Tag Archives: hacking

Start up: a huge new Android security risk, Google+ downgraded, iTunes’s giant mess, and more

Posted on by
1


It was 20 years ago (roughly) that a Rolling Stones song launched Windows 95. Photo by michfiel on Flickr.

A selection of 9 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Making free work (hint: cannibalize radio, not sales) » Music Industry Blog

Mark Mulligan:

Neither Spotify or Deezer is in the business of free music, they are in the business of subscriptions and simply use free as a marketing tool. So they have no reason to cling doggedly to free users that show no sign of converting. Instead after a sufficient period of free music has been offered users should be pushed to subscriptions or onto a radio tier (see figure). There is no business benefit to the streaming services nor rights holders to have perpetual on demand free users.

The assumption that free music is some sort of internet right is symptomatic of the internet’s growing pains. In terms of market development we’re probably at the adolescence stage of the internet, the stage at which carefree childhood starts to be replaced by responsibility and consequences. We’re seeing this happen right across the internet economy, from privacy, data, free speech, jurisdiction etc. Because music has been free online for so long consumers have learned to accept it as fact. That assumption will not be changed any time soon, and try to force the issue too quickly and illegal services will prosper.

Of course YouTube is, and always has been the elephant in the room, buoyed by the schizophrenic attitude of record labels who simultaneously question its impact on the market while continuing to use it as their number 1 digital promotional channel. While the tide may finally be beginning to turn, don’t expect YouTube to go anywhere any time soon. But should the screws tighten do expect YouTube to stop playing ball.

Apple Music, of course, chucks you out after your three-month trial unless you subscribe. Let’s see how it does for conversion.
link to this extract

Continuum on Windows 10 » Blogging Windows

Windows 10 adjusts your experience for your activity, device and display, so you can do your thing in any mode anytime you want. Onscreen features, like menus and taskbars, adapt for easy navigation. Apps are built to scale smoothly from screen to screen so they look good from the smallest app window up to the largest 8k displays*.

That’s gr– hey, what’s the asterisk?

“*App experiences may vary.”

Oh. (Via Wes Miller.)
link to this extract

Start Me Up (again) » GartenBlog

Windows 10 will arrive, without fanfare, on computers tomorrow (July 29th). In August 1995, Windows 95 was launched with the Rolling Stones’ “Start Me Up” as its theme song. Michael Gartenberg recounts Microsoft’s Brad Stone talking about the negotiations with the band:

For a good month we continued negotiations mostly on the phone. I had only so much I would and could pay and that made things easier on our end. The fact that we had to fish or cut bait to get our TV ads done in time for the August 24th launch served as a forcing function and eventually we agreed to terms. They rushed WK the “Start Me Up” recording as we were already working on the ad. The next day I got a frantic call from WK saying that the Stones had sent a later live version of “Start Me Up” that wouldn’t work. I called up Cohl and told him that I had to have the original version or there was no deal. Eventually they agreed. I found out later that the reason they gave us the live version was that it was recorded after Bill Wyman had left the band. Giving us the original meant that Wyman got his allocation of the deal which of course meant that giving us the original version of “Start Me Up” meant that Jagger, Richards and the rest of the band got less.

I also found out later that Jagger and Richards did not always see eye to eye on the deal. As Brad indicated, Jagger was less inclined to commercialize their music in this way. I was told he was especially ready to just forget the deal when we made it clear we needed the original version but that he did not want to piss off Richards over it because Richards wanted or needed the money.

One British paper (not me) suggested Microsoft paid $14m. “We paid a fraction of this”, Stone writes.
link to this extract

Dmail makes your Gmail messages self-destruct » TechCrunch

Sarah Perez:

The product works by way of a Google Chrome web browser extension, which only you, as the email sender, have to install.

Once loaded, you’ll have a new option within the Gmail “compose” interface that allows you to turn the Dmail service off and on using a toggle switch. When on, you can specify ahead of sending an email if you want the email destroyed in an hour, a day, a week, or “never.” Even if you choose the “never” option, you can later go into your sent message and click a “Revoke Email” button to remove access to that email from all recipients.

What’s clever about Dmail is that, unlike some other secure messaging products, recipients don’t have to use the service themselves in order for it to work. If they don’t have the extension installed, they’ll instead receive an email that states: “This secure message was sent using Dmail. To view this message, simply click the button below.” 

Clicking the included “View Message” button will then redirect them to a web view where they can read your email.

More accurate headline: Dmail makes your Gmail messages into shareable web pages whose access you control. These attempts to reinvent email are doomed to failure.
link to this extract

Canon cuts outlook as weak camera sales hit second-quarter profit » Reuters

Ritsuko Ando:

Japan’s Canon Inc cut its earnings outlook for the full year and reported a 16% fall in quarterly profit as consumers, increasingly in the habit of taking photos with their smartphones, bought fewer compact digital cameras.

The world’s largest camera maker said on Monday its second-quarter net profit fell to 68bn yen ($552m) compared with 81bn yen a year earlier. Analysts on average expected 65bn yen, according to Thomson Reuters data.

The firm said it now expects full-year profit of 245bn yen rather than the 255bn it forecast three months ago.

Wait and see what they forecast in another quarter. This is a trend that will only continue.
link to this extract

The hidden opportunity of corporate smartphones » Tech.pinions

Bob O’Donnell:

Many of the IT professionals who are making or strongly influencing these purchases also have a soft spot for Windows and this preference clearly shows up in survey results. Though it’s well known the percentage of consumers actively using Windows Phones is small, what isn’t well known is a surprisingly large percentage of companies (over 40% in several different surveys) have employees who use devices running Microsoft’s mobile OS. In fact, in a TECHnalysis Research survey of US healthcare companies, 17% of work smartphones in their organizations were running Windows Phone. This goes a long way towards explaining Microsoft’s recent comments about focusing their future smartphone development towards enterprise as a key target. They actually have a solid opportunity there.

Goes to show how little influence IT professionals have in the new mobile world order, if you ask me. A reminder: about 80m Windows Phones are being used worldwide; in the US it’s in the low single-digit millions. That might be a gigantic corporate usage. Or it might be a small corporate usage and a small corporate usage.
link to this extract

Major flaw in Android phones would let hackers in with just a text » All Tech Considered : NPR

Aarti Shamani:

In this attack, the target would not need to goof up — open an attachment or download a file that’s corrupt. The malicious code would take over instantly, the moment you receive a text message.

“This happens even before the sound that you’ve received a message has even occurred,” says Joshua Drake, security researcher with Zimperium and co-author of Android Hacker’s Handbook. “That’s what makes it so dangerous. [It] could be absolutely silent. You may not even see anything.”

Here’s how the attack would work: The bad guy creates a short video, hides the malware inside it and texts it to your number. As soon as it’s received by the phone, Drake says, “it does its initial processing, which triggers the vulnerability.”

The messaging app Hangouts instantly processes videos, to keep them ready in the phone’s gallery. That way the user doesn’t have to waste time looking. But, Drake says, this setup invites the malware right in.

If you’re using the phone’s default messaging app, he explains, it’s “a tiny bit less dangerous.” You would have to view the text message before it processes the attachment. But, to be clear, “it does not require in either case for the targeted user to have to play back the media at all,” Drake says.

Gives attackers system privileges. Proportion of Android devices vulnerable: 95%. Google has pushed out an update to hardware makers. But have the hardware makers pushed the update out? Google reckons that if 50% of devices get it, that will be good.

The big risk is that someone will create a Blaster-style worm that attacks a phone and then accesses its phone book to send malicious MMSs to the numbers in the phone book.
link to this extract

Don’t order the fish » Marco.org

Marco Arment:

With the introduction of Apple Music, Apple confusingly introduced a confusing service backed by the iTunes Store that’s confusingly integrated into iTunes and the iOS Music app (don’t even get me started on that) and partially, maybe, mostly replaces the also very confusing and historically unreliable iTunes Match.

So iTunes is a toxic hellstew of technical cruft and a toxic hellstew of UI design, in the middle of a transition between two partly redundant cloud services, both of which are confusing and vague to most people about which songs of theirs are in the cloud, which are safe to delete, and which ones they actually have.

iTunes has Microsoft’s problem: supporting a gigantic range of legacy hardware in the form of millions of iPods and iPhones.
link to this extract

Everything in its right place » Official Google Blog

Bradley Horowitz, VP of “Streams, Photos and Sharing”:

People have told us that accessing all of their Google stuff with one account makes life a whole lot easier. But we’ve also heard that it doesn’t make sense for your Google+ profile to be your identity in all the other Google products you use.

So in the coming months, a Google Account will be all you’ll need to share content, communicate with contacts, create a YouTube channel and more, all across Google. YouTube will be one of the first products to make this change, and you can learn more on their blog. As always, your underlying Google Account won’t be searchable or followable, unlike public Google+ profiles. And for people who already created Google+ profiles but don’t plan to use Google+ itself, we’ll offer better options for managing and removing those public profiles.

You’ll see these changes roll out in stages over several months. While they won’t happen overnight, they’re right for Google’s users—both the people who are on Google+ every single day, and the people who aren’t.

On that YouTube blogpost:

The comments you make on YouTube will now appear only on YouTube, not also on Google+. And vice-versa. This starts rolling out today.

Google+ is no longer obligatory. Slightly too soon to call it dead. But it will never grow big. And we’ll never hear those faintly bogus stats about “user sharing” or inflated claims of users.
link to this extract

Start up: adblocking animus, Amazon’s aims, Ubuntu phone reviewed, the iPod Watch, and more

Posted on by
Reply


“They say this replacement can’t be hacked remotely!” Photo by Hugo90 on Flickr.

A selection of 10 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

New iPhone apps will include ad blockers for the mobile web » MIT Technology Review

Tom Simonite:

Some [iOS developers] are now testing ad blocking apps they intend to release when iOS9 becomes available. Their results suggest these apps could be popular. For example, when Dean Murphy, an app developer based in the U.K., hacked together an ad blocker in about an hour earlier this month, he found it slashed the time taken to load the popular Apple blog iMore from 11 seconds to just two seconds.

He is now working to release a fully polished ad blocker called Crystal, and expects there will be many others when iOS9 launches. “Apple has laid a solid foundation for quality ad blocking applications,” he says.

One of Murphy’s competitors will be an app called Purify, created by Chris Aljoudi, who leads development of the desktop ad blocker uBlock, which he says has over one million active users. A video of Purify in action shows how it makes a news site load faster and strips pre-roll video ads from YouTube. Aljoudi says his tests have showed that Purify cuts Web browsing data usage by about a quarter—which could cut some people’s data bills and extend battery life. Both Aljoudi and Murphy intend to make their apps cheap, but not free.

I think they’re going to make good money. Advertisers (and sites) have a problem coming their way. Here’s Purify at work:

link to this extract

The Verge’s web sucks » blog.lmorchard.com

Les Orchard tried examining The Verge’s desktop site, and found it linked him to 47 third-party trackers:

I feel like someone just set up the entire vendor hall from an awful tech conference in my living room. Seriously, could you folks just not pick one or two or ten? Did you hit every booth and say “Yeah, cool, sign us up!” I feel thoroughly spindled & folded & researched, here.

