Start up: the convertible laptop dream, Pagefair’s malvertising hack, Samsung’s bulging bottom, and more


Keeping your personal information out of other sites is hard too. Photo by xiaming on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Count them if you like. I’m charlesarthur on Twitter. Observations and links welcome.

Laptop is a state of mind | Karma

Paul Miller:

There’s no such thing as “best of both worlds” in computers. Choices matter. Hybrids like the Surface Book are great for people who perfectly straddle the tablet and laptop use cases — who constantly switch between keyboard and pen, desk and walk-and-talks, angry memos and Angry Birds. Everyone else’s perfect “laptop” will probably be a lot more boring, and a good deal cheaper.

But.

You know what would be cool? A world where we actually needed Surface Books. What if our lives were like Microsoft Surface commercials? We’d flit effortlessly between different roles. An architect for one moment, consulting with a professional on your home remodel. Then you’re drawing up a clever football play for Russell Wilson. Then you’re playing Madden, streamed from your Xbox. Then you’re answering work emails and flicking away distractions with your finger. And then you’re in some big song-and-dance number, and you can’t even remember where you put your Surface Book because your life is amazing and who even cares anymore you’re going to die happy, loved by your family and respected by your peers.

The Surface Book is not an inferior product because its hardware is too ambitious. It’s an inferior product because its hardware is more ambitious than the digital lives we’ve thus far concocted.

link to this extract


CryptoWall 3.0 cost victims $325m – report » Infosecurity Magazine

Phil Muncaster:

The report noted:

“It was discovered that a number of primary [bitcoin] wallets were shared between campaigns, further supporting the notion that all of the campaigns, regardless of the campaign ID, are being operated by the same entity.”

Unfortunately for those unlucky enough to get infected by CryptoWall 3.0, the report paints the picture of a highly efficient operation running solid encryption, meaning victims usually do have to pay up to get their files back.

Even an FBI Special Agent was quoted as saying last week that it might be better for infected businesses to just pay the ransom.

link to this extract


Who knows what about me? A survey of apps’ behind-the-scenes personal data sharing to third parties » Technology Science

Jinyan Zang, Krysta Dummit, James Graves, Paul Lisker, and Latanya Sweeney:

We found that the average Android app sends potentially sensitive data to 3.1 third-party domains, and the average iOS app connects to 2.6 third-party domains. Android apps are more likely than iOS apps to share with a third party personally identifying information such as name (73% of Android apps vs. 16% of iOS apps) and email address (73% vs. 16%).

For location data, including geo-coordinates, more iOS apps (47%) than Android apps (33%) share that data with a third party. In terms of potentially sensitive behavioral data, we found that 3 out of the 30 Medical and Health & Fitness category apps in the sample share medically-related search terms and user inputs with a third party.

Finally, the third-party domains that receive sensitive data from the most apps are Google.com (36% of apps), Googleapis.com (18%), Apple.com (17%), and Facebook.com (14%). 93% of Android apps tested connected to a mysterious domain, safemovedm.com, likely due to a background process of the Android phone. Our results show that many mobile apps share potentially sensitive user data with third parties, and that they do not need visible permission requests to access the data.

Hardly seems a source of complaint if they’re sharing with Google and Apple, if it’s with permission. As for safemovedm.com, it seems to exist – since February 2008 – but not actually be active in any way; that makes it sound like an Android function.
link to this extract


Chrome OS is here to stay » Google Chrome Blog

Hiroshi Lockheimer, SVP Android, ChromeOS and Chromecast:

Over the last few days, there’s been some confusion about the future of Chrome OS and Chromebooks based on speculation that Chrome OS will be folded into Android. While we’ve been working on ways to bring together the best of both operating systems, there’s no plan to phase out Chrome OS.

With the launch of Chrome OS six years ago, we set out to make computers better—faster, simpler and more secure—for everyone. We’ve since seen that vision come to life in classrooms, offices and homes around the world. In fact, every school day, 30,000 new Chromebooks are activated in U.S. classrooms—that’s more than all other education devices combined. And more than 2 million teachers and students in more than 150 countries have the Share to Classroom Chrome extension, which launched in September and gets students onto the same webpage, instantly. Meanwhile, companies such as Netflix, Sanmina, Starbucks and of course Google, are using Chromebooks given the ease of deployment, the ability to easily integrate with existing technologies, and a security model that protects users at all levels, from hardware to user data. (Chromebooks are so secure you don’t need antivirus software!)

