud and Internet of Things battlefields too.
There's a four-in-five chance that there's a Linux-powered smartphone in your pocket (Android is based on the Linux kernel) and plenty of IoT devices are Linux-powered too, even if you don't necessarily notice it.
Devices like the Raspberry Pi, running a vast array of different flavours of Linux, are creating an enthusiastic community of makers and giving startups a low-cost way to power new types of devices.
Much of the public cloud is running on Linux in one form or another, too; even Microsoft has warmed up to open-source software. Regardless of your views about one software platform or another, having a rich set of options for developers and users is good for choice and good for innovation.
The dominance of the desktop is not what it once was: it's now just one computing platform among many. Indeed, the software on the PC becomes less and less relevant as more apps become device- and OS-independent, residing in the cloud instead.
The twists and turns of the Munich saga and the adventures of Linux on the desktop are fascinating, but they don't tell the full story.

Wednesday, January 25, 2017

Monday, January 23, 2017

Five Tools for Beginners that Power Up the Command Line by Thorin Klosowski

http://lifehacker.com/five-tools-for-beginners-that-power-up-the-command-line-1791515136


Whether you’re a seasoned veteran or a command line noob, there’s no way you remember every command, manual page, or tooltip. Lucky for you, we have some tools to make the command line less intimidating to newcomers that also help old timers remember what to do in a number of common circumstances. 


  1. Homebrew Makes Installing Apps on Mac Way Easier
  2. Mac-Cli and Climate Simplify Your Most Used Commands
  3. Cheat Shortens Manual Pages with Plain English Instructions
  4. Howdoi Hunts Down Answers to Common Questions
  5. The Fuck Corrects Your Last Console Command


Friday, April 15, 2016

Man 'deletes his whole company' after typing wrong bit of code by Chris Graham

http://www.independent.ie/business/technology/man-deletes-his-whole-company-after-typing-wrong-bit-of-code-34629615.html

Hosting provider Marco Marsala accidentally deleted his company after typing in a line of bad code.

15/04/2016
If ever there was a time you wish you could click 'undo', this would be it.

But while most people are often rescued by the quick 'control+z' command - seeing their entire document return to the screen after inadvertently deleting it all - there was no such saving grace for Marco Marsala.
The hosting provider wrote on help forum Server Fault that he had accidentally entered a code that seemed to have wiped his computers, including the websites of his customers. 
The command, "rm -rf", deletes everything it is told to and blocks the helpful warnings that usually inform the user that something is being deleted. In this case, because he hadn't specified what he wanted deleted, it erased everything.
“I run a small hosting provider with more or less 1,535 customers and I use Ansible to automate some operations to be run on all servers,” wrote Marco Marsala.
“Last night I accidentally ran, on all servers, a Bash script with a rm -rf {foo}/{bar} with those variables undefined due to a bug in the code above this line.
“All servers got deleted and the offsite backups too because the remote storage was mounted just before by the same script (that is a backup maintenance script).”
The response from the forum was far from positive.
“If you really don't have any backups I am sorry to say but you just nuked your entire company”
"If you really don't have any backups, I am sorry to say but you just nuked your entire company," wrote Andre Borie.
Another, Michael Hampton, said: "You're going out of business. You don't need technical advice, you need to call your lawyer."
One respondent pointed out - rather unhelpfully - that Mr Marsala should have kept the backup separate from everything else.
"Backups need to be offsite, offline, and incremental," said Tim. "That you could delete them from your main server means they weren't what I would call backups."


UPDATE: Marco Marsala's post on Server Fault:
http://serverfault.com/questions/769357/recovering-from-a-rm-rf

UPDATE: That man who ‘deleted his entire company’ with a line of code? It was a hoax:
http://www.pcworld.com/article/3057235/data-center-cloud/that-man-who-deleted-his-entire-company-with-a-line-of-code-it-was-a-hoax.html

Monday, March 7, 2016

Microsoft brings SQL Server to Linux by Mark Wilson


The new Microsoft has placed an increased importance on the cloud, and with other companies following suit, reliance on server solutions has increased.  Today the company announces that it is bringing SQL Server to Linux.
Both cloud and on-premises versions will be available, and the news has been welcomed by the likes of Red Hat and Canonical. Although the Linux port of SQL Server is not due to make an appearance until the middle of next year, a private preview version is being made available to testers from today.
Microsoft's increasing embrace of Linux sees the company expanding to a wider audience than ever. Al Gillen, group vice president, enterprise infrastructure, at IDC says that it shows Microsoft's "commitment to being a cross platform solution provider".
Writing on the Official Microsoft blog, Executive Vice President of Cloud and Enterprise Group at Microsoft, Scott Guthrie says:
  • Today I’m excited to announce our plans to bring SQL Server to Linux as well. This will enable SQL Server to deliver a consistent data platform across Windows Server and Linux, as well as on-premises and cloud. We are bringing the core relational database capabilities to preview today, and are targeting availability in mid-2017.
  • SQL Server on Linux will provide customers with even more flexibility in their data solution. One with mission-critical performance, industry-leading TCO, best-in-class security, and hybrid cloud innovations -- like Stretch Database which lets customers access their data on-premises and in the cloud whenever they want at low cost -- all built in.