As a webdev at Mozilla, I’ve been in hour-long meetings where we’ve agonized over whether it’s copacetic to include just one little Google Analytics snippet without notifying users and updating the privacy policy. But, I know we’re crazy in our own very special ways.

In former lives, I’ve worked at ad agencies and digital marketing companies. I’m no stranger to conversations that revolve around partners & bizdev & analytics & media buys. I can only imagine things have intensified & evolved since I’ve been out of those trenches.

Still – and maybe this is the Mozilla brain-damage talking – I can’t imagine a sane conversation that resulted in The Verge extending an invitation to over 20 companies to set up shop on my computer with every page visit.

The reckoning is moving just that bit closer each day. Once a significant number of people start getting faster, better experiences from using adblockers (or tracker-blockers), they won’t care that the ads aren’t targeted. Newspaper and magazine ads didn’t use to follow you around the room, and they were quite a good business.
link to this extract

I got my music back. At least most of it » Loop Insight

Jim Dalrymple, after the debacle of last week:

So now I have the iTunes Match service that I pay for separately, and Apple Music, both of which use iCloud Music Library. There is really no way to get away from them if you want to use the latest and greatest from Apple.

I’ll admit, I’m still trying to get my head around how this works.

Some of the songs I own were incorrectly tagged as Apple Music, but that’s been fixed too, which means they show up correctly in iTunes. That is great news.

However, I’m still missing a couple of hundred songs. Apple’s theory is that I deleted them—that when I was trying to fix Apple Music, I mistakenly deleted my own files. While I concede that it is within the realm of possibility that I deleted my own files, it doesn’t make sense to me.

Apple is clearly struggling with Apple Music – a colossal effort launched in a huge number of territories – which is why my advice would be not to get worked up about precisely what seems to be working or not at present. And especially not to delete anything that you think you might own.
link to this extract

Ubuntu Phone review: years in the making, but still not consumer-ready » Engadget

Jamie Rigg:

I get the idea of Scopes [which are like Live Tiles in Windows], kind of. They are supposed to give the user a personal experience, remove their reliance on walled apps and bring content to the forefront. I just don’t think Scopes deliver, or maybe I’m just so used to the app-first experience that I’m having trouble adapting to the Scope way of doing things. And if that’s the case, then most people will be in the same boat. My main problem with Scopes is that I feel I’m being bombarded with content. If I want to check out upcoming concerts on an iOS/Android device, I’d load up the Songkick app. But when that’s not what I’m looking for, I don’t really want to see Songkick listings permanently displayed on my phone, like I’m being advertised to. You could argue the solution is to remove the Songkick feed from the Scopes it populates. But, if I was constantly adding and removing sources from Scopes when they are or aren’t relevant, I don’t see how that’s preferable to having dedicated apps that offer a better experience.

It seems like there’s just no way to create a new user interface at present, certainly on a mobile screen. The gigantic gravitational field of the app-driven iOS/Android system precludes it.

Also, this sounds like crap.
link to this extract

Toshiba’s woes show how PC sales slump is squeezing big tech firms » The Guardian

I wrote about the Others:

It is whispered among some analysts that only the preinstallation of third-party antivirus programs – which try to get users to sign up to subscriptions – keeps some PC makers afloat at all, owing to the fees they receive from antivirus software firms.

It was the PC business that triggered the current turmoil at the Japanese giant [Toshiba], after an internal auditor asked in late January to look at the accounts for the company’s laptop business. That eventually concluded with an examination by an external panel, whose 294-page report noted “inappropriate accounting” in various business segments, including those “relating to component transactions” in the PC business.

In a statement on 21 July it said that 111bn yen (£580m) of assets in the PC business in the past six financial years were “under consideration” for re-evaluation. That could affect its financial results, which will be finalised by 31 August. But even in its most recent quarterly report, before any restatement, Toshiba said that its PC business recorded restructuring costs of 46bn yen in the previous three quarters, and that otherwise it “would have recorded positive operating income over three consecutive quarters”.

46bn yen is $370m. Is Toshiba really saying it made an average operating profit of $123m per quarter in the PC business? That’s as much as Asus, which is one of the biggest makers. Seems unlikely.
link to this extract

Twitter is deleting stolen jokes on copyright grounds » The Verge

Dante D’Orazio:

some people just copy good tweets from other people and act like they came up with the 140-character witticism on their own. This has been going on since the beginning of Twitter.

It now appears Twitter is using its legal authority to crack down on these tweet-stealers. A number of tweets have been deleted on copyright grounds for apparently stealing a bad joke.

As first spotted by @PlagiarismBad, at least five separate tweets have been deleted by Twitter for copying this joke:

saw someone spill their high end juice cleanse all over the sidewalk and now I know god is on my side
— uh (@runolgarun) July 9, 2015
Olga Lexell, who, according to her Twitter bio, is a freelance writer in LA, appears to be the first person to publish the joke on Twitter. In a tweet posted this afternoon, she confirmed that she did file a request to have the tweets removed.

I simply explained to Twitter that as a freelance writer I make my living writing jokes (and I use some of my tweets to test out jokes in my other writing). I then explained that as such, the jokes are my intellectual property, and that the users in question did not have my permission to repost them without giving me credit.

She added that most of the accounts that were reusing her tweets without accreditation were “spam accounts that repost tons of other people’s jokes every day.” This also isn’t the first time Twitter has complied with a request like this: Lexell tells The Verge that she’s filed similar requests for other jokes. Twitter staffers typically remove the offending tweets “within a few days” without asking Lexell any follow-up questions.

Couldn’t she, you know, just not tweet them but try them on other people? Or try them from a protected account? This is quite weird.
link to this extract

Pakistan to shut down BlackBerry services by December for “security reasons” » Reuters

Syed Raza Hassan:

Pakistan, a nuclear-armed nation of 180 million people, is plagued by militancy, criminal gangs and drug traffickers.

“PTA has issued directions to local mobile phone operators to close BlackBerry Enterprise Services from Nov. 30 on security reasons,” an official with the Pakistan Telecommunications Authority said in a text message.

He asked not to be named due to the sensitivity of discussing communications and intelligence.

BlackBerry was not immediately available to comment.

A report released this week by British-based watchdog Privacy International said Pakistan’s powerful military intelligence agency, the Inter-Services Intelligence (ISI), was seeking to dramatically expand its ability to intercept communications.

BlackBerry encrypts data such as emails and its BlackBerry Messenger messages sent between a user’s phone and public networks, ensuring greater privacy for users but making life harder for police and intelligence agencies.

link to this extract

Fiat Chrysler recalls 1.4 million vehicles to defend against hacks » Bloomberg Business

Mark Clothier:

Fiat Chrysler Automobiles NV is recalling about 1.4 million cars and trucks equipped with radios that are vulnerable to hacking.

The company was already distributing software to insulate connected vehicles from illegal remote manipulation after Wired magazine published a story about software programmers who were able to take over a Jeep Cherokee being driven on a Missouri highway. Fiat Chrysler reiterated that it’s not aware of any real-world unauthorized remote hack into any of its vehicles.

It stressed that no defect was found and that it’s conducting the campaign out of “an abundance of caution.”

Fiat Chrysler said it has blocked unauthorized remote access to certain vehicles systems via an over-the-air update on Thursday.

link to this extract

Amazon and the “profitless business model” fallacy » Remains of the Day

Eugene Wei (who used to work at Amazon):

There are very few people in technology and business who are what I’d call apex predators. Jeff [Bezos] is one of them, the most patient and intelligent one I’ve met in my life. An apex predator doesn’t wake up one day and decide it is done hunting. Right now I envision only one throttle to Jeff’s ambitions and it is human mortality, but I would not be surprised if one day he announced he’d started another side project with Peter Thiel to work on a method of achieving immortality.

One popular thesis among Amazon profitability skeptics is that Amazon can’t “flip a switch” and become profitable. The most common guess as to how Amazon flips the switch is that it will wait until it is the last retailer standing and then raise prices across the board, so Amazon skeptics argue against that narrative possibility.

But “flipping a switch” is the wrong analogy because Amazon’s core business model does generate a profit with most every transaction at its current price level.

In that light, it’s wrong to look at the AWS “profits” as a proportion of revenue and say “wow”. The profit number is meaningless. Amazon can make any part of the business look as profitable or unprofitable as it likes.
link to this extract

The future of Apple Watch will be more like the iPod’s than the iPhone’s » Beyond Devices

Aaron Miller (in a guest post on Jan Dawson’s site):

First, and most importantly, the Apple Watch is an ecosystem product. Right now, the Watch only works as an extension of the iPhone. Its upper boundary is the total number of iPhones in the world.

This makes the Watch much more like the iPod than the iPhone. From the time the iPod first launched, it was a product tied to a computer, first to Macs then eventually to Windows computers as well. (Remember the Digital Hub strategy?) Just as the iPod existed to enhance the Personal Computer + iTunes ecosystem, the Watch exists to enhance the iPhone ecosystem. The iPhone, even if tied to iTunes early on, was never merely an ecosystem enhancement—nor designed to be one, like the iPod or Apple Watch have been.

Naturally, we expect the Watch’s reliance on iPhones to change over time. LTE and GPS seem like inevitable Apple Watch additions, for example, as does a Watch-native App Store. With true third-party apps coming soon, reliance on the iPhone will diminish even more. But there’s one limitation that may always tie Apple Watches to iPhones: the screen…

…the Apple Watch category is not just smartwatches. The correct category is wearables, and wearables right now, at the birth of the Apple Watch, are very similar to the early MP3-player market. Some are huge and multi-functional. Some are svelte and limited. Some are banking on unique features trying to find a niche.

Wonder what other wearables Apple might have in mind. What’s the iPod shuffle version of a Watch?
link to this extract

Start up: Amazon’s profitable cloud, Apple Music woes, early days of search, and more

Posted on by
1

Kepler 452b
“Hello! Have you heard of ‘Greece’? Do you have spare money?” Artist impression by Nasa.

A selection of 9 links for you. Lather them all over yourself. I’m charlesarthur on Twitter. Observations and links welcome.

How Lycos almost won the search engine wars » Gizmodo

Jim Gilliam with a tale from the pit:

A few months later, our team made a huge discovery. In our ongoing efforts to make search results better, Dennis set up an eye-tracking lab and began scientific testing of how people used search. We watched where people looked on the pages and noticed something shocking: people didn’t look at the ads. Not only that, but the more we tried to make the ads stand out, the less people looked at them. Our entire advertising philosophy was based on making ads flashy so people would notice them. But we saw, quite counterintuitively, that people instinctively knew that the good stuff was on the boring part of the page, and that they ignored the parts of the page that we—and the advertisers—wanted them to click on.

This discovery would give us an edge over everyone in the industry. All we had to do was make the ads look less like ads and more like text. But that was not what the ad people wanted, and the ad people ran Lycos. The advertiser was seen as our true customer, since advertising was where our revenue came from. Our team argued that our customers were also the people searching, and without them, we’d lose the advertisers. The eye-tracking revelation wasn’t enough to convince them, so we tried another tack.

In the ultracompetitive world of search engines, the biggest factor aside from the quality of the results was how fast they loaded. We were constantly trying to take things out of the pages to make them load faster. So I created a program that took queries coming into our site and ran them on all the major search engines, ranking them in order of speed.

