What the fdisk? Storage Spaces Direct just vanished from Windows Server in version 1709

Found on The Register on Wednesday, 18 October 2017
Browse Software

Support for Storage Spaces Direct, Microsoft's version of VSAN, has been stripped from the latest build of Windows Server 2016, version 1709, which was released on Tuesday.

Storage Spaces Direct, as the name suggests, handles direct-attached SAS, SATA or SSD drives.

So much for relying on Microsoft for not removing components you had before.

Adobe patches Flash bug used for planting spying tools

Found on BBC News on Tuesday, 17 October 2017
Browse Software

They found that the attacker - thought to be a group called BlackOasis - was targeting the governments of various countries who are members of the United Nations, as well as oil and gas companies in several regions.

"The creator of the tool is a UK company, and then it is used to spy on British targets. I just find the whole concept a bit worrying."

It's more worrying that people still have that collection of security holes installed.

How the KRACK attack destroys nearly all Wi-Fi security

Found on Ars Technica on Monday, 16 October 2017
Browse Software

The research is built upon previous explorations of weaknesses in WPA2's component protocols, and some of the attacks mentioned in the paper were previously acknowledged to be theoretically possible. However, the authors have turned these vulnerabilities into proof-of-concept code, "and found that every Wi-Fi device is vulnerable to some variant of our attacks. Notably, our attack is exceptionally devastating against Android 6.0: it forces the client into using a predictable all-zero encryption key."

Sometimes it's just surprising how suddenly giant bugs are found in wide-spread protocols that have been in use for years. It's almost like nobody bothered to look at the details before.

Secure coding in Java: Bad online advice and confusing APIs

Found on Help Net Security on Saturday, 07 October 2017
Browse Software

A group of Virginia Tech researchers has analyzed hundreds of posts on Stack Overflow, a popular developer forum/Q&A site, and found that many of the developers who offer answers do not appear to understand the security implications of coding options, showing a lack of cybersecurity training.

“These poor coding practices, if used in production code, will seriously compromise the security of software products,” the researchers pointed out.

There are a bunch of people who think they know how to write code because they are able to copy&paste snippets together. Nobody knows everything, but if you blindly use code in your project which someone else posted on an online board, without actually understanding it, you deserve every single problem you get.

Watch out Windows, Android, and iOS: Amazon's Alexa is turning into the next big operating system

Found on ZDNet on Sunday, 01 October 2017
Browse Software

Since then Amazon has rapidly added to its hardware portfolio, and what's clear is that the company is trying to make sure that its hardware and services are at every fundamental touch-point in the home; the new Echo Spot is going to replace your alarm clock, for example.

The Alexa 'routines' feature will be able to tie all of this together by allowing you to automate a series of actions with a single voice command: saying "Alexa, good night," and having it turn off the lights, lock the door, and turn off the TV, for example.

Amazon announced a deal to make Alexa available in BMW and Mini vehicles from the middle of next year, allowing drivers to use the digital assistant to get directions, play music or control smart home devices while travelling, without having to use a separate app.

Why would somebody want having devices around which constantly listen to everything you say and send it back to a company for evaluation? That's big brother at its finest. It might be interesting if it would work without being online, but until then such spy devices are better kept outside your home and car.

Firefox takes a Quantum leap forward with new developer edition

Found on Ars Technica on Tuesday, 26 September 2017
Browse Software

Mozilla has developed a new CSS engine, Stylo, that parses CSS files, applies the styling rules to elements on the page, and calculates object sizes and positions. There is also a new rendering engine, WebRender, that uses the GPU to draw the (styled) elements of the page. Compositor combines the individual rendered elements and builds them into a complete page, while Quantum DOM changes how JavaScript runs, especially in background tabs.

Next year, for example, Mozilla will do further work on the browser's sandboxing implementation, incorporating elements from the Chromium project to further restrict its sandbox processes.

Now if Mozilla would not kill support for the majority of extensions, people might actually care.

Facebook U-turn: React, other libraries freed from unloved patent license

Found on The Register on Saturday, 23 September 2017
Browse Software

Wolff said while Facebook continues to believe its BSD + Patents license has benefits, "we acknowledge that we failed to decisively convince this community."

Wolff said Facebook considered a license change for its other open-source projects, but wasn't ready to commit to anything. Some projects, he said, will keep the BSD + Patents license.

It has benefits, but only for Facebook. At least FB is giving in under the growing pressure coming from some of the big players on the market.

Microsoft: Windows getting more stable, faster, and lasting longer on battery

Found on Ars Technica on Thursday, 21 September 2017
Browse Software

The Anniversary Update was rapidly deployed, and it hit a number of issues soon after launch, causing problems for both consumers and enterprise users alike.

The Fall Creators Update will give enterprises a little more control over which telemetry data is collected, but a built-in way to disable telemetry collection entirely remains out of reach for regular consumers.

What else should MS say? That the new updates make it buggier, slower and short-lived on battery? That's typical marketing talk, nothing else.

Hackers Hid Backdoor In CCleaner Security App With 2 Billion Downloads

Found on Forbes on Monday, 18 September 2017
Browse Software

Users of Avast-owned security application CCleaner for Windows have been advised to update their software immediately, after researchers discovered criminal hackers had installed a backdoor in the tool.

It's unclear just who was behind the attacks. Yung said the company wouldn't speculate on how the attack happened or possible perpetrators. For now, any concerned users should head to the Piriform website to download the latest software.

If the operating system itself would allow good cleanups, software like this would not even be needed.

WordPress to ditch React library over Facebook patent clause risk

Found on Techcrunch on Sunday, 17 September 2017
Browse Software

Mullenweg said his concerns have not been assuaged. And he writes that he cannot, in good conscience, require users of the very widely used open source WordPress software to inherit the patent clause and associated legal risk. So he’s made the decision to ditch React.

Companies, especially those with large patent portfolios, may well have concerns if they are using open source software which incorporates Facebook’s React framework — even if Automattic feels comfortable on its own account.

Some of the fiercest critics of the patent clause have dubbed React a “‘Trojan horse’ into the open source community”.

Sorry FB, that's not how open source works.