Microsoft has not yet made clear exactly what other features of SQL Server 2016 will make their way to SQL Server for Linux, but more news is expected over the coming weeks and months.
Paul Cormier, President, Products and Technologies, Red Hat said, "SQL Server's proven enterprise experience and capabilities offer a valuable asset to enterprise Linux customers around the world." He continued:
  • We believe our customers will welcome this news and are happy to see Microsoft further increasing its investment in Linux. As we build upon our deep hybrid cloud partnership, spanning not only Linux, but also middleware, and PaaS, we’re excited to now extend that collaboration to SQL Server on Red Hat Enterprise Linux, bringing enterprise customers increased database choice.

While the full launch of SQL Server for Linux is not due until the middle of 2017, SQL Server 2016 is expected to launch later this year.

Tuesday, February 2, 2016

Windows 10 Passes Windows XP In Market Share




Windows 10 Passes Windows XP In Market Share


An anonymous reader writes:Six months after its release, Windows 10 has finally passed 10 percent market share. Not only that, but the latest and greatest version from Microsoft has also overtaken Windows 8.1 and Windows XP, according to the latest figures from Net Applications. Windows 10 had 9.96 percent market share in December, and gained 1.89 percentage points to hit 11.85 percent in January.Maybe it will jump even faster soon, but not necessarily for the best of reasons.

Saturday, January 30, 2016

Privacy-Centric Linux Distro Tails Hits 2.0 Release

http://linux.slashdot.org/story/16/01/29/159219/privacy-centric-linux-distro-tails-hits-20-release?utm_source=feedly1.0mainlinkanon&utm_medium=feed






Privacy-Centric Linux Distro Tails Hits 2.0 Release38


A_Mythago writes:The Amnesic Incognito Live System (Tails) has finalized version 2.0, which has several improvements and updates to continue to meet their mission of preserving privacy, anonymity and circumventing censorship without a trace, using a Debian 8.0 custom live distro. More details about Edward Snowden's use of Tails and the distro itself can be found at a previous Slashdot story from 2014.

Windows Phone is dead by Tom Warren

http://www.theverge.com/2016/1/28/10864034/windows-phone-is-dead


Windows Phone started off life as a promising alternative to Android and iOS five years ago. Microsoft positioned its range of Windows Phone 7 handsets as the true third mobile ecosystem, but it's time to admit it has failed. If a lack of devices from phone makers and even Microsoft itself wasn't enough evidence, the final nail in the coffin hit today. Microsoft only sold 4.5 million Lumia devices in the recent quarter, compared to 10.5 million at the same time last year. That's a massive 57 percent drop. Even a 57 percent increase wouldn't be enough to save Windows Phone right now.
Microsoft and Nokia have sold a total of 110 million Windows Phones compared to 4.5 billion iOS and Android phones in the same period. IDC recently reported that 400 million phones were sold in the recent quarter, meaning just 1.1 percent of them were Lumia Windows Phones. Microsoft does not have any compelling Lumia handsets, and the Lumia 950 and Lumia 950 XL were both disappointing flagship devices with unfinished Windows 10 Mobile software.

With Lumia sales on the decline and Microsoft's plan to not produce a large amount of handsets, it's clear we're witnessing the end of Windows Phone. Rumors suggest Microsoft is developing a Surface Phone, but it has to make it to the market first. Windows Phone has long been in decline and its app situation is only getting worse. With a lack of hardware, lack of sales, and less than 2 percent market share, it's time to call it: Windows Phone is dead. Real Windows on phones might become a thing with Continuum eventually, but Windows Phone as we know it is done. It won't stop Microsoft producing a few handsets every year as a vanity project, but for everyone else it's the end of the line. Farewell, Windows Phone.

Sunday, January 24, 2016

Hot Potato Exploit Gives Attackers the Upper Hand in Multiple Windows Versions by Catalin Cimpanu



By chaining together a series of known Windows security flaws, researchers from Foxglove Security have discovered a way to break into almost all of Microsoft's recent versions of Windows.
The exploit, named Hot Potato, relies on three different types of attacks, some of which were discovered back at the start of the new millennium, in 2000.
All of these security flaws have been left unpatched by Microsoft, with the explanation that by patching them, the company would effectively break compatibility between the different versions of their operating system.