And guess which speed-obsessed, blinky-ad-ignoring company came along next? It’s an extract from Gilliam’s new book, The Internet Is My Religion. Have a free download of the book.
link to this extract

Amazon Web Services is now a $6 billion-a-year cloud-computing monster » Quartz

Dan Frommer:

AWS generated almost $400m in operating income during the quarter, and almost $1bn over the past four quarters. It represented almost 40% of Amazon’s consolidated-segment operating income for the second quarter in a row—despite only generating about 8% of the company’s sales.

In short: AWS is one of Amazon’s most valuable assets.

That 40%-8% ratio is something to ponder. Prices are going to fall as Microsoft and Google keep trying to win share. Will profits remain as strong?
link to this extract

Apple Music is a nightmare and I’m done with it » Loop Insight

Jim Dalrymple had a terrible experience:

I went through about 15 albums one night and manually added all of the missing songs. It was frustrating, to say the least, but I did it. I nearly lost my mind the next morning when I checked my iPhone and Apple Music and taken out all of the songs I added the night before. I was right back where I started.

In some cases, like Bob Dylan and Neil Young, a few of the songs show up twice on one album. When you tap to play the song, they both show the animated icon in iTunes, as if they are both playing. Note in the screenshot that the songs are different in terms of their length of playing time. Either Apple Music shaved a few seconds off one of the tracks, or they’re from different albums.

I’ve had some problems a little like this – duplicate tracks on iOS devices, ie not the originating device, which is the desktop. But nothing like Dalrymple’s awful loss of thousands of tracks. I’ve lost nothing. (People, don’t suffer the same way; make backups.) I’m just waiting for it to sort itself out. And I have a backup.

I suspect that Apple’s servers are suddenly under a colossal load, and that this is related in some way. Apple Music is very, very complicated. Not that that excuses track deletion. But it’s Spotify plus the iTunes Music Store plus iTunes Match. A gigantic beast.
link to this extract

An identity thief explains the art of emptying your bank account » Bloomberg Business

Dune Lawrence:

On this particular winter night [in Minsk] in 2009, [Dmitry] Naskovets checks the online orders that have come in and sees a routine assignment. A client has tried to buy a MacBook Pro online with a stolen credit card, but American Express blocked the purchase. Now it’s Naskovets’s job to work it out with Amex.

He calls the toll-free number, using software that makes it look as if he’s dialing from the U.S. Any information the customer rep might ask for, Naskovets’s client sends him instantly by chat. The questions don’t usually get beyond the cardholder’s date of birth, Social Security number, or mother’s maiden name, but the woman fielding this call is unusually thorough. She notices that the phone number on the account has changed recently, triggering extra security. She puts Naskovets on hold while a colleague dials the old number and gets the actual cardholder on the line.

Thus begins an absurd contest: Naskovets against the man he’s impersonating. The agents throw out questions to distinguish the fake. When did you buy your home? What color was the car you bought in 2004? Each time Amex puts him on hold, he knows the legitimate cardholder is being asked the same question. At last, the rep thanks him, apologizes, and approves the purchase. Naskovets was even better than the real thing.

Scary.
link to this extract

Apple Watch: a work in progress but packed with potential » CCS Insight

Ben Wood says his initial expectations were too high, and that he has been left underwhelmed. But, he adds:

this is version 1.0 and Apple has a proven track record of making a nice first device and then slowly but surely making it better and better. I’m not going to lie — I was among those who misjudged the original iPhone. It was easy to pick holes in the first model when it launched: poor battery life, no concessions to operators or subsidy, and missing features like 3G and MMS made it easy to jump to the wrong conclusions. But over time it’s become one of the most transformative electronic devices of our generation. That’s because the product that appeared in 2007 is not the product that hundreds of millions of people are using today. It was a full year before Apple opened the App Store, a major catalyst to the iPhone’s success. I predict we’ll take a similar journey with its watch.

When you go beyond the basic features and think about the sheer potential of the device you start to realise how significant it is. To me, it comes down to offering capabilities that are so compelling it’s not even worth the milliseconds it takes to whip your smartphone out of your pocket.

A perfect example of this is payment. Apple Pay landed in the UK this month. Although I’ve only used it a few times, my initial impression is that having a secure, predictable payment mechanism easily accessible on your wrist is hugely useful, whether you’re buying a coffee or hopping on a bus.

Another inspiring application is an electronic hotel room key – something Apple is already supporting at some Starwood hotels. No more arriving at your room struggling to get an unreliable plastic keycard out of your pocket or wallet, with a coffee in one hand and a suitcase in the other. A tap of the wrist and you’re in.

Things get even better when you add another layer of intelligence. At some point in the future, you’ll arrive at the hotel or approach the counter to pay for your coffee; a nearby beacon will tell your Apple Watch what information you’re likely to need. As if by magic the relevant loyalty card appears on the watch face ready to help you check in or pay for the coffee. These types of rich application are limited only by developers’ imagination and the software needed to create them.

Judging devices that obey Moore’s Law on their first incarnation really is a mug’s game.
link to this extract

NASA just discovered ‘Earth 2.0’ » Business Insider

Jessica Orwig:

Kepler 452b will forever be remembered as the first, second Earth or what NASA refers to as “Earth 2.0” ever discovered:

Here’s what we know so far about this Earth 2.0:

It’s 60% larger than Earth.
• It’s most likely rocky, meaning it has a solid surface as opposed to a gaseous one, like Jupiter.
• It’s about 1,400 light years from Earth.
• It orbits its star every 385 days, very similar to Earth’s orbital length.
• The planet and star it’s orbiting are about 6 billion years old — 1.5 billion years older than our sun.

Any chance they could bail out Greece? Just asking.
link to this extract

Google+: a case study on app download interstitials » Official Google Webmaster Central Blog

David Morell, software engineer at Google+ on why “hey, get our app!” things that take over the page might bug users:

Despite our intuition that we should remove the interstitial, we prefer to let data guide our decisions, so we set out to learn how the interstitial affected our users. Our analysis found that:
• 9% of the visits to our interstitial page resulted in the ‘Get App’ button being pressed. (Note that some percentage of these users already have the app installed or may never follow through with the app store download.)
• 69% of the visits abandoned our page. These users neither went to the app store nor continued to our mobile website.

While 9% sounds like a great CTR for any campaign, we were much more focused on the number of users who had abandoned our product due to the friction in their experience. With this data in hand, in July 2014, we decided to run an experiment and see how removing the interstitial would affect actual product usage. We added a Smart App Banner to continue promoting the native app in a less intrusive way, as recommended in the Avoid common mistakes section of our Mobile SEO Guide. The results were surprising:
• 1-day active users on our mobile website increased by 17%.
• G+ iOS native app installs were mostly unaffected (-2%). (We’re not reporting install numbers from Android devices since most come with Google+ installed.)

So much is weird about this. Why were they ever showing the interstitial to Android users, since “most” already had it? The news that not blocking a screen leads to people not giving up (especially for an app they’re likely to already have) isn’t that astonishing. Also: only 17% more read the page? That doesn’t seem so great, given that there were 69% abandoning before. Note too how the measurements aren’t congruent: in the first set, you’re told how many follows to the app there were, and how many abandoned. In the second, you’re told how “1-day active users” increased and how nothing happened to iOS installs – not how many clicked through.

When you aren’t given congruent statistics (in experiment A, X happened; in experiment B, X changed by Y), be distrustful.

And the other missing stat: the balance between iOS users and Android users who came to the page. It all just seems like a study in “what were you even thinking by trying to force people to click past an interstitial?”
link to this extract

Worldwide smartphone market posts 11.6% year-over-year growth in Q2 2015, the second-highest shipment total for a single quarter » IDC

According to the latest preliminary release from the International Data Corporation (IDC) Worldwide Quarterly Mobile Phone Tracker, vendors shipped a total of 337.2 million smartphones worldwide in the second quarter of 2015 (2Q15), up 11.6% from the 302.1 million units in 2Q14. The 2Q15 shipment volume represents the second highest quarterly total on record. Following an above average first quarter (1Q15), smartphone shipments were still able to remain slightly above the previous quarter thanks to robust growth in many emerging markets. In the worldwide mobile phone market (inclusive of smartphones), vendors shipped 464.6 million units, down -0.4% from the 466.3 million units shipped 2Q14.

Quite a contrast with the gloomier number from Trendforce on Tues/Weds. That gives smartphones 73% of sales; the 90% point, when featurephones are just edge cases, is fast approaching. Minor details: Samsung was the only top vendor to see a fall in shipments (and that by about 1m, so within margins of error). Apple, Huawei and Xiaomi all seeing growth faster than the market.

A notable quote from Melissa Chau on the phone team: “IDC now tracks over 200 different smartphone brands globally, many of them focused on entry level and mid-range models, and most with a regional or even single-country focus.”
link to this extract

Lottery IT security boss guilty of hacking lotto systems to win $14.3m » The Register

Iain Thomson:

Iowa state lottery’s IT security boss hacked his employer’s computer system, and rigged the lottery so he could buy a winning ticket in a subsequent draw.

On Tuesday, at the Polk County Courthouse in Des Moines, Iowa, the disgraced director of information security was found guilty of fraud.

Eddie Tipton, 52, installed a hidden rootkit on a computer system run by the Multi-State Lottery Association so he could secretly alter the lottery’s random number generator, the court heard. This allowed him to calculate the numbers that would be drawn in the state’s Hot Lotto games, and therefore buy a winning ticket beforehand.

The prosecution said he also tampered with security cameras covering the lottery computer to stop them recording access to the machine.

Hmm – worth a one-hour drama. Not really a miniseries or a film.
link to this extract

Start up: the people who buy flops, remotely hacking Jeeps, sharing Google’s salaries, and more

Posted on by
Reply


Inside the Greenwich foot tunnel: great for (walking) London cyclists. Photo by nick.garrod on Flickr.

A selection of 9 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Harbingers of failure » Penn State University

Eric Anderson, Song Lin, Duncan Simester and Catherine Tucker:

We show that some customers, whom we call ‘Harbingers’ of failure, systematically purchase new products that flop. Their early adoption of a new product is a strong signal that a product will fail – the more they buy, the less likely the product will succeed. Firms can identify these customers either through past purchases of new products that failed, or through past purchases of existing products that few other customers purchase. We discuss how these insights can be readily incorporated into the new product development process. Our findings challenge the conventional wisdom that positive customer feedback is always a signal of future success.

The authors aren’t specific, but might another word for such people be “Kickstarter participants”?
link to this extract

You disabled Flash in your browsers, but is that enough? » Fortinet Blog

Bing Liu:

Flash files can not only be embeded in a web page but also in various document formats such as Microsoft Office documents and PDF files. Even if you have disabled Flash in your browsers, Flash exploits can still leverage Flash player vulnerabilities through software like Microsoft Office and Adobe Reader. Let’s do some tests. I will use the PoC of CVE-2015-5122 from the Hacking Team in my test. It will pop up the caculator program when loaded in browsers and other applications that have a vulnerable Flash plugin enabled.