“Working on ways to bring together the best of both operating systems” implies that the two are coming together somehow – you wouldn’t have a third OS. Android isn’t going away. So Lockheimer hasn’t explained how ChromeOS is here to stay; instead, by avoiding the question while also acknowledging that something is happening, he’s making it more mysterious.
link to this extract


The Apple iPhone 6s and iPhone 6s Plus review » Anandtech

Ryan Smith and Joshua Ho:

The only real issues I can think of are that the iPhone 6s doesn’t have OIS and that the base SKU is still 16GB of storage. To be fair, the 16GB SKU can become a noticeable user experience issue if you’re constantly dealing with the limits of this storage, and the jump from 16 to 64 GB feels like it’s simply designed to encourage buying a more expensive SKU. There are arguments that users that don’t really take a ton of photos or videos and stream all their media will be fine, but it’s still a user experience problem in this day and age. However, despite these issues I would argue that the iPhone 6s’ are the best phones you can buy today.

Of course, this sounds like a rather hollow recommendation to those that have followed our reviews for the past year. This year, more than ever it feels like Android smartphones at the high end have stood still, as if smartphone improvements have become a zero sum game. To make the best phone this year is therefore a pretty low bar to clear.

The benchmarks, especially for storage, are remarkable: the new iPhones seem to knock everything aside in the raw processing power space. They stumble only a little in the battery life area, and even there it’s not a huge difference. (Thanks @papanic for the link.)
link to this extract


Samsung sells more phones — but for less money » WSJ Digits blog

Jonathan Cheng:

Samsung has been selling more cheaper smartphones, and fewer high-end premium devices, than it did even compared to Samsung’s rocky 2014, according to numbers from data firm Counterpoint Technology Market Research.

Samsung doesn’t separately disclose smartphone sales numbers.

Samsung shipped 84m smartphones in the third quarter of 2015, 6.3% more than during the same stretch last year and more than the No. 2 and No. 3 players, Apple and Huawei Technologies, combined, according to Counterpoint.

But while 55% of its smartphones were priced at $301 per unit or more at this time last year, that high-end segment has fallen to just 40% of Samsung’s overall smartphone sales, Counterpoint said.

Phones priced $200 or below now account for 38% of total units shipped at Samsung, versus 30% this time last year.

So while Samsung is indeed shipping more smartphones, it isn’t charging as much for them — or making as much money from them as it may have during the salad days of 2012 and 2013.

But the numbers also suggest that Samsung is willing and able to take the fight to the low-cost Chinese competitors that emerged in 2013 and 2014, eating away at its market share and profits.

If you calculate the numbers (I did) this means that Samsung sold 10m fewer phones in the $300+ bracket than last year – effectively ceding that chunk of the market to Apple – and sold 8m more than last year in the sub-$200 bracket.
link to this extract


Brazilian smartphone users quicker to adopt new Android OS than Indian users » Jana Blog

Globally, 93% of Android users are using versions of either the Lollipop, KitKat, or Jelly Bean operating systems on their devices. When we looked at the market share of each Android OS in India and Brazil among mCent users, we saw a similar theme. 98% of mCent users in India and 97% of users in Brazil are using either Lollipop, KitKat, or Jelly Bean. KitKat is the most popular OS among mCent users in both countries…

…In the case of Samsung, the top device brand in India and Brazil, older versions of the Galaxy and the Note will never get the new Marshmallow OS update. So while some users may want to upgrade, they simply may not be able to depending on which device and carrier they have…

…When looking across the three popular Android OS, Lollipop, KitKat, and Jelly Bean, Brazilian users are currently pretty evenly spread out across the three. But when we look at India, the majority of users—52%— are on KitKat. As users in Brazil move to new operating systems, users in India are staying on older OS versions much longer.

This is hardly amazing; Jelly Bean was released in late 2012. You’d be more surprised if newcomers to the smartphone market were on much older OSs.
link to this extract


What do recruiters look for in a resumé at first glance? »Quora

Abra Benjamin responded:

Our world is a lot simpler than you think. “Does this candidate seem like they stand a chance of being a good match for this role? If yes, proceed to next step. If no, reject.” Each recruiter is different, so there’s no one way to answer this question. But I’ll highlight briefly (actually, not so briefly) how I personally absorb a resume.  I should preface this by saying that currently I primarily recruit for senior-level software engineers.

It’s definitely useful if you’re looking around for jobs, especially the stuff about education not mattering much, nor formatting (duh), nor “uncomfortably personal details”, nor cover letters.
link to this extract


Halloween Security Breach » Inside PageFair

Pagefair being, of course, the company which is complaining about the cost of adblocking to publishers, and which offers analytics to them:

If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service, which prompted some visitors to these websites to download an executable file. I am very sorry that this occurred and would like to assure you that it is no longer happening.

The attack was sophisticated and specifically targeted against PageFair, but it is unacceptable that the hackers could gain access to any of our systems. We identified the breach immediately, but it still took over 80 minutes to fully shut it down.  During this time, visitors to websites owned by the publishers who have placed their trust in us were targeted by these hackers.