Hot Potato is made up of three different exploits

The three security problems that form the Hot Potato exploit are a local NBNS (NetBIOS Name Service) spoofing technique that's 100% effective, a flaw which allows attackers to set up fake WPAD (Web Proxy Auto-Discovery Protocol) proxy servers, and an attack against the Windows NTLM (NT LAN Manager) authentication protocol.
Going through these exploits one by one may take attackers from minutes to days, but if successful, the attacker can elevate an application's permissions from the lowest rank to system-level privileges, the Windows analog for a Linux/Android root user's permissions.
Foxglove researchers created their exploit on top of a proof-of-concept code released by Google's Project Zero team in 2014 and have presented their findings at the ShmooCon security conference over the past weekend. They've even posted their exploit code onGitHub.

Hot Potato can be used against multiple Windows versions

Additionally, some proof-of-concept videos were also uploaded on YouTube, and you can see the researchers break Windows versions such as 7, 8, 10, Server 2008 and Server 2012.
Researchers say that enabling "Extended Protection for Authentication" in Windows should stop the last stage of their exploit, the NTLM relay attack.
Using SMB (Server Message Block) signing may theoretically block the attack, but they have not properly investigated this mitigation technique.

Monday, April 6, 2015

10 Years of Git: An Interview with Git Creator Linus Torvalds by Jennifer Cloer



Ten years ago this week, the Linux kernel community faced a daunting challenge: They could no longer use their revision control system BitKeeper and no other Software Configuration Management (SCMs) met their needs for a distributed system. Linus Torvalds, the creator of Linux, took the challenge into his own hands and disappeared over the weekend to emerge the following week with Git. Today Git is used for thousands of projects and has ushered in a new level of social coding among programmers.
To celebrate this milestone, we asked Linus to share the behind-the-scenes story of Git and tell us what he thinks of the project and its impact on software development. You'll find his comments in the story below. We'll follow this Q&A with a week of Git in which we profile a different project each day that is using the revision control system. Look for the stories behind KVM, Qt, Drupal, Puppet and Wine, among others. 
Why did you create Git?
Torvalds: I really never wanted to do source control management at all and felt that it was just about the least interesting thing in the computing world (with the possible exception of databases ;^), and I hated all SCM's with a passion. But then BitKeeper came along and really changed the way I viewed source control. BK got most things right and having a local copy of the repository and distributed merging was a big deal. The big thing about distributed source control is that it makes one of the main issues with SCM's go away - the politics around "who can make changes." BK showed that you can avoid that by just giving everybody their own source repository. But BK had its own problems, too; there were a few technical choices that caused problems (renames were painful), but the biggest downside was the fact that since it wasn't open source, there was a lot of people who didn't want to use it. So while we ended up having several core maintainers use BK - it was free to use for open source projects - it never got ubiquitous. So it helped kernel development, but there were still pain points.
That then came to a head when Tridge (Andrew Tridgell) started reverse-engineering the (fairly simply) BK protocol, which was against the usage rules for BK. I spent a few weeks (months? It felt that way) trying to mediate between Tridge and Larry McVoy, but in the end it clearly wasn't working. So at some point I decided that I can't continue using BK, but that I really didn't want to go back to the bad old pre-BK days. Sadly, at the time, while there were some other SCM's that kind of tried to get the whole distributed thing, none of them did it remotely well.  I had performance requirements that were not even remotely satisfied by what was available, and I also worried about integrity of the code and the whole workflow, so I ended up just deciding to write my own.
How did you approach it? Did you stay up all weekend to write it or was it just during regular hours?
Torvalds: Heh. You can actually see how it all took shape in the git source code repository, except for the very first day or so. It took about a day to get to be "self-hosting" so that I could start committing things into git using git itself, so the first day or so is hidden, but everything else is there. The work was clearly mostly during the day, but there's a few midnight entries and a couple of 2 a.m. ones. The most interesting part is how quickly it took shape ; the very first commit in the git tree is not a lot of code, but it already did the basics - enough to commit itself. The trick wasn't really so much the coding but coming up with how it organizes the data.
So I'd like to stress that while it really came together in just about ten days or so (at which point I did my first *kernel* commit using git), it wasn't like it was some kind of mad dash of coding. The actual amount of that early code is actually fairly small, it all depended on getting the basic ideas right. And that I had been mulling over for a while before the whole project started. I'd seen the problems others had. I'd seen what I wanted to avoid doing. 
Has it lived up to your expectations? How is it working today in your estimation? Are there any limitations?
Torvalds: I'm very happy with git. It works remarkably well for the kernel and is still meeting all my expectations. What I find interesting is how it took over so many other projects, too. Surprisingly quickly, in the end. There is a lot of inertia in switching source control systems;  just look at how long CVS and even RCS have stayed around, but at some point git just took over.
Why do you think it's been so widely adopted?