Oh god, please can Flash DIAF?
link to this extract

iPhone, iPad study shows trade stats dramatically overstate the value of US imports from China » American Enterprise Institute

Mark Perry:

This study [from 2011] also confirms our earlier finding that trade statistics can mislead as much as inform. Earlier we found that for every $299 iPod sold in the U.S., the U.S. trade deficit with China increased by about $150. For the iPhone and the iPad, the increase is about $229 and $275 respectively. Yet the value captured from these products through assembly in China is around $10. Statistical agencies are developing tools to gain a more accurate breakdown of the origins of traded goods by value added, which will be attributed based on the location of processing, not on the location of ownership. This will eventually provide a clearer picture of who our trading partners really are, but, while this lengthy process unfolds, countries will still be arguing based on misleading data.

Makes sense: the assembly in China doesn’t really create significant value. Moving those jobs back to the US (which is impossible: the infrastructure isn’t there) wouldn’t make a lot of difference either. (Via Eugene Wei.)
link to this extract

Nanotec Systems NESPA #1 » 6moons audio reviews

The procedure is simple. Place a CD or DVD inside the black box, secure the disc with the magnetic puck and rock the switch. The disc will start spinning and the light will flash 120 times in a 2-minute period. After that, the disc will stop spinning and voila, the disc is finalized.

The flash applied is rated at 1000mW/sec, has a temperature of 5500K and light intensity of one million Lux. So in fact the disc is exposed to sunlight without destroying it.

So marvellous. (Via Peter Bright.)
link to this extract

Apple iPhone 6, the bestselling smartphone for 10 months straight » Counterpoint Technology Market Research

Every year we’ve seen the pattern of the iPhone topping the list in the fourth and first quarter of the year, while the Galaxy S tops the second and third quarter. This pattern now seems to have been broken as the iPhone 6 continues to top the list since September 2014.

The highly anticipated Galaxy S6 Edge was plagued with supply issues in the first month and now suffers from its high price tag – quickly losing its flare as a consequence. We see its sales figures declining since its launch in April. This is a heavy blow to Samsung as it has no other new model launched in 2015 in the top 10 best sellers list.

The list goes: iPhone 6, iPhone 6 Plus, Samsung GS6, Samsung GS6 Edge, iPhone 5S, Xiaomi Mi Note, Samsung Galaxy S5, Samsung Galaxy Note 4, Xiaomi Redmi 2, LG G4. (Relative sizes not given.) This is the first time LG has been in there this year; Xiaomi’s presence is a clear and present danger to Samsung.

Note that the data is for sales to users, not shipments to carriers.
link to this extract

Downward trend: Korean smartphone makers struggle in Latin American market » BusinessKorea

Cho Jin-young:

Korean smartphone makers are expected to face a crisis after showing good performance in Latin America. Samsung Electronics accounted for 29.5% of the smartphone market in Latin America during Q1 2015, down 10% or more compared to the same period last year, according to Hong Kong-based market research firm Counterpoint Research. LG Electronics, which was the second-most-popular smartphone vendor in the region, also experienced a decline in market share within a year, from 14% to 10.9%. The combined share of the two Korean companies amounted to 52.4% in Q1 2014, but the figure for Q1 2015 was 40.4%. Therefore, it is urgent for two Android phone makers to come up with measures to address the problem.

In contrast, a shift in the center of gravity for the global smartphone market is predicted to become a golden opportunity for Chinese firms that mainly produce entry-level and mid-range smartphones. Xiaomi recently entered the Brazilian mobile phone market by showcasing the Redmi2, a mid-range model, in line with the current market environment. The Chinese company decided to produce Android phones in Brazil for local consumption by asking Foxconn to assemble their products in the country.

More concerning for them is that sales of smartphones in Latin America are slowing down – so that’s a falling share in a falling or static market.
link to this extract

Hackers remotely kill a Jeep on the highway—with me in it » WIRED

Andy Greenberg:

The attack tools [Charlie] Miller and [Chris] Valasek developed can remotely trigger more than the dashboard and transmission tricks they used against me on the highway. They demonstrated as much on the same day as my traumatic experience on I-40; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.

Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep’s brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say they’re working on perfecting their steering control – for now they can only hijack the wheel when the Jeep is in reverse.

All this is remote and wireless – they aren’t directly plugged in to the car: the car’s phone connection makes it vulnerable if you know its IP address. Let’s just hope these cars aren’t running Flash.
link to this extract

@EricaJoy’s salary transparency experiment at Google (with tweets) » Storify

Joy started a spreadsheet inside Google on which she shared her salary and details about bonuses (she wasn’t receiving any). The sheet went viral inside the organisation. Some choice extracts:

“I was invited to talk to my manager on Mon or Tues. Higher up people weren’t happy. She wasn’t happy. “Why did I do it? Don’t you know what could happen?”

“Nothing. It’s illegal to retaliate against employees for sharing salaries.”

“Wellll….

And another observation of Joy’s:

“Fighting for justice & fairness INSIDE Google doesn’t go over well. Salary sharing is only 1 example. Blogger porn. Real names. Many others.”

One can see how any company would be uncomfortable at having employees all virally sharing details of their remuneration. The irony of Google, which so insists that All Must Be Known And None Shall Be Hidden, getting a taste of it, is quite a thing to behold. (Joy left Google and is now at Slack.)
link to this extract

CityCyclist 1.0 » scraplab

Tom Taylor:

For a few months, in slivers of spare time, I’ve been working on a little app for city bike navigation, called CityCyclist.

I’ve tried to build something clean and accessible, that gets a good bike route on the screen as quickly as possible. That’s glanceable while on a bike, and more useful when off.

Key innovations: there’s a little scrubber on the elevation profile at the bottom to fly quickly along a route without zooming and panning around. My hypothesis was that might make it easier to consign a route to memory. I suspect that’s not true, but I still like it.

The search results use a combination of Foursquare and Apple’s address geocoder, and seem fairly good.

The routing is powered by CycleStreets (backed by OpenStreetMap) with a selection of three options: fast, balanced, quiet. (UK only for now.)

The height detail is really nifty. And yes, cyclists have very different routing needs from drivers or walkers.
link to this extract

Start up: Windows 10’s puzzle, Adobe’s coming obituary, our digital romances, and more

Posted on by
Reply


A better sound to be found inside? Photo by pumpkinmook on Flickr.

A selection of 8 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Windows 10 signifies Microsoft’s shift in strategy » The New York Times

Nick Wingfield:

in recent years, Windows has become an afterthought for many software developers, who have turned to the huge and engaged audience on smartphones. That shift has left Microsoft in a precarious position with consumers in recent years.

To generate more interest from developers, Microsoft has designed Windows 10 to run on PCs, smartphones and other devices, which is meant to make it easier for developers to write apps that run across all of them. And the company has sworn there will be one billion devices running the software in the next two to three years, giving developers a huge potential market to reach with their creations.

“I think we will see really huge adoption” of Windows 10, said Kevin Sather, director of product marketing for systems at Razer, a maker of high-end gaming computers and other devices.

The benefits of fast and free adoption of Windows 10 could well outweigh the revenue Microsoft is giving up. The company does not disclose how much upgrade revenue it normally makes from a new operating system, but analysts estimate that it is small compared with the other ways the company makes money from the operating system.

What this doesn’t explain is why Windows 10, even free, should suddenly make consumers devote any more time to their PCs, or buy Windows tablets any more than they do. Obviously Microsoft is a business-oriented company. So will this actually make any difference at all to the general direction of travel, away from the desktop to mobile? I just don’t see it.
link to this extract

Free sound improving techniques » PWB Electronics

Try the freezing experiment using a CD first – they are usually the easiest object to hand. If you have two identical CDs all the better as you can keep one CD as the control (no treatment) and put the other CD through the freezing/slow defrost process.

Place one CD in a plain plastic bag and place this bag in the domestic deep freezer overnight. When you remove the CD from the freezer, allow it to return to room temperature very, very slowly. You can achieve a slow defrost quite easily by wrapping it in a towel or blanket. Listen to the CD which has been through the freezing process first and then see if you can listen to the other (unfrozen) CD with the same pleasure !! Putting the previously frozen CD through the freezing/slow defrost process a second time gives you a further improvement in the sound.

Impossible to distinguish from satire. Or reality.
link to this extract

Only around 15% of WP 8.1 users to upgrade to Windows 10 Mobile? » All About Windows Phone

Steve Litchfield:

There’s something of a blanket assumption that everyone currently using Windows Phone 8.1 will upgrade to Windows 10 Mobile – after all, Microsoft has been promising that ‘majority’ of users will join the Window 10 ecosystem. But, after a few recent experiences of mine with budget devices, I thought it worth sounding a note of caution and reality – I’d put money on the actual conversion numbers to Windows 10 Mobile being significantly less than 50% and maybe as low as 15%.

He tested trying to update to Windows 10 Mobile on wiped-clean Lumias. It wasn’t great. Why? Storage: some of those low-end phones just won’t have the spare space – especially for those with any apps installed.
link to this extract

Tech world prepares obituary for Adobe Flash » WSJ

Robert McMillan:

in 2007, along came the iPhone. Adobe engineers embraced it immediately. “Everyone who was in the organization was carrying an iPhone,” said Carlos Icaza, an Adobe senior engineer at the time.

But Apple’s smartphone also troubled Mr. Icaza, who was in charge of Flash development on mobile phones. Flash had become bloated over the years and required lots of computing power to run. That wasn’t a big deal on PCs, but on mobile phones, with their limited battery life, it was a major problem, and Apple had opted not to support the technology.

Flash needed a major rewrite to work on the iPhone, but Mr. Icaza couldn’t get his superiors to allocate the necessary resources.

“For me, it was, ‘What the hell is going on? We have this amazing device that is going to change the world and everybody knows it,’” he said in an interview. “Nobody at the organization was trying to make Flash work on this device.”…

…Adobe itself now considers Flash to be immaterial to its business, meaning that it accounts for less than 5% of company revenue, but it is still widely used on websites built for browsers. The software runs on under 6% of the Internet’s home pages and its use is declining, according to BuiltWith Pty Ltd, which tracks Internet technology.

You don’t hear that 6% stat thrown around much, do you?
link to this extract

I tried all the apps that are supposed to mend a broken heart » Fusion

Kristen Brown:

A few months into the relationship I’d asked Siri to remember which of the many Johns* [*his name wasn’t John] in my contacts was the one I was dating. At the time, divulging this information to Siri seemed like a big step — at long last, we were “Siri Official!” Now, though, we were Siri-Separated. Having to break the news to my iPhone—my non-human, but still intimate companion—surprisingly stung.

Siri wasn’t the only screen-based trial of my break-up. Our relationships now exist across networked webs of digital connections, webs that we build up each time we begin a new romance and then must painfully break down when one ends. When I flicked open my laptop at work, the bottom-right corner was empty where a Google chat had previously sat waiting for me. Notifications of unread Snapchat messages used to lead to goofy photos of John, but now they’re just, disappointingly, announcements from Team Snapchat. Every time I send a note to a particular group of friends, Google’s algorithm suggests I add John to the e-mail thread.

Our relationship was the digital equivalent of moving in together, and now painful memories of him were scattered all over my online home. Technology was making my heartache worse, but that’s not how these things are supposed to work: Technology is supposed make our lives easier, so I sought out tech fixes for a broken heart.

link to this extract

Online cheating site AshleyMadison hacked » Krebs on Security

Brian Krebs:

In a long manifesto posted alongside the stolen ALM data, The Impact Team said it decided to publish the information in response to alleged lies ALM told its customers about a service that allows members to completely erase their profile information for a $19 fee.