The damage was mitigated by our standard security practices, but the attackers still gained access.  I want to take some time here to describe exactly what happened, how it may have affected some of your visitors, and what we are doing to prevent this from ever happening again.

Spearphish email to take over account on CDN (Content Distribution Network) which offered a fake Adobe Flash advert which would install a bitcoin mining trojan. The breach was spotted within 5 minutes – but it took another 80 to regain control. Among the sites infected was Anandtech.

Once more, episodes like this make people who use adblockers utterly certain that they’ve made the right decision, while making those who haven’t wonder if they should. It’s a ratchet.
link to this extract


Apple indoor positioning app ‘Indoor Survey’ spotted on iOS App Store » Apple Insider

Mikey Campbell:

According to Indoor Survey’s iOS App Store page, spotted by developer Steve Troughton-Smith, the Apple-branded software enables indoor positioning within a venue by using radio frequency signals and an iPhone’s onboard sensors.

“By dropping ‘points’ on a map within the Survey App, you indicate your position within the venue as you walk through,” reads the app description. “As you do so, the indoor Survey App measures the radio frequency (RF) signal data and combines it with an iPhone’s sensor data. The end result is indoor positioning without the need to install special hardware.”

While not an exact match, the described system smacks of technology pioneered by indoor positioning startup WiFiSLAM, a Silicon Valley firm Apple snapped up for $20m in 2013.

Google has been doing something similar since 2012 for museums and a SLAM (simultaneous location and mapping) system since September 2014.
link to this extract


Start up: another Lenovo preinstall, abandoning GPG, video game breasts (yup), the watch business, and more


Bank of England: visualise this. Photo by Michael Sissons on Flickr.

A selection of 9 links for you. Yes, you. I’m charlesarthur on Twitter. Observations and links welcome.

August 2013: renegade Windows App Store Pokki lands Lenovo as its latest OEM partner, will preload on its PCs » TechCrunch

Alex Wilhelm, in August 2013:

After securing Acer as its first major OEM deal, Pokki, an alternative Windows application marketplace and Start Button replacement, today secured Lenovo as its newest partner. The deal will see Pokki’s game arcade and Start Menu shipped with Lenovo machines, greatly boosting its marketshare in the PC ecosystem.

I’ve asked Lenovo about this: it hasn’t so far been able to tell me how much Pokki paid to be installed. It seems to me a fair presumption that Pokki did pay to be included – it offers various shareware apps via its menu. (Pokki doesn’t interfere with network traffic.) Here’s Pokki’s blogpost on the “partnership”. (That’s an Internet Archive link because I can’t get the original to load.)

Superfish might be the most recent, but it wasn’t the first time Lenovo was trying to improve its margins with preloaded software.


Meet Ross, the IBM Watson-powered lawyer » PSFK

Adriana Krasniansky:

Lawyers using Ross ask a legal question, and the program sifts through thousands of legal documents, statutes, and cases to provide an answer. Ross’s responses include legal citations, suggest articles for further reading, and even calculate a confidence rating to help lawyers prepare for cases. Because Ross is a cognitive computing platform, it learns from past interactions, meaning that Ross’s responses will grow to be more accurate as lawyers continue to use its system.

Via Mark Gould, who says that this sort of thing could automate legal functions… so what happens to those white-collar jobs?


Windows was less vulnerable than OS X, Linux, and iOS in 2014: report » NDTV Gadgets

Robin Sinha, somewhat perfunctorily:

Apple’s OS X operating system was the most vulnerable in 2014, according to a new report by the US National Vulnerability Database (NVD).

As per the report, OS X leads the list followed by iOS, Linux, Microsoft Windows Server 2008, Windows 7, Windows Server 2012, Windows 8, Windows 8.1, Windows Vista, and Windows RT. It has been noted that 7,038 new vulnerabilities were added last year, which results in 19 new vulnerabilities per day.

The report adds that out of the 7,038 vulnerabilities, 80 percent were said to come via third-party applications, 13 percent from operating systems and 4 percent via hardware devices. It is worth mentioning that in 2013 the vulnerability number was low at 4,794. Also, out of the 7,038 vulnerabilities, 68 percent was said to fall under the ‘medium’ severity, 24 percent in ‘high’ and the remaining 8 percent in ‘low’.

OK, I get it had the most vulnerabilities. Was it the most exploited, though?


Data Visualisation Competition – Are you a Viz Whizz? » Bank of England

“Viz Whizz”. Cringe. But it’s real, and could be fun:

Three criteria will be used to judge the entries. Is the visualization:

• showing something novel or insightful that is relevant to the Bank?
• clear and easy to understand?
• aesthetically pleasing and original?

Prize
Those entries that make the finalist day on Thursday 4 June will receive a tour of the Bank of England and its archives in the morning, followed by lunch.
Judging will take place in the afternoon where finalists will present their entries to an expert panel.
The winning entry will then be announced and the winning team will receive the prize of £5000. Refreshments will then be served for the contestants who will have the chance to mingle with the judges and other Bank staff.
The prize will be for the entry (and not per person).


