Apple suffers 'major iPhone X leak'

Found on BBC News on Monday, 11 September 2017
Browse Software

"As best I've been able to ascertain, these builds were available to download by anyone, but they were obscured by long, unguessable URLs [web addresses]," wrote John Gruber, a blogger known for his coverage of Apple.

One company watcher said that the scale of the leak meant Tuesday's launch had lost some of its power to surprise.

So Apple is incompetent enough to protect the core of its business with something as simple as a password? Not to mention it could have kept the software in an internal network only. It sounds like a leak, but is has the smell of being "a leak" (as in, planned).

Software to capture votes in upcoming national election is insecure

Found on Chaos Computer Club on Thursday, 07 September 2017
Browse Software

The Chaos Computer Club is publishing an analysis of software used for tabulating the German parliamentary elections (Bundestagswahl). The analysis shows a host of problems and security holes, to an extent where public trust in the correct tabulation of votes is at stake.

„Elementary principles of IT-security were not heeded to. The amount of vulnerabilities and their severity exceeded our worst expectations“, says Linus Neumann, a speaker for the CCC that was involved in the study.

„A whole chain of serious flaws, from the update server, via the software itself through to the election results to be exported allows for us to demonstrate three practical attack scenarios in one“, Neumann continues.

At the same time politicians stand in front of cameras, talk about IoT, Industry 4.0 and the importance of crypto and security. What an irony.

ReactOS 0.4.6 Released

Found on Slashdot on Monday, 04 September 2017
Browse Software

0.4.6 is a major step towards real hardware support. Several dual boot issues have been fixed and now partitions are managed in a safer way avoiding corruption of the partition list structures.

General notes, tests, and changelog for the release can be found at their respective links. A less technical community changelog for ReactOS 0.4.6 is also available.

It's a very impressive project, even though the progress is slow.

Node.js Forked Again Over Complaints of Unresponsive Leadership

Found on The New Stack on Thursday, 24 August 2017
Browse Software

The codebase for popular Node.js JavaScript runtime has been forked again — the second time in less than three years — with a growing number of contributors charging that the Technical Steering Committee (TSC) leadership is ignoring repeated violations of the project’s code of conduct.

On August 21, The TSC voted on whether or not to remove Vagg from its ranks. Of the 10 TSC members who voted, 60 percent voted against removing Rod from the TSC and 60 percent voted against asking Rod to voluntarily resign.

So only four members voted for the removal of Vagg. If you count in those who did not vote, only 30% supported the request. Sounds like a democratic vote where the outcome did not please those who lost, so now they step onto a soapbox. That shows a bad understanding and a lack of respect for democractic processes. The irony is that their own CoC requires treating people with respect and prohibits unprofessional behavior.

What Happened To Winamp?

Found on Slashdot on Sunday, 20 August 2017
Browse Software

Winamp was released more than 20 years ago, and last week marked the 15th anniversary of the release of Winamp3.

Radionomy's Winamp page is still showing download links -- though they now lead instead to a forum post which says "code licensed to the previous owner" is being removed or replaced.

Winamp just works. Granted, there are some missing features, but then there are also plugins. It's meant to be a player for mp3 music, and it plays mp3 music. That's about it.

The Docx games: three days at the Microsoft Office World Championship

Found on The Verge on Wednesday, 16 August 2017
Browse Software

This allows the certified to confirm the line on their resume that claims “proficiency in MS Office” is backed up by some solid knowledge of deep formatting and presentation design.

"I have participated in many zumbathons," he said, "I have danced onstage. I love Zumba because it brings color to my life." But when he won the national competition in Excel, he said, "It instantly created a more happy life for me."

Everyone settled down as the awards announcements began, starting with third place in Word 2013. As each winner was named, their delegations and new friends erupted with cheers and applause, each kid fighting their way to the stage with out-of-control energy.

Microsoft Office Championship? Yes, really, a Microsoft Office Championship; it doesn't seem to be a hoax, even if you hoped it would be.

ESET Spreading FUD About Torrent Files, Clients

Found on Slashdot on Saturday, 05 August 2017
Browse Software

Like all such attempts at FUD, his treatise ended with a claim that ESET was the one true source whereby users could obtain "knowledge" to protect themselves.

Kubovic then used the old furphy which is resorted to by those who lobby on behalf of the copyright industry -- torrents are mostly illegal files and downloading them is Not The Right Thing To Do. But then he failed to mention that hundreds of thousands of perfectly legitimate files are also offered as torrents -- for instance, this writer regularly downloads images of various GNU/Linux distributions using a BitTorrent client because it is the more community-friendly thing to do, rather than using a direct HTTP link and hogging all the bandwidth available.

Letting such "experts" do PR work will backfire hard, especially when they come up with arguments like that.

Linux kernel hardeners Grsecurity sue open source's Bruce Perens

Found on The Register on Thursday, 03 August 2017
Browse Software

It offers its GPLv2 licensed software through a subscription agreement. The agreement says that customers who redistribute the code – a right under the GPLv2 license – will no longer be customers and will lose the right to distribute subsequent versions of the software.

As the GPLv2 license states, "You may not impose any further restrictions on the recipients' exercise of the rights granted herein."

There's a solution for GrSec: write your own kernel. If they are not happy with the license, they don't have to use the product.

Systemd wins top gong for 'lamest vendor' in Pwnie security awards

Found on The Register on Friday, 28 July 2017
Browse Software

The award for best server-side bug went to the NSA's Equation Group, whose Windows SMB exploits were stolen and leaked online this year by the Shadow Brokers.

The epic 0wnage award was split between North Korea and Russia for launching the WannaCry ransomware contagion and masterminding the Shadow Brokers, respectively.

Australian prime minister Malcom Turnbull earned an award for the most epic fail for insisting the laws of Australia trump the laws of mathematics.

And finally, the lamest vendor response award went to Systemd supremo Lennart Poettering for his controversial, and perhaps questionable, handling of the following bugs in everyone's favorite init replacement.

Poettering shound finally fork off his PoetterOS and let the Linux community have a real Init system that sticks to the classic UNIX principles of keeping things simple and robust.

Where’s all my CPU and memory gone? The answer: Slack

Found on Medium on Thursday, 27 July 2017
Browse Software

CPU and memory usage increases linearly as you add more accounts to your Slack desktop client. As a result, I believe the growing trend to use Slack to be part of multiple communities is seriously flawed until Slack resolve this problem.

What a total waste of resources for an overhyped fancy IRC client used by hipsters.