According to the hackers, although the “full delete” feature that Ashley Madison advertises promises “removal of site usage history and personally identifiable information from the site,” users’ purchase details — including real name and address — aren’t actually scrubbed.

“Full Delete netted ALM $1.7mm in revenue in 2014. It’s also a complete lie,” the hacking group wrote. “Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed.”

Their demands continue: “Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.”

link to this extract

The Apple Watch review » Anandtech

Joshua Ho and Brandon Chester:

Although this is a review of the Apple Watch, the Apple Watch will ultimately be quickly forgotten with the launch of future iterations of the Apple Watch. After all, Apple is not trying to sell the world on the idea of a smarter watch, but the idea of a watch altogether.

For those still deciding on whether the first Apple Watch makes sense, I have no reservations in saying that it’s the best wearable I’ve ever used. However, at the same time I find it hard to recommend this first-generation Apple Watch. It’s clear that there are far too many obvious areas to improve upon, areas where Moore’s law will help to dramatically improve the experience. In the case of smartphones, Moore’s law made it possible to deliver true all-day battery life and fluid app performance. After spending a few months with the Apple Watch, all I can see is a need for more compute and battery life, like what happened with smartphones.

Finally, we get back to the question of whether Apple will be sell people on the concept of a watch. In the months since I first used the watch I’ve ended up wearing it every day. I distinctly noticed its absence when I forgot the charger on a trip. I don’t know if Apple will succeed in convincing others of the utility of a watch, but they’ve definitely convinced me.

To the despair of graph-lovers everywhere, the authors declare that they can’t figure out a standard method for testing battery life, because you can configure the Apple Watch and Android Wear to behave so differently on notifications. But I agree with their conclusion – what you begin to notice, increasingly, over time is the utility.
link to this extract

Dropdowns should be the UI of last resort » LukeW

Luke Wroblewski:

No one likes filling in forms. And the longer or more complicated a form seems, the less likely we are to jump in and start filling in the blanks -especially on small screens with imprecise inputs (like our fingers).

dropdowns v tabs

While there’s two extra fields in the “painful” version above, the primary difference between these two flight booking forms is how they ask questions. One makes use of dropdown menus for nearly every question asked, the other uses the most appropriate input control for each question.

Dropdowns really are a pain, but it takes this post to point out quite why. There’s a longer writeup with links to video clips too.
link to this extract

Start up: Google and real accident rates, who really buys iPods?, Reddit and trolls, and more

Posted on by
1


Apple Music is available if you’re running iOS 8.4. Photo by danielooi on Flickr.

A selection of 7 links for you. Do you feel lucky? Well, do ya, punk? I’m charlesarthur on Twitter. Observations and links welcome.

Apple Music adoption » Mixpanel Trends

This is amazing: from 29 June, when iOS 8.4 was released (bringing Apple Music), Mixpanel’s measurement suggests that it passed 50% of all installed iOS devices by 16 July. That’s less than three weeks. It’s gaining about 1% per day. There has to be an upper limit, but it’s pretty high – 84% of devices are running iOS 8.

This also means, if Mixpanel is representative, that about 200m devices could already be able to try Apple Music.
link to this extract

The view from the front seat of the Google self-driving car, chapter » Medium


(That’s Google’s SDC being rear-ended on July 1 in the right-hand lane: the car causing the crash doesn’t even brake.)

Chris Urmson, who leads Google’s SDC effort:

National crashes-per-miles-driven rates are currently calculated on police-reported crashes. Yet there are millions of fender benders every year that go unreported and uncounted  —  potentially as many as 55% of all crashes, according to the National Highway Traffic Safety Administration. (None of the accidents in which people hit us resulted in a police report  —  not even the July 1 crash, even though the police were on site.) Furthermore, the numbers that are available don’t distinguish between miles-driven before causing a crash vs simply being involved in one. This all means no one knows the real crashes-per-miles-driven rates for typical American streets.

link to this extract

Who’s actually buying iPods these days? » BirchTree

Former Target manager Matt Birchler:

Kids would buy (or their parents would buy for them) the iPod Touch because of 3 things:

• It played games (Minecraft, mostly)
• It had YouTube
* It could stream music

A lot of families stopped buying iPod Touches once the iPad Mini got down to the $249 price point. You get a lot more device for your buck, and Touch sales dropped off very quickly. I could go on and on about this, but young kids love iPads more than most of us 20-30 somethings can imagine.

You also see more and more kids just using a hand-me-down smartphone that the parents have since upgraded from.

And then there were older people who bought Touches. They were more rare, but they were people who wanted something to FaceTime with their kids/grandkids. Maybe they wanted to use a couple apps they had heard about, but didn’t want to pay the ridiculous data fees to get them on a smartphone. This was a much smaller market, and many of them would end up buying an iPod Nano (for reasons I’ll address in the next section).

Nano and Shuffle had very different audiences. I asked who used to buy the Classic; his reply: “You’d be shocked how few were sold. Let’s just say it’s too few for me to draw any real conclusions.”
link to this extract

HTC won’t ship the Grip after all, but its fitness ambition lives on » Engadget

Chris Velazco:

Hey, remember that time HTC built a fitness tracker (with a little help from Under Armor) and showed it off in Barcelona? The one that was originally slated for a Spring launch? Well, we’re knee-deep in Summer already, and the company just confirmed to us that it no longer plans to ship the Grip we’ve already seen. As a spokesperson put it, the company “decided to align Grip with the entire product portfolio for health and fitness launching later this year” after “extensive wear testing and user feedback.” In other words, the exact Grip we saw in Spain won’t hit the market, but something better will.

Uh-huh. Let’s see how this progresses. HTC made the right call putting off its smartwatch (pre-announced in February 2014); this would also be a tough sell when it’s losing money. Problem is, how do you make money except with new things?
link to this extract

How iCloud Drive deletes your files without warning » Michael Tsai

Tsai quotes Mark Jaquith:

let’s say that, on your shiny new Mac, you want to move these files from iCloud Drive to your local hard drive, or to another synced drive like Google Drive or Dropbox. Well, you can just drag their folders do the other destination, right? You sure can. Apple kindly warns you that your dragging action is moving that folder, and that the files will be moved to your Mac, and won’t exist on iCloud Drive anymore. Fine. That’s what dragging a file from one place to another generally does!

But what happens if there are files inside this folder that haven’t yet synced to your local machine? Well, the move operation will be slower, because your Mac has to first download them from iCloud Drive. But once they download, they’ll be in their new location. Right?

Nope. Those files are now gone. Forever.

Tsai then follows up to show that Apple knows about this – though also pulls together other comments, including one from an ex-Apple services employee, showing that this problem is known internally, but it is being starved of funding.
link to this extract

Former Reddit CEO Ellen Pao: the trolls are winning the battle for the Internet » The Washington Post

To understand the challenges facing today’s Internet content platforms, layer onto that original balancing act a desire to grow audience and generate revenue. A large portion of the Internet audience enjoys edgy content and the behavior of the more extreme users; it wants to see the bad with the good, so it becomes harder to get rid of the ugly. But to attract more mainstream audiences and bring in the big-budget advertisers, you must hide or remove the ugly.

Expecting internet platforms to eliminate hate and harassment is likely to disappoint. As the number of users climbs, community management becomes ever more difficult. If mistakes are made 0.01% of the time, that could mean tens of thousands of mistakes. And for a community looking for clear, evenly applied rules, mistakes are frustrating. They lead to a lack of trust. Turning to automation to enforce standards leads to a lack of human contact and understanding. No one has figured out the best place to draw the line between bad and ugly — or whether that line can support a viable business model.

The basic problem is that we remember the vicious words and acts more than the kind ones; possibly we’re evolutionarily set out that way.
link to this extract

Dozens of phone apps with 300M downloads vulnerable to password cracking » Ars Technica

Dan Goodin:

many smartphone apps still allow users to make an unlimited number of login attempts. That failure allows attackers to cycle through long lists of the most commonly used passwords. Given the difficulty of entering strong passwords on smartphone keyboards, it’s a likely bet that it wouldn’t be hard to compromise a statistically significant number of accounts over a period of weeks.

According to research from smartphone security firm AppBugs, dozens of Android and iPhone apps downloaded more than 300 million times contain no limits on the number of logins that can be attempted. Per the company’s disclosure policy, researchers give app developers up to 90 days to fix vulnerabilities before making them public. That means most of the 50 or so apps identified by AppBugs still aren’t being made public. Still, the grace period has expired on at least 12 apps, including those from CNN, ESPN, Slack, Expedia, Zillow, SoundCloud, Walmart, Songza, iHeartRadio, Domino’s Pizza, AutoCAD, and Kobo. Three other apps, from Wunderlist, Dictionary, and Pocket, were found to be vulnerable but were later fixed after AppBugs brought the weaknesses to the developers’ attention.

link to this extract

Start up: YouTube’s smartest change, Google + Huawei, the truth on ads, Windows Phone redux, and more

Posted on by
Reply


When Javascript hits a particular temperature… Photo by Tom Gill on Flickr.

A selection of 11 links for you. Too much, right? I’m charlesarthur on Twitter. Observations and links welcome.

The ‘terrifying’ moment in 2012 when YouTube changed its entire philosophy » Business Insider

Jillian D’Onfro:

the discovery algorithm often recommended videos that weren’t the best fit. For example, if a user searched for the footage from a recent fight, YouTube might recommend a clip with a thumbnail image of a juicy punch and a title about someone getting knocked out. When the user clicked, the actual video would be not fight footage, but a dude sitting in his living room just talking about the epic punch.

But when the frustrated user clicked through several different videos, the algorithm tallied up the views and counted it as an accomplishment.  

“We realized that if we made the viewer click that many times, it didn’t seem to be a good estimate of how much value they were deriving from YouTube,” [YouTube’s director of engineering for search and discovery, Cristos] Goodrow said. “Instead, we realized that if they didn’t leave a video and continued watching, that seemed like a better estimate of the value they were getting.” 

So, after bouts of data collection and analysis coupled with countless meetings, YouTube re-jiggered its search-and-discovery algorithm on March 15 to make watch time, not views, the determining factor in what videos to recommend.

Seems obvious. But actually, that’s the sort of customer dissatisfaction that’s really hard to spot in the first place, and then really hard to change – because it upsets the existing order.

Google’s best Android friend » The Information

Amir Efrati:

Unlike other Android hardware partners like Samsung and Xiaomi, Huawei has no ambition whatsoever to compete with Google in mobile software and services. Huawei has agreed to help Google distribute a mobile app store in China, a market where Google has largely been shut out, say people briefed on the talks between the companies. (It remains to be seen whether Google can get a green light from the government to do so.)

Huawei, whose core networking-equipment business has helped it develop relationships with wireless carriers globally, could help Google expand its nascent wireless network service outside the U.S. and work on other wireless experiments to expand Internet access in emerging markets. Google might also seek to license some of Huawei’s patents in that area.

Meanwhile, Huawei this fall will become the first mainland China manufacturer to produce a “Nexus” smartphone together with Google, people with direct knowledge of the project have said. While the phone likely won’t be a big seller, it will serve as a status symbol for a privately-held Chinese firm that is trying to boost its consumer brand around the world and be as beloved as Coca-Cola.