Wristwatch industry statistics » Statistic Brain

Fascinating data: 1.2bn watches sold annually, 29.2m Swiss watches, almost all the rest from China and Hong Kong. Average values hugely different. It’ll be fun to see how the annual revenues for Swatch/Omega and Rolex look in a year’s time. (Via Robin H.)


Experts dubious of Gemalto claim its SIM keys weren’t stolen by GCHQ » Forbes

Thomas Fox-Brewster on the pushback against SIM card maker Gemalto’s claim that no siree, the keys are all locked in this safe:

First, [Gemalto] has assumed that its “highly secure exchange processes” have not been compromised. Second, Gemalto’s report was put together in a week, which might not be enough time to uncover far more surreptitious activity across its network, especially given the technical ingenuity of the alleged adversary. “Do they know the truth? Do they seriously believe they can conduct an investigation uncovering the truth in less than a week? This is a rush job to placate shareholders. Hopefully, they will keep investigating,” said Dr Ralf-Philipp Weinmann, who runs Comsecuris, a security research and consulting company. “Attacking SIM card vendors is a very economic solution to breaking encryption of cellular telephony.”

Perhaps the most worrying of Gemalto’s assertions is that it’s not possible to break connections over 3G or 4G using the methods described in the report. As Gemalto must know, it’s possible to force phones to “fail over” to easily-crackable 2G by jamming 3G and 4G connections.

My money’s on GCHQ. Those people are smart.


GPG And Me » Moxie Marlinspike

“Marlinspike” is a pretty adept crypto developer:

When I receive a GPG encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. Sometimes I actually contemplate creating a filter for them so that they bypass my inbox entirely, but for now I sigh, unlock my key, start reading, and – with a faint glimmer of hope – am typically disappointed.

I didn’t start out thinking this way. After all, my website even has my GPG key posted under my email address. It’s a feeling that has slowly crept up on me over the past decade, but I didn’t immediately understand where it came from. There’s no obvious unifying theme to the content of these emails, and they’re always written in earnest – not spam, or some form of harassment.

Eventually I realized that when I receive a GPG encrypted email, it simply means that the email was written by someone who would voluntarily use GPG…

… I think of GPG as a glorious experiment that has run its course. The journalists who depend on it struggle with it and often mess up (“I send you the private key to communicate privately, right?”), the activists who use it do so relatively sparingly (“wait, this thing wants my finger print?”), and no other sane person is willing to use it by default.

Been available 20 years, yet has only 50,000 “strong” keys and under 4m published in the keypool. I’ve had a lot of PGP keys and forgotten the passwords to them all.


How video game breasts are made (and why they can go wrong) » Kotaku UK

Patricia Hernandez did a lot of research:

One developer who I’ll call “Alex,” because they didn’t want to be identified by their own name, told me about a situation where breasts had gone wrong—and it wasn’t the result of tech limitations. Alex told me that their studio was very concerned with its depiction of breasts. Even so, there were stumbles along the way.

“The very first thing I noticed when [the studio was] animating breasts is, I would look at them, and they were just not moving in a way that was even remotely natural,” Alex said.

“I remember saying to the artist, ‘the breasts are moving wrong.’ And I remember directly asking him, ‘Have you watched breasts move? Have you actually watched breasts move?”

Game developers have all the interesting conversations. It’s a fascinating piece as much as anything for the explanation of how developers *do* cope with the problem. (As one commenter asks, should the uncanny valley of video game breasts be called the uncanny cleavage?) So much effort, and then the premise of the game is ridiculous…


On WordPress.com and Bitcoin » Matt Mullenweg

WordPress is ending the ability to pay for its services using bitcoin, principally because it’s working on a code rewrite of its payment system, and wants less complication in the number of currencies it has to support. So some questions were put to Mullenweg:

Q: You mention that bitcoin has low volume compared to other payment methods, has this always been the case? Has its volume share changed over time?

A: The volume has been dropping since launch, in 2014 it was only used about twice a week, which is vanishingly small compared to other methods of payment we offer. We supported Bitcoin for philosophical reasons, not commercial ones.

Something of a reality check there. Although Mullenweg also says:

I believe Bitcoin or some other blockchain-like system will be the basis of the majority of financial transactions in the future, from small remittances to multi-billion dollar corporate acquisitions. I think transaction costs should follow Moore’s law, and I don’t think we’re going to get there with the centralized gateways that currently account for the overwhelming majority of transactions. I also personally hold Bitcoin, I’m an advisor to Stellar.org, and my friends make fun of me for bringing up Bitcoin and the blockchain in unrelated conversations.

(Via Ben Thompson)