Apple iOS 11 security 'downgrade' decried as 'horror show'

Found on The Register on Friday, 01 December 2017
Browse Software

Oleg Afonin, a security researcher for password-cracking forensic IT biz Elcomsoft, in a blog post on Wednesday called iOS 11 "a horror story" due to changes the fruit-themed firm made to its mobile operating system that stripped away a stack of layered defenses.

"Once an intruder gains access to the user’s iPhone and knows (or recovers) the passcode, there is no single extra layer of protection left," Alfonin explains in his post. "Everything (and I mean, everything) is now completely exposed. Local backups, the keychain, iCloud lock, Apple account password, cloud backups and photos, passwords from the iCloud Keychain, call logs, location data, browsing history, browser tabs and even the user’s original Apple ID password are quickly exposed."

Perhaps it was done because users complained and it's more convenient if you only have to remember one passcode. You get convenience, you lost security.

Wondering why your internal .dev web app has stopped working?

Found on The Register on Thursday, 30 November 2017
Browse Software

Rather than connecting to private stuff on an internal .dev domain to pick up where they left off, a number of engineers and sysadmins are facing an error message in their web browser complaining it is "unable to provide a secure connection."

Chrome forces connections to all domains ending in .dev (as well as .foo) to use HTTPS via a HTTP Strict Transport Security (HSTS) header. This is part of Google's larger and welcome push for HTTPS to be used everywhere for greater security.

In another commit, Google renames Chrome to GTNB: Google's Nanny Telemetry Browser. Yes, security is important, but you don't mess with your user's setups. It's main use is on internal testing systems, and if you need the security of HTTPS on your Intranet, then your security problems are somewhere else, and much bigger than you thought.

HP stealthily installs new spyware called HP Touchpoint Analytics Client

Found on Computer World on Tuesday, 28 November 2017
Browse Software

Dubbed “HP Touchpoint Analytics Service,” HP says it “harvests telemetry information that is used by HP Touchpoint’s analytical services.” Apparently, it’s HP Touchpoint Analytics Client version 4.0.2.1435.

Martin Brinkmann on ghacks has a detailed accounting of the spyware and how to remove it. He gives step-by-step instructions for disabling the HP Touchpoint Analytics Client in your Services listing, as well as deleting the HP Touchpoint Manager.

Some never learn. After all that Microsoft stirred up with their unwanted telemetry services, HP does simply the same. Maybe we really need a simple law that makes it illegal to collect data unless the user gets informed about every single detail of the collected data, and what it is used for; and of course, there has to be an opt-out option that must not be opted-in with a later update.

End of an open source era: Linux pioneer Munich confirms switch to Windows 10

Found on TechRepublic on Friday, 24 November 2017
Browse Software

Now Munich will begin rolling out a Windows 10 client from 2020, at a cost of about €50m, with a view to Windows replacing LiMux across the council by early 2023.

Nevertheless, despite Munich running both systems side-by-side for more than a decade, today the council says this dual-system setup is unsustainable, hence the need to return to Windows.

While staff have reported intermittent problems with IT at the council, past surveys have found only a minority of staff wanted to return to Windows and Microsoft Office.

Running two entirely different operating systems side by side is arguably not a performance booster; but they could as well finish the job they started and ditch MS completely. They had 10 years to put pressure on developers to produce cross platform versions of their software. In the end however, it looks like the party with the deeper pockets for lobbying work won.

New Firefox Runs Like a Rabbit

Found on Technewsworld on Saturday, 18 November 2017
Browse Software

"We have a better balance of memory to performance than all the other browsers," said Firefox Vice President for Product Nick Nguyen.

"A significant number of our users are on machines that are two cores or less, and less than 4 gigabytes of RAM," Nguyen explained.

So these days it is a big improvement that a
    browser
now works better on machines with less than dual-cores and 4GB RAM? It is still bloatware; and yes, that applies to lots of other software too. At some point in the past, their developers dropped the "let's be efficient" mantra and switched to "let's use up everything we can".

EA ditches microtransactions in Star Wars Battlefront II

Found on CNet News on Thursday, 16 November 2017
Browse Software

Electronic Arts has announced it is turning off all in-game purchases on Star Wars Battlefront II, on the eve of the game's worldwide launch, after a massive outcry from fans.

Early players soon discovered unlocking top hero characters like Luke Skywalker or Darth Vader could take up to 40 hours, unless players paid-to-play.

But when payments become a major impediment to gameplay, or a game becomes virtually unplayable without forking out cash, gamers are quick to speak up.

In other words, it's a paid way to cheat on those players who invest their time.

Firefox Quantum arrives with faster browser engine, major visual overhaul, and Google as default search engine

Found on Venture Beat on Tuesday, 14 November 2017
Browse Software

The new version, which Mozilla calls “by far the biggest update since Firefox 1.0 in 2004,” brings massive performance improvements and a visual redesign.

The goal is to make Firefox the fastest and smoothest browser for PCs and mobile devices — the company has previously promised that users can expect “some big jumps in capability and performance” through the end of the year.

Well the Mozilla Team will at some point need to listen to its userbase instead of introducing changes to the UI or killing lots of extensions (granted that was announced, but some extentions cannot be ported to the new API). The cruel numbers however show that Firefox is following the same path Netscape went.

An Extremely Convincing WhatsApp Fake Was Downloaded More Than 1 Million Times From Google Play

Found on Fortune on Sunday, 05 November 2017
Browse Software

According to Hacker News, the fake WhatsApp was nearly indistinguishable from the real thing thanks to an invisible space placed at the end of the developer’s name.

A search for “WhatsApp” on Google Play currently shows no fewer than seven spoof apps using slight variations on the developer name “WhatsApp Inc.”, including versions with extra spaces, asterisks, or commas.

In prior incidents, security experts or unlucky users have encountered malware in compromised messaging apps, in a line of popular children’s games, and even in fake versions of Pokemon Go.

Why would you allow whitespace at the end of a string anyway? That's just bad input validation.

Hardware has never been better, but it isn't a licence for code bloat

Found on The Register on Thursday, 02 November 2017
Browse Software

My iPhone 6 recently upgraded itself to iOS 11. And guess what – it's become noticeably slower. This is no surprise, of course, as it's the same on every platform known to man. The new version is slower than the old.

I believe that one overriding reason for the latter is fairly simple: there's no longer a compulsion to write super-efficient code. These days we measure computer RAM in gigabytes, not kilobytes, and CPU clock speeds are in gigahertz, not megahertz. So back in the day you had to write code incredibly defensively if you were to make it work on the hideously constrained hardware available. Algorithms had to be elegant: processors were so slow that a brute-force algorithm just wasn't really an option, and with tiny amounts of RAM you had to be fastidious with data structures.

Just like pointed out yesterday: developers these days are spoiled by the hardware and should seriously start to think about becoming efficient again.

Denuvo’s DRM now being cracked within hours of release

Found on Ars Technica on Thursday, 19 October 2017
Browse Software

Those nearly instant Denuvo cracks follow summer releases like Sonic Mania, Tekken 7, and Prey, all of which saw DRM protection cracked within four to nine days of release.

If Denuvo can no longer provide even a single full day of protection from cracks, though, that protection is going to look a lot less valuable to publishers. But that doesn't mean Denuvo will stay effectively useless forever. The company has updated its DRM protection methods with a number of "variants" since its rollout in 2014, and chatter in the cracking community indicates a revamped "version 5" will launch any day now.

In the long run, DRM will always fail.