Risky game for Google: Huawei has found it impossible to shake off suspicions in the US about its Chinese ownership and allegations of spying. There’s absolutely no evidence against Huawei, but that isn’t an obstacle for some.

Content blockers, bad ads, and what we’re doing about it » iMore

Rene Ritchie explains why there are sometimes tons of ads on iMore pages – which led one person to write a content blocker for iOS 9. This part though is worth noting:

Just as desktop ads pay far less than old-fashioned print ads, mobile ads pay far less than desktop. Because phone displays are smaller than desktop, ads are also far harder to ignore. They’re not off to the side or a small strip on a big screen. They’re in our faces and in our way.

As more and more people move to mobile, revenue goes down, and the typical response is to amp up the ads in an attempt to mitigate the loss. That, of course, just makes them even more annoying.

Ad networks have not responded well to any of this. Hell, they still haven’t fully responded to Retina and HiDPI displays, and those came out in 2011.

You’d think the ad industry would be at the forefront of user experience, and that making gorgeous, high performance, highly engaging ads would boost conversion and ultimately income for everyone. Unfortunately, it seems like whatever math they’re running shows crappy ads perform well enough that making great ads isn’t worth the extra effort.

Note that first paragraph: “because phone displays are smaller than desktop, ads are also far harder to ignore”. In that case, why do they pay less on mobile, which has more readers?

Scary internet scam becoming disturbingly common » TidBITS

Randy Singer:

While the legions of Mac viruses still haven’t appeared, there is a new nasty out there that takes advantage of this paranoia. It isn’t a virus, a Trojan Horse, or any other sort of actual malware. Instead, it’s more like a phishing scam, using social engineering to get you to do something that the bad guys want you to do. It does it by scaring the willies out of you, and it is becoming disturbingly common. Some call it “scareware” or “ransomware.”

What happens is that you visit a Web site and seemingly have your browser maliciously frozen. You’ll find that you can’t quit, nor can you navigate away from the page by clicking the Back button.

Next, a page or pop-up appears telling you any of a number of stories (often tailored to your location), perhaps that your Mac has a problem or has illegal material on it, or that your data has been encrypted by some malevolent entity.

The real culprit: a (non-destructive) Javascript hack. But if you follow the scam instructions, you will have a real problem.

Musings on autonomous transport: are self-driving Starbucks the future? » Core77

Michael Ditullo:

what happens when the car evolves from a means of transport to a place itself? Commuting to work? Take a Starbucks owned and operated car where you can get a latte and lounge at a table while working on your laptop along the way. A long drive to see the in-laws? Call for a movie car where you can watch a Michael Bay blockbuster in full surround sound on that two hour ride. Need to run some errands and grab lunch? Sounds like a burrito car. Need to work off the day’s stress on the way home? Pick from a workout car or a zen meditation car.

Once upon a time Starbucks called itself the “third place.” Not home, not work, that other place you wanted to go in-between. The self-driving car could very well evolve into that third place, but a place on-the-go. The in-between place becomes something that can also get you where you need to go. I imagine an entire crop of small businesses existing solely on cars. The payment in exchange for the goods and services these businesses provide would pay for the car journey itself.

This all assumes that we’ll need to travel to exactly the same extent. Can we be sure that’s true? Why take the Michael Bay blockbuster car if you could get the same at home? Does the car become a relief from home? So many assumptions are built into the way we view self-driving cars. More working from home, less travel?

The three unlikely lessons from the Microsoft/Nokia Adventure » VisionMobile

Michael Vakulenko:

Looking at the industry through the lens of software-defined business models has helped us to accurately predict years before the story unraveled the duopoly of Apple and Google (2009), the demise of Palm (2009), the outcome of HP’s foray into mobile with WebOS (2010), BlackBerry’s meltdown (2010), and the failure of Windows Phone (2012).

The story repeats in Internet of Things. Much like in mobile, software-defined business models cause deep shifts in how value is created and delivered. The IoT winners will be decided by business model innovation, not by technology, product features or standard committees. VisionMobile’s Stijn Schuermans wrote about it here – What the Internet of Things is not about.

How bad is it for Microsoft if it misses out on the IoT?

Microsoft takes $7.6bn Nokia writedown and cuts 7,800 jobs » FT.com

Richard Waters and Richard Milne with the collateral damage:

The job cuts will include 2,300 of the 3,200 remaining Nokia handset workers in its home country of Finland, adding to a decline in the pulp and paper industry that has led some to dub it the new “sick man” of Europe as unemployment and public debt levels have risen.

Microsoft took on 25,000 workers with the acquisition in April last year, inflating its headcount to 128,000. By the end of March this year it had cut its workforce back to about 119,000.

“In practice, this means the end of Nokia’s old business in Finland,” Juha Sipilä, the country’s prime minister, told a hastily-convened press conference on Wednesday. The situation is so serious in the country, which has been mired in recession for the past three years, that the new centre-right government has called for an extra budget in September to help the affected workers.

Also in the story:

“It’s a repudiation of the Ballmer strategy to buy Nokia,” said Ken Dulaney, an analyst at Gartner. Microsoft should have acquired BlackBerry instead to focus on its core business users, he added — a strategy that the company backed on Wednesday, as Mr Nadella announced a narrowing of the handset division’s focus to making handsets for workers and a smaller number of “flagship” devices.

Yes: Microsoft really should have bought BlackBerry. Wouldn’t have cost much more, and would have been a valuable asset adding to what it’s trying to do. Love to know the discussions that happened, or didn’t, over that.

Wikileaks release indicates Hacking Team sold spyware to FSB, Russia’s secret police » Forbes

Tom Fox-Brewster:

in December 2012, a NICE employee asked Hacking Team whether it had sold directly to the FSB rather than via the Israeli company.

“Yes we did,” the Hacking Team employee responded. “We discussed this opportunity in the past and you were aware of the fact we were working there. I’d like to take advantage of this conversation to ask you a feedback about Azerbaijan.”

Asked about working in Russia, Hacking Team head of communications Eric Rabe said: “We have not sold to blacklisted countries — at least when they were actually on a blacklist. As you know these things can change and a country, that is considered respectable, may later on turn out not to be.”

So classy. Here’s the Wikileaks link, if you’ve got a few spare years to read through the emails.

Hacking Team Flash zero-day tied to attacks in Korea and Japan… on July 1 » Trend Micro

Weimin Wu:

Earlier this week several vulnerabilities were disclosed as part of the leak of information from the Italian company Hacking Team. We’ve noted that this exploit is now in use by various exploit kits. However, feedback provided by the Smart Protection Network also indicates that this exploit was also used in limited attacks in Korea and Japan. Most significantly, these took place before the Hacking Team leak took place; we first found this activity on July 1.

The exploit code we found is very similar to the code published as part of the Hacking Team leak. As a result of this, we believe that this attack was carried out by someone with access to the Hacking Team tools and code.

According to the Adobe security bulletin, the vulnerability CVE-2015-5119 affects all of the latest Flash versions on Windows, Mac, and Linux. Adobe has since provided a security update for this vulnerability.

Not clear from this – and apparently not to Trend Micro either – whether this attack was by Hacking Team, or by someone who had already broken into their systems and was using this attack for themselves.

In other news, Adobe’s security update team must be one of the hardest-working in the industry.

Apple plans record number of new iPhones » WSJ

Lorraine Luk and Daisuke Wakabayashi say it has ordered 85m-90m devices – up from 70m-80m last year:

The changes in the iPhone models expected to be released later this year will be less noticeable than last year’s. The phones are expected to feature Apple’s Force Touch technology that can distinguish between a light tap and deep press, allowing users to control a device differently depending on how hard they push on the screen, according to people familiar with the matter. Apple has added this feature to the Apple Watch and MacBook laptop computer.

In addition to keeping the display size unchanged, Apple is expected to keep the screen resolution about the same, according to people familiar with the matter.

It may offer a fourth color for the aluminum casing of the iPhone, in addition to silver, gold and space gray, these people said.

Force Touch is being signalled so strongly it would be surprising if it weren’t there. (I’ll elucidate later.)

Finland enlists convicted Lizard Squad hacker to fight cyber crime » Newsweek

Caroline Baylon:

17-year-old Julis Kivimaki, a member of the infamous Lizard Squad hacking group, was found guilty of over 50,000 counts of computer crime by a Finnish court, local media have reported, but rather than face prison time, the judge has ordered that Kivimaki himself help “fight against cyber crime”.

The extent of Kivimaki’s punishment will be a two-year suspended sentence, the confiscation of his computer, and being made to return some €6,500 in profits earned from cyber crime.

Kivimaki, known by the online nickname “zekill”, has been hacking since age 15 and committed a wide range of attacks directed at individuals, engaging in online harassment and identity theft, as well as corporations, where he triggered data breaches, hijacking of emails, and stealing credit card information.

To catch a thief…

Start up: Lightning at Twitter, academic publishers strangle libraries, that iOS/OSX hack explained, and more

Posted on by
2


Do you recognise this person? Photo by Tim Dorr on Flickr.

A selection of 8 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

New smart home gadget called ELLA Assistant wants you to put down your phone » Tech In Asia

Steven Millward:

The startup team, which is based in Shanghai, sees it being used for things like telling you that you should take an umbrella, reminding you that you’re running late to an appointment, or for turning off all your smart lights at once. With a single press, it could alert your significant other that you’re leaving the house.

All that will depend on it working nicely with the brand of smart lights that you have, or syncing with the online calendar service that you use. The fact that the ELLA Assistant is subservient to your phone and other smart gadgets means it has to work with them all with ease, or it won’t gain favor with consumers. War tells Tech in Asia that the team will add support for various things as demand arises, but there are no specific supported devices or services listed yet – which is because the little gizmo hasn’t even launched. Once it’s out, it’ll have its own app store.

The ELLA Assistant will hit Kickstarter some time in August.

Hmm. Don’t think so, somehow.

This is Twitter’s top secret Project Lightning » BuzzFeed News

Mat Honan:

Project Lightning will bring event-based curated content to the Twitter platform, complete with immersive and instant-load photos and videos and the ability to embed those experiences across the Web — and even in other apps.

“It’s a brand-new way to look at tweets,” says Kevin Weil, who runs product for the company. “This is a bold change, not evolutionary.”

It is also still a few months out, and things could change. But here’s how it will work.

On Twitter’s mobile app, there will be a new button in the center of the home row. Press it and you’ll be taken to a screen that will show various events taking place that people are tweeting about. These could be based on prescheduled events like Coachella, the Grammys, or the NBA Finals. But they might also focus on breaking news and ongoing events, like the Nepalese earthquake or Ferguson, Missouri. Essentially, if it’s an event that a lot of people are tweeting about, Twitter could create an experience around it.

This likely comes out of the machine-intelligence-curated tweet streams from a company that Twitter just bought – under Costolo’s leadership, don’t forget. He just took too long to do it. (By the way, in future could “top secret” – used in the headline – please be reserved for things that actually are top secret, such as the content of the Snowden documents, and not PR-led product demos by the CEO?)

Academic publishers reap huge profits as libraries go broke » CBC News

Researchers rely on journals to keep up with the developments in their field. Most of the time, they access the journals online through subscriptions purchased by university libraries. But universities are having a hard time affording the soaring subscriptions, which are bundled so that universities effectively must pay for hundreds of journals they don’t want in order to get the ones they do.

Larivière says the cost of the University of Montreal’s journal subscriptions is now more than $7m a year  – ultimately paid for by the taxpayers and students who fund most of the university’s budget. Unable to afford the annual increases, the university has started cutting subscriptions, angering researchers.

“The big problem is that libraries or institutions that produce knowledge don’t have the budget anymore to pay for [access to] what they produce,” Larivière said.

“They could have closed one library a year to continue to pay for the journals, but then in twenty-something years, we would have had no libraries anymore, and we would still be stuck with having to pay the annual increase in subscriptions.”

The kicker: the five largest academic publishers produce 53% of scientific papers in natural and medical sciences – up from 20% in 1973. Consolidation and monopoly.

EFF and eight other privacy organizations back out of NTIA face recognition multi-stakeholder process » Electronic Frontier Foundation

Jennifer Lynch:

Despite the sensitivity of face recognition data, however, the federal government and state and local law enforcement agencies continue to build ever-larger face recognition databases. Last year the FBI rolled out its NGI biometric database with 14-million face images, and we learned through a Freedom of Information Act (FOIA) request that it plans to increase that number to 52-million images by this year. Communities such as San Diego, California are using mobile biometric readers to take pictures of people on the street or in their homes and immediately identify them and enroll them in face recognition databases. These databases are shared widely, and there are few, if any, meaningful limits on access. 

EFF has been especially concerned about commercial use of face recognition because of the possibility that the data collected will be shared with law enforcement and the federal government. Several years ago, in response to a FOIA request, we learned the FBI’s standard warrant to social media companies like Facebook seeks copies of all images you upload, along with all images you’re tagged in. In the future, we may see the FBI seeking access to the underlying face recognition data instead.

Huh. The FBI does that, does it?

Apple criticised over ‘presumptuous’ news app email » BBC News

Kevin Rawlinson:

According to Graham Hann, the head of technology, media and communications at the law firm Taylor Wessing, the terms of the deal are broadly in line with industry standards – except the requirement to opt out.

“The content of the notice is not unusual, although it has deliberately been dumbed down, possibly for clarity,” he told the BBC.

“However, the optout approach is very unusual and I don’t see how the notice could form a binding contract without a positive reply.

“Apple clearly wants to launch with as much content as possible and has taken this risk-based approach. Some publishers may object and even threaten to sue.

“However, I think it would be hard to claim damage beyond a reasonable royalty fee.”

Soooo… it’s not actually a big deal?

Internet TV boxes: Nvidia pips Google for Android » FT.com

Tim Bradshaw:

while [Android TV] mostly got the dictation right, it often failed to produce the results I was looking for. Asking for Breaking Bad brought up detailed information about the show and its actors, but no way to watch it. This query also produced a link to Pomodoro Wear, a countdown timer app shaped like a tomato and designed for Google’s Android Wear smartwatch platform.

Even Google itself does not seem to know quite how to use Android TV. Its marketing materials suggest asking for “romantic comedies set in New York”. But when I tried that on the Android TV itself, it produced only a list of YouTube videos, the first of which was about Lego sets from a New York toy fair. With no When Harry Met Sally or Manhattan to be found, I can only wonder whether anyone else — including Google’s own staff — has ever searched for something to watch this way.

Bear in mind that Apple experimented with the same voice dictation system for TV and, by the account in the WSJ, abandoned it.

XARA exploits on Mac, iPhone, and iPad, and what you need to know » iMore

Rene Ritchie with a series of Q+As on the vulnerability disclosed yesterday:

Q: So were the App Stores or app review tricked into letting these malicious apps in?

A: The iOS App Store was not. Any app can register a URL scheme. There’s nothing unusual about that, and hence nothing to be “caught” by the App Store review.

For the App Stores in general, much of the review process relies on identifying known bad behavior. If any part of, or all of, the XARA exploits can be reliably detected through static analysis or manual inspection, it’s likely those checks will be added to the review processes to prevent the same exploits from getting through in the future

Apparently apps now have to state the URL schemes they will use in plaintext in a .plist file; that’s easy to review, and Apple can easily spot duplicates by static testing. Security researchers suggest Apple probably began adding such tests when it was told about the weakness – so this is perhaps already “fixed” in the simplest way it can be. (Checking plist files can be done retrospectively too.)

How useful will Google Now be? » Naofumi Kagami

With Google announcing Google Now on Tap at Google I/O 2015 and Apple announcing Proactive at WWDC 2015, there is now a lot of discussion on how useful these predictive personal assistants will be. In particular, there is a lot of discussion on how much data these personal assistants will need to collect about you, and whether these assistants need to send this data to be analysed in the cloud.

The problem I have with these arguments is that they do not go into specifics. Instead of say “everything is going to be cool”, we should be having a detailed discussion of how each predictive recommendation is actually made, and whether each recommendation could be performed easily on your local device, or whether it needs to be done in the cloud.

I think Kagami’s question is really “What things need to be in the cloud for predictive analysis to work?” You could argue that traffic or transit news needs to be analysed in the cloud (a la Google) so it can warn you about delays; but on the other hand, an Apple device could pull that data from the cloud, and look at what’s in your device, and warn you too.

So the quest goes on.

Start up: Apple’s hacker flaw, Downing St’s FOI oddity, machines that parse art, and more

Posted on by
Reply


“You mean all we need to do to defeat him is adopt HTML5? Why didn’t you say?” Photo by Tom Simpson on Flickr.

A selection of 8 links for you. Uninflammable. I’m charlesarthur on Twitter. Observations and links welcome.

Encryption “would not have helped” at OPM, says DHS official » Ars Technica

Sean Gallagher:

pressed on why systems had not been protected with encryption prior to the recent discovery of an intrusion that gave attackers access to sensitive data on millions of government employees and government contractors, [US Office of Personnel Management Katherine Archuleta] said, “It is not feasible to implement on networks that are too old.” She added that the agency is now working to encrypt data within its networks.

But even if the systems had been encrypted, it likely wouldn’t have mattered. Department of Homeland Security Assistant Secretary for Cybersecurity Dr. Andy Ozment testified that encryption would “not have helped in this case” because the attackers had gained valid user credentials to the systems that they attacked—likely through social engineering. And because of the lack of multifactor authentication on these systems, the attackers would have been able to use those credentials at will to access systems from within and potentially even from outside the network…

…nearly every question of substance about the breach—which systems were affected, how many individuals’ data was exposed, what type of data was accessed, and the potential security implications of that data—was deferred by Archuleta on the grounds that the information was classified. What wasn’t classified was OPM’s horrible track record on security, which dates back at least to the George W. Bush administration—if not further.

Serious OS X and iOS flaws let hackers steal keychain, 1Password contents » Ars Technica

Dan Goodin:

The malicious proof-of-concept apps were approved by the Apple Store, which requires all qualifying submissions to treat every other app as untrusted. Despite the supposed vetting by Apple engineers, the researchers’ apps were able to bypass sandboxing protections that are supposed to prevent one app from accessing the credentials, contacts, and other resources belonging to another app. Like Linux, Android, Windows, and most other mainstream OSes, OS X and iOS strictly limit app access for the purpose of protecting them against malware. The success of the researchers’ cross-app resource access—or XARA—attacks, raises troubling doubts about those assurances on the widely used Apple platforms.

“The consequences are dire,” they wrote in a research paper titled Unauthorized Cross-App Resource Access on MAC OS X and iOS. “For example, on the latest Mac OS X 10.10.3, our sandboxed app successfully retrieved from the system’s keychain the passwords and secret tokens of iCloud, email and all kinds of social networks stored there by the system app Internet Accounts, and bank and Gmail passwords from Google Chrome.”…

…It’s not the first time researchers have found flaws in application sandboxes. The attack exploiting WebSocket weaknesses, for instance, can also succeed in Windows under certain conditions, the researchers said. Interestingly, they said application sandboxing in Google’s Android OS was much better at withstanding XARA threats.

For the time being, the researchers told Ars, there isn’t much end users can do except wait for Apple to fix the vulnerabilities.

Bad (though not deluge-of-malware bad; instead it’s sneaky-Trojan bad). Apple was told about this in October 2014. The best hope is that this is fixed in OS X 10.11 and iOS 9, but there’s no clear indication of how hard it is to fix.

Freedom of information turns into Mission Impossible for Downing St emails » FT.com

Jim Pickard and Kiran Stacey:

Emails sent from computers in Downing Street are automatically deleted within three months under a system that makes it harder for the public to obtain answers to “freedom of information” requests, former staff have disclosed.

The system, instigated a decade ago but not widely known about, means that messages are only held beyond that period if an individual saves them. It is widely blamed by government advisers for what one former employee called a sometimes “dysfunctional” operation at the heart of Whitehall.

The email system was introduced under the Labour government in late 2004, just weeks before January 2005 when the Freedom of Information Act belatedly came into force.

“The timing of this very strongly indicates that it was not a coincidence,” said Maurice Frankel, director of the UK Campaign for Freedom of Information.

Gee, ya think?

China and Russia almost definitely have the Snowden docs » WIRED

Bruce Schneier (who is a veritable security expert; if he says it, it’s true):

The vulnerability is not Snowden; it’s everyone who has access to the files.

First, the journalists working with the documents. I’ve handled some of the Snowden documents myself, and even though I’m a paranoid cryptographer, I know how difficult it is to maintain perfect security. It’s been open season on the computers of the journalists Snowden shared documents with since this story broke in July 2013. And while they have been taking extraordinary pains to secure those computers, it’s almost certainly not enough to keep out the world’s intelligence services…

…In general, it’s far easier to attack a network than it is to defend the same network. This isn’t a statement about willpower or budget; it’s how computer and network security work today. A former NSA deputy director recently said that if we were to score cyber the way we score soccer, the tally would be 462–456 twenty minutes into the game.

Even airgapped, never-connected computers can be attacked (don’t ask me how). The Guardian took extraordinary pains with its London copy: two people needed to enter passwords, at least two people needed to be present when documents were read, the computers used had never been online and had no connection.

But a simpler thought is this: if Snowden was one of 10,000 or so NSA staff with access to that data (and more in the UK), what are the chances that absolutely none of those has somehow been coerced or willingly turned over data to foreign powers? Pretty much zero.

Flash will soon be obsolete: it’s time for agencies to adapt » Advertising Age

David Evans on the fact that major browsers on desktop are hurrying to dump Flash:

If this sounds like a big problem to you, you’re absolutely right. If the major browsers were to disable Flash immediately, we could be looking at a scenario where roughly 84% of banners across the internet would not be viewable on desktop browsers. Rather than clicking on a visually dynamic, animated ad created to capture attention with movement and video, users would instead see a static banner in place of the intended ad, and most advertising creatives don’t pay much attention to the creation of static backups.

For advertisers, this could mean shelling out first-class money for economy-class impressions.
Though it might be painful to admit for an industry that has relied on Flash for over a decade, the right choice is to start creating desktop ads in the HTML5 language used to create ads for mobile.

This is a bit obvious to anyone who’s been paying attention for the past three years (minimum), but perhaps advertising has been looking somewhere else.

Market Monitor Q1 2015: LATAM smartphones grow 25% annually » Counterpoint Technology

Tina Lu:

LATAM is third, behind North America and Europe in the global ranking of smartphone shipment penetration.

• Except for Peru, majority of the key LATAM markets are seeing a significantly higher smartphone demand, with shipment penetration of total handsets between 77% and 99%.

• Overall feature phone demand has been declining, and so has been the overall scale and profitability of manufacturing and selling them. As a result, in countries like Argentina, due to government protectionist measures and import restrictions, vendors are manufacturing and selling only the more profitable smartphones. This has led to smartphone shipment penetration of sales to reach 99%; the highest in the region.

Here’s the shipment figure: Latam smartphone shipments Q1 2015

If you do the maths, on a 25% yoy growth both Samsung’s and LG’s shipments actually fell; Apple’s more than doubled. Alcatel and “Others” both grew faster than the market.

Apple’s Siri, Spotlight extend Google-like search inside iOS 9 apps, without tracking users » Apple Insider

Daniel Eran Dilger:

Because Apple is indexing in-app content for its search results, it can more easily suppress “Search Engine Optimization” malicious content or link spamming, as relevancy is tied to user engagement. If few users find a search result worthwhile, it can fade from relevance.

Many of the new search-related features Apple debuted for iOS 9 and OS X El Capitan bear a strong resemblance to some of predictive search features first introduced by Google starting back in 2012 as part of Android 4.1, branded as “Google Now.”

Since then, Google has introduced “app indexing,” a related feature designed to make the company’s web-style search more relevant to mobile users by delivering results that can open within local apps. For example, a recipe might open within a cookbook app, rather than just presenting the same information on a web page or dumping users into the app to find the recipe on their own.

The most profound difference between the two companies’ approach to in-app search is that Apple does not monetize its search with ads, and therefore has no need to capture and store users’ data and behaviors for future profiling, tied to a persistent user and device identifier that individuals can’t easily remove.

Apple is perhaps two years behind Google on this – but most people are using a version of Android that is at least two years old (87% are using 4.4, KitKat, from November 2013, or earlier). Which means that by November or so, Apple will roughly have parity on this feature.

Machine vision algorithm chooses the most creative paintings in history » MIT Technology Review

The job of distinguishing the most creative from the others falls to art historians. And it is no easy task. It requires, at the very least, an encyclopedic knowledge of the history of art. The historian must then spot novel features and be able to recognize similar features in future paintings to determine their influence.

Those are tricky tasks for a human and until recently, it would have been unimaginable that a computer could take them on. But today that changes thanks to the work of Ahmed Elgammal and Babak Saleh at Rutgers University in New Jersey, who say they have a machine that can do just this.

machine vision view of art

They’ve put it to work on a database of some 62,000 pictures of fine art paintings to determine those that are the most creative in history. The results provide a new way to explore the history of art and the role that creativity has played in it.

Can’t be long before someone puts a human art historian up against the machine to see who spots the fake. (By the way, there was no byline I could find on the story. Maybe a robot wrote it.)

Start up: Grexit to bitcoin?, Google’s antitrust deadline, Merkel’s suspect PC, Samsung security hole and more

Posted on by
Reply


Stockpiled – a bit like HTC’s unsold phones. Photo by .dh on Flickr.

A selection of 7 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Bitcoin surges as Grexit worries mount, posts best run in 18 months » Reuters

Jemima Kelly:

Joshua Scigala, co-founder of Vaultoro.com, a firm that holds bitcoin for its customers and allows them to exchange it for gold and vice versa, said that Greeks were buying the currency as their trust in the authorities waned. It is also unclear what currency would be used if a Grexit does occur — another potential factor driving Greek demand for bitcoin.

“Some people aren’t waiting for the government to figure out an exit plan and are doing it for themselves,” said Scigala.

“You have people worrying about their families’ wealth or their life savings, and worrying that their money might be locked up in banks … They’d rather hold money in a private asset like gold or bitcoin.”

Scigala said over the past two months, with Greece locked in talks with its creditors, the company had seen a 124% pick-up in inflows from Greek IP addresses – numerical labels that identify computers and other internet-enabled devices.

124% = doubling. Which doesn’t amount to much, really, unless Greece was already a lot of business. Here’s the problem with this story. To buy bitcoin, you have to sell the euros to someone. If Greeks are withdrawing their euros from banks, why not hold on to those euros instead of buying bitcoin with them? Do they really think a post-Grexit euro will be worth less, rather than more? I’d bet on the latter.

There may be some Greek euros moving into bitcoin, which is moving bitcoin – but that only indicates that bitcoin has low liquidity, and so small amounts of money can move the value easily. Or else it’s something else altogether causing it.

Critics due to get EU’s Google antitrust charge sheet this week: sources » Reuters

Foo Yun Chee:

Microsoft, German publisher Axel Springer and 17 other critics of Google are expected to get a copy of the EU’s antitrust charge sheet against the search engine giant this week in order to allow them to provide feedback, four people familiar with the matter said on Tuesday.

The 19 companies, which include U.S. online travel site Expedia, U.S. consumer reviews website Yelp, online mapping service Hot-map and British price comparison site Foundem, helped triggered the European Commission’s case against Google nearly five years ago…

…Google has until July 7 to respond to the accusations. This can be extended on request. It can also seek a closed-door hearing to argue its case before a broad audience of antitrust officials and the critics.

The complainants were told on Monday to sign confidentiality waivers not to disclose the so-called statement of objections to journalists or public affairs consultants before they could get a copy of the redacted document, according to a Commission letter seen by Reuters.

The critics were told to restrict the charge sheet to their lawyers and economists.

Leaks in 3,2,1… And there’s Andrew Orlowski’s writeup of the Foundem examination into Google’s “search for harm” blogpost.

One tiny number can reveal big problems at a global smartphone maker » Bloomberg Business

Tim Culpan:

Tucked away in a corporate earnings report—past the data on profit margins and revenue growth, hidden deep inside a balance sheet—is a number that can tell you a lot about a mobile phone maker’s health. In the global smartphone war, brands are routinely measured by market share, revenue, profit, and the coolness of their ads. But one line item called finished goods inventory, which refers to the percentage of materials that were manufactured into phones but went unsold, can give insight into whether a company’s fortunes are changing.

The latest company to let phones pile up in warehouses and on store shelves is HTC. The Taiwanese company’s stock just fell to its lowest point in a decade after lowering its sales forecast on June 5 and announcing a NT$2.9 billion ($93 million) writedown, though it’s recovered some of that loss amid speculation the decline could make it a buyout target. HTC’s finished goods inventory had climbed to a record high 2.35% of total assets at the end of last quarter. During the company’s heyday, that figure rarely nudged above 1%.

Culpan has done a neat job, building on what I pointed out last week about HTC’s broader inventory numbers. Relating inventory to total assets is an effective way to look at it; here’s the graph.

HTC inventory as percent of assets
So now it’s higher than ever before. Finished goods inventory is going to be one of the first numbers people look at when the Q2 figures are published (in late July, probably).

Merkel’s PC was the first one infected in the Bundestag hack »Security Affairs

I have written many posts regarding a recent attack against the German Bundestag with caused a major data breach.

We discussed the possibility that the cyber attack against the German Parliament was coordinated by Russian state-sponsored hackers that spread a highly sophisticated malware inside the network of the Bundestag.

The consequence of the data breach could be serious for the German Government, German media states that Bundestag may need to replace 20,000 computers after the intrusion, an operation that could cost millions of euros.

New revelations in the investigation confirms that the cyber attack on the German Bundestag began with the compromise of Chancellor Angela Merkel’s personal computer.

Her phone by the NSA, her computer by Russia…

Flaw lingers in Samsung phones, illustrating hacking risk » WSJ

Danny Yadron:

Last fall, researchers at cybersecurity firm NowSecure found a bug in most Samsung smartphones that could allow hackers to spy on users.

In March, Samsung told NowSecure it had sent a fix to wireless carriers that they could distribute to users. It asked NowSecure to wait three months before going public.

Last week, the researchers bought two new Samsung Galaxy S6’s from Verizon Wireless and Sprint. They found both were still vulnerable to the security hole, which involves how the phone accepts data when updating keyboard software.

NowSecure CEO Andrew Hoog shared his version of events with The Wall Street Journal as his company prepared to release its research Tuesday. The story helps illuminate why hacking is so hard to stamp out.

That’s particularly true in smartphones, with its diffuse system of device makers, software programmers and network operators. Things likely are only to get worse as Americans connect their thermostats, door locks and cars to the Internet and face the need to update their software…

…Welton found he could hijack the process of updating one of the virtual keyboards Samsung installs on many Android smartphones. From there, he could eavesdrop on phone conversations, rummage through text messages and contacts, or turn on the microphone to capture audio.

That was possible, Hoog said, because Samsung didn’t encrypt the update process.

It’s the IOT vulnerability that’s the real worry here, much more than which make of phone is involved. Except that Samsung asked NowSecure for a year to fix the bug – a month after it was told about it. And what does this mean for Google’s “we find a bug and we publicise it in 90 days” stance?

Nokia faces lengthy arbitration over LG patent royalty payments » Reuters

Jussi Rosendahl:

Nokia said the arbitration with LG is expected to conclude within two years. Shares in Nokia rose 1.4 percent by 1204 GMT (8.04 a.m ET).

“This is becoming a more and more common model. The companies won’t go to the court but instead let an independent party decide,” said Nordea analyst Sami Sarkamies.

He estimated that the Samsung deal, expected to conclude later this year, could eventually mean Nokia receives 100-200 million euros of additional royalty payments annually, on top of retroactive payments.

Seems to be related to 4G patents; Nokia signed a similar deal with Samsung a while back. For LG, means that profitability in the smartphone side becomes that little bit more elusive – especially after the back payment.

Apple News curation will have human editors and that will raise important questions » 9to5Mac

Jordan Kahn:

Techmeme‘s founder Gabe Rivera gave us the hard truth on why being an algorithm-based service like Google News doesn’t make sense for the Apple News app saying, “All news aggregators intended for the mass market need editors, so this makes sense for Apple.” But the flip side of Apple’s human-based curation is that without a separation of editorial and the business, there will undoubtedly be conflicts of interest. Rivera points out that “…as the world’s most valuable corporation, they can’t and shouldn’t be trusted to present well-rounded coverage on many important topics.” Rivera continues, “But most readers won’t care about that.”

Apple doesn’t want this to be an algorithm thing, because (a) algorithms might not pull outré-yet-fascinating stuff to the surface (b) if some story that were grisly/violent/sexual – pick the topic you think Americans in particular would react in horror to – popped up, Apple would of course get the blame. Apple hates that.

So it wants humans on hand to stop the Bad Stuff that will Offend People finding its way into the app. But that immediately raises the question: what will it define as Bad Stuff? Are Mark Gurman’s well-sourced leaks of Apple plans Bad Stuff? Is vicious criticism of Apple?

I suspect people are overplaying this; Apple is really wary of consumer backlashes over pr0n. Look at how Facebook struggles with the same topic, and the issue of content posted by millions of people which some find offensive and others really don’t.

No simple answer, but Apple may not have realised it was putting itself in the position of a publisher.