WordPress team working on daring plan to forcibly update old websites

Found on ZD Net on Friday, 09 August 2019
Browse Internet

The goal of this plan is to improve the security of the WordPress ecosystem, and the internet as a whole, since WordPress installations account for more than 34% of all internet websites.

The plan is to slowly auto-update old WordPress sites, starting with v3.7, to the current mimum supported version, which is the v4.7 release.

If only a few individual sites break, than those site will be rolled back to their previous versions and the owner will be notified via email.

This is going to be fun. Lots of breaking is to be expected and tons of websites will suddenly fail to work as they did before. Even if they do it in little steps, there is no way to tell if a plugin stops working as expected, or if themes display like before. Be sure to order tons of popcorn when this plan is put into action.

Steam Windows Client Local Privilege Escalation 0day

Found on Amonitoring on Thursday, 08 August 2019
Browse Software

45 days have gone since the initial report, so I want to publicly disclose the vulnerability. I hope this will bring Steam developers to make some security improvements.

This article was ready for publication by July 30 (this date was chosen due to 45 days deadline since initial vulnerability report was sent). So, two weeks after my message, which was sent on July 20, a person appears, who tells me that my report was marked as not applicable, they closed the discussion and wouldn’t offer any explanation to me. Moreover, they didn't want me to disclose the vulnerability. At the same time, there was not even a single word from Valve. No, guys, that's not how it works. You didn’t respect my work, and that's the reason why I won’t respect yours — I see no reason why I shouldn't publish this report.

Ff it is a vulnerability, Steam should acknowledge it, fix it and rewards the guy. If it is not a vulnerability, then there cannot be any harm done by the discloser, because, well, it is not a bug.

Microsoft catches Russian state hackers using IoT devices to breach networks

Found on Ars Technica on Wednesday, 07 August 2019
Browse Internet

Hackers working for the Russian government have been using printers, video decoders, and other so-called Internet-of-things devices as a beachhead to penetrate targeted computer networks, Microsoft officials warned on Monday.

Microsoft researchers discovered the attacks in April, when a voice-over-IP phone, an office printer, and a video decoder in multiple customer locations were communicating with servers belonging to “Strontium,” a Russian government hacking group better known as Fancy Bear or APT28.

Of course, no other nation does anything similar to spy in other nations. Only Russia hacks IoT devices, or anything else network related.

There is no evil like reCAPTCHA (v3)

Found on Stoicism & Me on Tuesday, 06 August 2019
Browse Internet

I would go so far as to say that being subjected to constant reCAPTCHAs is actually an act of human torture and disregard for a person's human right of mental comfort.

To solve what was (at the time) an epidemic in and of itself of bots, reCRAPCHA was born. Google came to the rescue of all, as was arguably their responsibility because they were the ones taking it up the rear the hardest from such bots.

How long it takes to now solve these things has increased due to completely deliberate and specific choices that Google has made in reCAPTCHA v3.

reCAPTCHA is just the worst. It's almos everywhere, and annoying. It fuels an entire industry of professional captcha solvers.

Stop abusing land, scientists warn

Found on BBC News on Monday, 05 August 2019
Browse Nature

Scientists are to deliver a stark condemnation of the damage being done to the land surface of the planet.

Scientists say the problem is huge. They admit it will be hard to solve, especially as conservation-style farming would involve teaching half a billion farmers to work differently.

Prof Jane Rickson from Cranfield University, UK, told us: “Increased temperatures and heavier rainfall will aggravate soil erosion, compaction, loss of organic matter, loss of biodiversity, and landslides… many of which are irreversible.

As long as more money is made by abusing nature than by saving it, nothing will change. That's what it all boils down to.

The worst volume control UI in the world

Found on UX Design on Sunday, 04 August 2019
Browse Internet

I’m sure a lot of people reading this has, at some point in their careers, felt that urge of innovating no matter what. An uncontrollable desire of redesigning something that hasn’t been redesigned for too long. It has to be recreated. And it has to be innovative.

Answering the should question is a skill you only get after many, many years answering questions alike.

That urge is the reason why things that are working just fine turn into a mess with the next release.

UK parliament sends snippy letter to Zuck and his poodle Clegg as it seems Facebook has been lying again

Found on The Register on Saturday, 03 August 2019
Browse Various

Most of the questions revolve around a simple question that Facebook has squirmed over for more than a year: when did it become aware that Cambridge Analytica was abusing access to its systems?

But while pretty much no one believed Facebook was telling the truth at the time, in recent months evidence has come to light that would appear to prove its mendacity.

His notorious poor poker face is likely why he has repeatedly refused to attend in person at committee hearings, despite some aggressive requests for him to do so.

It always has lied, always lies, and always will lie. It's about time those in charge realize that Facebook makes a fool of them and act.

Amazon to kill Dash button functions on August 31—you have a month to hack yours

Found on Ars Technica on Friday, 02 August 2019
Browse Technology

Amazon justified its plans by saying that consumer use of the devices "has significantly slowed" since the retailer stopped offering them as a buyable option.

What will you use leftover Dash buttons for? Beats us. But anything has to be better than pressing the thing and not getting a massive carton of Doritos as expected.

Another pile of junk created in an attempt to boost sales.

WIPO Says Websites In Its Pirate Database Don't Deserve Due Process

Found on Techdirt on Thursday, 01 August 2019
Browse Legal-Issues

After a number of emails back and forth, WIPO eventually told me that since this database is "under formal discussion by WIPO member states at a meeting of the Advisory Committee on Enforcement" in early September, WIPO felt that it was best not to comment until after it's too late for it to matter and after the member states have discussed it. That strikes me as odd.

I am quite sure that Thille thought he was being helpful here -- and, he actually was being super helpful in revealing WIPO's complete and utter disgust for basic due process on issues that impact speech and innovation.

You cannot leave any legal questions to companies, because they will always find a way to abuse this new power.

Facebook's fact-checking process is too opaque to know if it's working

Found on New Scientist on Wednesday, 31 July 2019
Browse Internet

Most of the queue provided by Facebook contained content that couldn’t be fact-checked – such as statements of opinion and random links including a swathe of Mr Bean videos – pointing to the ongoing difficulty in monitoring the more than one billion pieces of content posted to the platform daily.

“Facebook’s algorithms are not yet at a stage where they can reliably identify information that is inaccurate,” says Will Moy, director of Full Fact.

This is a blow for the company as they, as well as other tech companies, have said that artificial intelligence should be used to help tackle the problem of fake news. But it doesn’t seem ready yet.

Facebook is vague, opaque and questionable? What a shocker.