Windows 10 update panic: Older VMware Workstation Pro app broken

Found on The Register on Wednesday, 09 October 2019
Browse Software

In a thread on Microsoft's site, one affected user complained that upgrading their 100 VMware Workstation licences would cost €11,500.

There are other factors, though. A user trying to run the networking software GNS3 found that after upgrading, the software no longer worked. In addition, newer versions of VMware do not work on some older processors, so an upgrade is not always possible.

This is part of the Application Compatibility Framework which is able to patch applications on the fly as well as informing the user of compatibility issues. Some desperate users (not only in the VMware case) have tried replacing this file with an older version to get blocked applications to run.

Another Windows update, another fallout. Usually the updates are loaded with bugs that cause a wide range of unpleasant errors or even data-loss, but this time the block was intentional. Microsoft could just scan the system before borking it and notify users, giving them the option to decline the update; but in the new world, forced updates are mandatory even if they break your system.

Adobe shuts down Photoshop in Venezuela

Found on BBC News on Tuesday, 08 October 2019
Browse Software

Users have until 28 October to download content, after which accounts will be deactivated, Adobe said.

On a help page, the firm explained: "The US government issued executive order 13884, the practical effect of which is to prohibit almost all transactions and services between US companies, entities and individuals to Venezuela. To remain compliant with this order, Adobe is deactivating all accounts in Venezuela."

It said it "was unable to issue refunds" because the sanctions included "sales, service, support, refunds, credits, etc".

Adobe has moved to a subscription-only model for the latest versions of its products meaning users will not be able to buy standalone versions.

Welcome to the new world of failures. In the past you bought a software, installed it and could use it forever. Now when someone does not like you anymore, you just get cut off of what you paid for, left with empty hands and unable to continue your work. Think ahead a little next time you buy anything cloud-based.

Oracle demands $12K from network biz that doesn't use its software

Found on The Register on Friday, 04 October 2019
Browse Software

According to Palmer, while the IP addresses cited fall within Merula's assignment range, they're not all those used by the biz, which runs a virtual network for several other companies that control their own IP addresses. So those it does control aren't part of its core or hosting environment; rather they're used by customers on broadband connections.

"Although your organization might be an ISP however if your use is outside of your customer base beyond 30 days, payments are due to Oracle," the confusingly worded billing demand says.

"When companies use their legal department as a profit center it is highly indicative that the products they claim they are incorporated to provide are no longer competitive in the marketplace," he said.

Oracle must be aware that they are wrong here, but that has never stopped them from trying to squeeze money out of someone. They should just file a lawsuit and be laughed out of court.

The D in Systemd is for Directories: Poettering says his creation will phone /home in future

Found on The Register on Thursday, 26 September 2019
Browse Software

Systemd inventor Lennart Poettering told the crowds at the All Systems Go Linux user-space event in Berlin he intends to reinvent home directories to fix issues with the current model that are otherwise insoluble.

He is also much concerned with a security issue, which is that even when full-disk encryption is in use, when the system is suspended the decryption key is held in memory, so that if a laptop is stolen while suspended it would be possible to access the data.

A person at the session asked what should be done by a university student, for example, who wanted to log in to a Linux machine that was rebooted overnight from 200 miles away. The answer: "If you really want that this system can come up on its own, don't use this stuff. This is about security."

It's not about security, it's about Poettering stroking his little ego. If he seriously believes that the risk of accessing an in-memory in a suspended laptop justified messing up the entire /home ecosystem, then someone should tell him that anybody who really wants his decryption key will just beat him up hard until he tells them. It's just more and more of this cancer that is spreading through the system, going against Unix philosophy. Lennart really has to fork and create the "Poettering Operating System" or "POS" for short.

German ministry hellbent on taking back control of 'digital sovereignty', cutting dependency on Microsoft

Found on The Register on Saturday, 21 September 2019
Browse Software

In an official statement, the Federal Minister of the Interior Horst Seehofer states that “in order to ensure our digital sovereignty, we want to reduce dependencies on individual IT providers. We are also considering alternative programs to replace certain software. This will be done in close coordination with other EU countries.”

The analyst identifies several pain points ("Schmerzpunkten"). The first is data security. Telemetry transfers data to Microsoft, the user has limited insight and control over this, and it may contain personal data and therefore risk of breaching GDPR, the report suggests.

First Munich moves from Windows to Linux, then it moves back. It is important to mention that the migration not only saved millions of Euros, but also reduced support requests and in general was a success. However, after Microsoft promised to mayor Dieter Reiter (who calls himself a Microsoft fan) to move its headquarters to Munich, a rollback to Windows was announced. That, of course, costs the taxpayer tens of millions of Euros, even though most of the workers were satisfied with LiMux. All this makes it sound like a really nasty bribery affair.

Firefox will encrypt web domain name requests by default

Found on Engadget on Monday, 09 September 2019
Browse Software

Mozilla's Firefox privacy protections will soon include one of the most basic tasks for any web browser: fielding the domain name requests that help you visit websites. The developer will make DNS over encrypted HTTPS the default for the US starting in late September, locking down more of your web browsing without requiring an explicit toggle like before.

If all goes smoothly, Firefox may become a go-to option for anyone who insists on securing as much of their web traffic as possible.

So, in their infinite wisdom, Mozilla decided to mess with an perfectly fine core protocol of the Internet, making it harder for system admins to trace down problems and circumventing custom DNS settings which are used to effectively avoid malware and advertising domains. Even worse, they wrap DNS requests into HTTP, adding more layers to the transport of a basic request. To top it all, they have the gall to accounce it as a much needed solution for your privacy while sending all DNS requests to Cloudflare; totally ignoring the fact that DNS over TLS already exists and is working fine and even has its own RFC.

Over half the world is now running Windows 10

Found on The Inquirer on Tuesday, 03 September 2019
Browse Software

It has taken over four years and a hell of a lot of marketing, some good, some dodgy, but it's finally happened - Windows 10 now has over half the operating system market on desktop and laptop machines.

Most of those extra bums-on-seats come from Windows 7 which is now at 30 per cent (-1.49). That's still a big chunk of machines though, nearly a third, which is going to prove an increasing headache as we hit the last few months before the venerable OS is retired in January 2020.

Funny how most of the news you can read about Windows 10 are how updates cripple systems and delete the data users have on it.

npm bans terminal ads

Found on ZD Net on Sunday, 01 September 2019
Browse Software

After last week a popular JavaScript library started showing full-blown ads in the npm command-line interface, npm, Inc., the company that runs the npm tool and website, has taken a stance and plans to ban such behavior in the future.

However, the JavaScript community didn't react in the way Aboukhadijeh hoped, and his initiative was criticized by most developers, who claimed the ads were polluting application logs.

Now if only NPM would be banned too. Nobody who is serious would ever consider using that in anything remotely close to a production environment; but then we're talking about Javascript...

Steam Windows Client Local Privilege Escalation 0day

Found on Amonitoring on Thursday, 08 August 2019
Browse Software

45 days have gone since the initial report, so I want to publicly disclose the vulnerability. I hope this will bring Steam developers to make some security improvements.

This article was ready for publication by July 30 (this date was chosen due to 45 days deadline since initial vulnerability report was sent). So, two weeks after my message, which was sent on July 20, a person appears, who tells me that my report was marked as not applicable, they closed the discussion and wouldn’t offer any explanation to me. Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report.

Ff it is a vulnerability, Steam should acknowledge it, fix it and rewards the guy. If it is not a vulnerability, then there cannot be any harm done by the discloser, because, well, it is not a bug.

Microsoft changes Windows 10’s update model

Found on Ars Technica on Thursday, 25 July 2019
Browse Software

Fast Ring subscribers are the first to get new features and updates. Slow Ring subscribers get those features before they're public but not until after the Fast Ring folks have had a while to flush out the worst of the bugs.

If Microsoft continues in the vein that it has begun with 20H1 and 19H2, the Fast Ring will get longer periods of time to test the biggest and potentially more problematic major feature upgrades, and the Slow Ring will get the first crack at—and more time to test—the smaller incremental updates aimed at fixing long-term problems in performance and stability.

With all the endless bugs, problems and angry customers it sounds like Fast and Slow Ring are the end users.