Torvalds: I think that many others had been frustrated by all the same issues that made me hate SCM's, and while there have been many projects that tried to fix one or two small corner cases that drove people wild, there really hadn't been anything like git that really ended up taking on the big problems head on. Even when people don't realize how important that "distributed" part was (and a lot of people were fighting it), once they figure out that it allows those easy and reliable backups, and allows people to make their own private test repositories without having to worry about the politics of having write access to some central repository, they'll never go back.
Does Git last forever, or do you foresee another revision control system in another 10 years? Will you be the one to write it? 
Torvalds: I'm not going to be the one writing it, no. And maybe we'll see something new in ten years, but I guarantee that it will be pretty "git-like." It's not like git got everything right, but it got all the really basic issues right in a way that no other SCM had ever done before.
No false modesty ;)
Why does Git work so well for Linux?
Torvalds: Well, it was obviously designed for our workflow, so that is part of it. I've already mentioned the whole "distributed" part many times, but it bears repeating. But it was also designed to be efficient enough for a biggish project like Linux, and it was designed to do things that people considered "hard" before git - because those are the things *I* do every day.
Just to pick an example: the concept of "merging" was generally considered to be something really quite painful and hard in most SCM's. You'd plan your merges, because they were big deals. That's not acceptable to me, since I commonly do tens of merges a day when in the merge window, and even then, the biggest overhead shouldn't be the merge itself, it should be testing the result. The "git" part of the merge is just a couple of seconds, it should take me much longer just to write the merge explanation message.
So git was basically designed and written for my requirements, and it shows.
People have said that Git is only for super smart people. Even Andrew Morton said Git is "expressly designed to make you feel less intelligent than you thought you were." What's your response to this?
Torvalds: So I think it used to be true but isn't any more. There is a few reasons people feel that way, but I think only one of them remains. The one that remains is fairly simple: "you can do things so many ways."
You can do a lot of things with git, and many of the rules of what you *should* do are not so much technical limitations but are about what works well when working together with other people. So git is a very powerful set of tools, and that can not only be overwhelming at first, it also means that you can often do the same (or similar) things different ways, and they all "work." Generally, the best way to learn git is probably to first only do very basic things and not even look at some of the things you can do until you are familiar and confident about the basics.
There's a few historical reasons for why git was considered complicated. One of them is that it wascomplicated. The people who started using git very early on in order to work on the kernel really had to learn a very rough set of scripts to make everything work. All the effort had been on making the core technology work and very little on making it easy or obvious. So git (deservedly) had a reputation for requiring you to know exactly what you did early on. But that was mainly true for the first 6 months or a year.
The other big reason people thought git was hard is that git is very different. There are people who used things like CVS for a decade or two, and git is not CVS. Not even close. The concepts are different. The commands are different. Git never even really tried to look like CVS, quite the reverse. And if you've used a CVS-like system for a long time, that makes git appear complicated and needlessly different. People were put off by the odd revision numbers. Why is a git revision not "1.3.1" with nice incrementing numbers like it was in CVS? Why is it that odd scary 40-character HEX number?
But git wasn't "needlessly different." The differences are required. It's just that it made some people really think it was more complicated than it is, because they came from a very different background. The "CVS background" thing is going away. By now there are probably lots of programmers out there who have never used CVS in their lives and would find the CVS way of doing things very confusing, because they learned git first.
Do you think the rate of Linux kernel development would have been able to grow at its current rate without Git? Why or why not?
Torvalds: Well, "without git," sure. But it would have required that somebody else wrote something git-equivalent: a distributed SCM that is as efficient as git is. We definitely needed something *like* git.
What's your latest opinion of GitHub?
Torvalds: Github is an excellent hosting service; I have nothing against it at all. Now, the complaints I've had is that GitHub as a development platform - making commits, pull requests, keeping track of issues etc - doesn't work very well at all. It's not even close, not for something like the kernel. It's much too limited.
That's partly because of how the kernel is developed, but part of it was that the GitHub interfaces were actively encouraging bad behavior. Commits done on GitHub had bad commit messages etc, because the web interfaces at GitHub were actively encouraging bad behavior. They did fix some of that, so it probably works better, but it will never be appropriate for something like the Linux kernel.
What is the most interesting use you've seen for Git and/or GitHub?
Torvalds: I'm just happy that it made it so easy to start a new project. Project hosting used to be painful, and with git and GitHub it's just so trivial to do a random small project. It doesn't matter what the project is; what matters is that you can do it.
Do you have side projects up your sleeve today? Any more brilliant software projects that will dominate software development for years to come?
Torvalds: Nothing planned. But I'll let you know if that changes.

Great Git Interactive Infographic: