Tag Archives: malware

Start up: yet another UK broadband pledge, what is mobile?, hacking Samsung’s theft protection, and more

Posted on by
Reply


A Huawei-made Nexus 6P: no breakage of the camera visor panel here. Photo by TechStage on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 12 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Fast broadband for all by 2020 pledged by David Cameron » BBC News

All UK homes and businesses will have access to “fast broadband” [of at least 10 megabits per second] by 2020, David Cameron has pledged.

The PM is to introduce a “universal service obligation” (USO) for broadband, giving the public a legal right to request an “affordable” connection.

It would put broadband on a similar footing to other basic services such as water and electricity.
In 2010, the coalition government promised the UK would have the best superfast broadband in Europe by 2015.

Then, in 2012, a pledge was made by then-Culture Secretary Jeremy Hunt that the UK would have “the fastest broadband of any major European country” by 2015.

He defined high-speed broadband as offering a download speed of greater than 24 megabits per second (Mbps). Communications regulator Ofcom defines it as 30Mbps.

That final sentence completely shows how weak this “pledge” really is: from 30Mpbs down to 24 down to 10. I suspect BT, as the dominant operator which also now owns a 4G network, will aim to fulfil this revised USO via 4G.
link to this extract

Some Nexus 6P owners are reporting spontaneously broken rear glass panels » Android Police

Michael Crider:

The early reaction to the Nexus 6P from both critics and owners has been mostly positive, but a few new owners seem to be encountering serious problems. Specifically, the glass panel on the rear of the phone, which covers the camera, LED flash, and laser autofocus module, is reportedly cracking and breaking on its own. A user on the Android subreddit reported the rear panel cracking, and at least two others have reported similar results, with the panel splitting into multiple cracks with no particular rough handling or impact.

That subreddit is getting pretty big, and there isn’t a lot of joy for the 6P. One person has had two in a row go wrong. Problem for Huawei?
link to this extract

How uBeam transmits energy wirelessly using ultrasound » uBeam

Meredith Perry, uBeam’s founder, has a big explainer about how it works, because people have been saying that either it doesn’t work, or it’s dangerous:

The uBeam system is composed of two parts: a transmitter that emits energy, and a receiver that receives energy. The transmitter is like a sound speaker, but instead of emitting audible sound, uBeam’s transmitter emits high frequency sound. This sound can’t be heard by humans or dogs; it’s called ultrasound. The receiver, like a microphone, picks up the sound and converts it into usable energy. Sound, like light and wind, is a form of energy that can be converted into electrical energy with our proprietary energy harvesting technology. The receiver then sends this electrical power to charge or power an electronic device.

link to this extract

Mobile, ecosystems and the death of PCs » Benedict Evans

Evans wrestles with the question of “what is ‘mobile’?” in the face of competing devices like the SurfaceBook, the Surface Pro, iPad Pro and so on:

Each generation of technology goes through an S-curve of development – slow improvement of an impractical product, then explosively fast improvement once fundamental barriers are solved, and then slowing iteration and refinement as you solve every last issue and the curve flattens out. PCs are on that flattening part of the curve, just as the [fastest ever piston-powered aircraft developed at the end of WW2, soon surpassed by jets, the Republic] Rainbow was.

They get perfect because you’re debugging the big things you invented in the past, and now your innovation is in the extra little things (such as the Rainbow using exhaust for extra thrust), and there are no big new innovations to debug. But meanwhile, the new ecosystem is catching up, and the curve of development and innovation for that generation will flatten out way out of reach. The new curve is crossing the old one. This is why they look simliar – this is why a Surface Pro and an iPad Pro look similar. They both exist right at the point that those development curves cross. The iPad might still be a little below, but its curve is heading up.

That is, the point that you can start to do old ecosystem things on what look like new ecosystem devices is also the point that the new ecosystem can do those things too – but the new ecosystem has 10x the scale, and the new ecosystem is just starting down the innovation track where the old one is at its end.

The really tricky part is knowing where on the S-curve something is, and whether there’s still money to be made from it. As Evans points out,

No-one is going to found a new company to make Win32 applications (though enterprise Windows apps will be worked on for a long time, just as mainframe apps were [after the IBM PC arrived]).

link to this extract

It’s incredibly easy to bypass Factory Reset Protection on a Samsung phone [with video] » 9to5 Google

Stephen Hall:

Factory Reset Protection was introduced with Android Lollipop, and, like Apple’s iCloud Activation Lock, it’s supposed to make it really hard to resell a stolen Android phone. The gist is that when you use Android recovery menu to reset a phone to factory settings, the phone will require upon reboot that you sign in using a Google account you previously used on the device before resetting it. If someone steals your phone and wipes it, they need your Google account for it to be anything but a brick.

Well, it appears that a flaw in Samsung’s phones lets potential thieves around this security measure, and it looks like the workaround takes just about five minutes to pull off…
Obviously a thief wouldn’t be able to get around a password-secured phone, so a factory reset would require going to Android’s recovery menu after a reboot (as opposed to going into the Settings app and doing a factory reset from there).

But since Samsung’s phones automatically pull up a file manager when you plug in an external storage device (even in the set up process), all you have to do is load an app file that lets you open up the stock Settings app. Press a couple buttons to do what the phone thinks is a legitimate/authorized reset, and the phone reboots without tripping Factory Reset Protection.

D’oh.
link to this extract

Google annual search Statistics » Statistic Brain

The number of annual searches conducted by Google, according to ComScore and the “Statistic Brain Research Institute” (sounds grand).

Compare the numbers in the top two lines of the table. It suggests that in 2014 the total number of Google searches fell, for the first time ever. Even within margins of error, that suggests search growth has stopped.
link to this extract

XcodeGhost S: a new breed hits the US » FireEye Threat Research

Yong Kang, Zhaofeng Chen, and Raymond Wei:

Through continuous monitoring of our customers’ networks, FireEye researchers have found that, despite the quick response, the threat of XcodeGhost has maintained persistence and been modified.

More specifically, we found that:

• XcodeGhost has entered into U.S. enterprises and is a persistent security risk
• Its botnet is still partially active
• A variant we call XcodeGhost S reveals more advanced samples went undetected

After monitoring XcodeGhost related activity for four weeks, we observed 210 enterprises with XcodeGhost-infected applications running inside their networks, generating more than 28,000 attempts to connect to the XcodeGhost Command and Control (CnC) servers – which, while not under attacker control, are vulnerable to hijacking by threat actors.

Pretty dramatic. And it can affect apps via third-party frameworks, as Possible Mobile discovered. Meanwhile, on Android…
link to this extract

Lookout discovers new trojanized adware; 20K popular apps caught in the crossfire » Lookout Blog

Michael Bentley of the anti-malware company:

Auto-rooting adware is a worrying development in the Android ecosystem in which malware roots the device automatically after the user installs it, embeds itself as a system application, and becomes nearly impossible to remove. Adware, which has traditionally been used to aggressively push ads, is now becoming trojanized and sophisticated. This is a new trend for adware and an alarming one at that.

Lookout has detected over 20,000 samples of this type of trojanized adware masquerading as legitimate top applications, including Candy Crush, Facebook, GoogleNow, NYTimes, Okta, Snapchat, Twitter, WhatsApp, and many others.

Malicious actors behind these families repackage and inject malicious code into thousands of popular applications found in Google Play, and then later publish them to third-party app stores. Indeed, we believe many of these apps are actually fully-functional, providing their usual services, in addition to the malicious code that roots the device.

Oh, and also: if you get infected you probably won’t be able to uninstall it; you’ll either need a pro or a trip to buy a new one. (Factory reset won’t do it.)
link to this extract

BlackBerry Priv review: good, but probably only for keyboard junkies » Android Police

David Ruddock is befuddled by those little things with letters on:

But time for some real talk about those keys, in respect to my particular tapping of them. I am awful at these tiny little keyboards. Like, your grandpa trying to use an ATM when 6 other people are in line behind him and all of them are clearly in a rush awful. It’s just not my thing, it never has been, and it never will be. To me, this is mind-bendingly unintuitive and would take me months to master in anything approaching a respectable way. I’m not going to be using the Priv for months. I cannot give you a good evaluation of the keyboard on the merits. Sorry. I can show you what it looks like, though! Also, it’s backlit.

My thoughts without getting into the related software bits are as follows: the keys are really small. They depress and feel clicky. They are keys. Again, I am sorry. I really, really, can’t get into this keyboard-for-ants thing, even as I have forced myself to use it on the Priv.

This is the reason why anyone who began using a smartphone after 2010 is going to find the Priv completely weird. It’s like introducing typewriters to schools that have used iPads.
link to this extract

HTC One A9 review » AndroidAuthority

Joshua Vergara:

Remember the Sensor Suite originally announced in the HTC One M8? It allowed for the phone to go straight into specific areas with taps and swipes after the phone knew it was brought up for usage. Now, because the fingerprint reader is there, it is the wall that prevents all of these extra unlocking methods from being used. That also doesn’t include the fact that it can be a home button, without any capacitive keys accompanying it. Soft keys are still used, so using the reader as a home button takes some getting used to – and fiddling between the two, we’ve found to be really common.

Of course, there is also the omission of BoomSound speakers due to the addition of the fingerprint reader. This is a pretty bold move for the company, as one of its most-recognized features isn’t here anymore. Sound, thus, gets a big downgrade with the bottom-mounted unit. It certainly doesn’t get very loud at all, and it’s safe to say that we miss the stereo audio found in past One devices.

Storage options with the A9 are pretty standard, with the option to choose between 16 or 32GB variants. It should be noted that the 16GB model comes with just 2GB of RAM, while the 32GB variant comes with 3GB. We’ve been testing the 32GB model with 3GB of RAM, and we’ve noticed that it gets a little slow at times.

Jeepers – it’s sometimes slow with 3GB of RAM? None of this is really a vote of confidence.
link to this extract

HTC pushes US One A9 pre-order shipments back by up to several weeks, delays Verizon compatibility indefinitely » Android Police

David Ruddock:

While the A9 is indeed a pretty good phone, there’s no doubt HTC’s bungled the launch of the device a bit. First, the whole promotional pricing thing (and the 2GB/16GB variant abroad being so damn expensive), and now? A pre-order shipment delay for those who did choose to buy one. We’re hearing from US readers that HTC has sent out the following email, pushing back shipment of the initially available colors until next Tuesday, November 10th, at the earliest. Some customers, though, will be waiting much longer than that – especially if you ordered a Sprint variant.

In addition, HTC has now delayed Verizon network compatibility for the One A9 indefinitely. They had promised compatibility shortly after the November launch, then in December, and now have no ETA for the feature.

And it gets worse; certain colour variants are going to take weeks and weeks to ship. Dead on non-arrival?
link to this extract

Who the f*** is that advertiser? » Medium

Rob Leathern on the problem of validating who is advertising (which amounts to “running random Javascript on your system); the Interactive Advertising Bureau wants to charge $10,000 per company for this. Leathern laughs:

Google Adwords probably has over 2.5 million advertisers by this estimate. The top 100 to 1,000 advertisers (likely to be cost-insensitive enough to sign up for a program like this) aren’t the problem for online and mobile advertisers. The problem area is distinguishing between tens of thousands of large but legitimate advertisers, and those with money who are not legitimate or who are fronts for malware, botnets, and schlocky affiliate offers.

The goal shouldn’t be to register the top few thousands advertisers, but make the barriers low enough that we can validate every single advertiser consistently, and then do the kinds of auditing, checks and follow-up necessary to stop problem advertisers from being banned and then popping back up right away under another name or identity. Once you can accurately identify advertisers and have every part of the value chain understand this information, both publishers and consumers should be able to decide what kinds of advertisers they want to block.

If I had to guess, it’s a $10/year fee (ten dollars) and not $10,000, that will be a better incentive to get companies to participate and to create the infrastructure needed to validate this information at enormous scale.

Even at that level, it wouldn’t happen. And malware generators would still find ways to get around it.
link to this extract

Errata, corrigenda and ai no corrida: none notified. But the week is still young.

Start up: payday search predators, the natural nuclear reactor, Facebook’s code problem and more

Posted on by
2


Shh! Don’t tell Facebook! Photo by The Keenes on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 11 links for you. Please note: the “link to this extract” link doesn’t work if you’re using it from the email. Who shall we blame? Meanwhile, I’m charlesarthur on Twitter. Observations and links welcome.

People’s deepest, darkest Google searches are being used against them » The Atlantic

Adrienne Lafrance:

Consider, for example, a person who googles “need rent money fast” or “can’t pay rent.” Among the search results that Google returns, there may be ads that promise to help provide payday loans — ads designed to circumvent Google’s policies against predatory financial advertising. They’re placed by companies called lead generators, and they work by collecting and distributing personal information about consumers online. So while Google says it bans ads that guarantee foreclosure prevention or promise short-term loans without conveying accurate loan terms, lead generators may direct consumers to a landing page where they’re asked to input sensitive identifiable information. Then, payday lenders buy that information from the lead generators and, in some cases, target those consumers—online, via phone, and by mail—for the very sorts of short-term loans that Google prohibits.

But look, if Google bans those ads, then it’s taking a position. Shouldn’t it only accept ads from organisations that it has vetted? Or just not accept ads on those searches?
link to this extract

In the 1970s, scientists discovered a two billion-year-old nuclear reactor in west Africa » Medium

The Physics ArXiv blog explains:

When the ore in Gabon was laid down some 2 billion years ago, the concentration of uranium-235 would have been about 4%, more than enough for a self-sustaining nuclear reaction.

The idea is that when a neutrons hits an atom of uranium-235, the atom splits producing two smaller nuclei and several neutrons. These neutrons go on to split other atoms in an ongoing chain reaction.

However, the liberated neutrons are high-energy particles that tend to fly away rapidly. So nuclear reactors usually contain a moderating material that slows down the neutrons so that they can interact with other uranium atoms.

It turns out that water is a reasonable neutron moderator. So an important component of this natural reactor was the presence of water seeping through the uranium ore. And this had an interesting impact on the way the reactors operated.

Nuclear scientists believe that the Oklo reactors operated in pulses. As water flowed into the rock, it moderated the neutrons, allowing a chain reaction to occur. But this increased the temperature of the rock, boiling the water into steam which escaped.

Kept running for 300,000 years. More useful than that is what it taught scientists about how fission waste products migrate from burial sites. Turns out the answer is: not that much.
link to this extract

Facebook’s code quality problem » Graham King

Facebook has a software quality problem. I’m going to try to convince you with three examples. This is important because it demonstrates the time-honored principle that quality matters. In demonstrates it, as Facebook engineers like to say, at scale. I don’t work at Facebook or any competitor, I’m just an observer.

The three examples – 18,000 Objective-C classes in the iOS app with 429 people working on it (note: delete the app), database restarts and the fact that the site works better when its engineers aren’t there, all speak to a classic problem.
link to this extract

Hackers claim million-dollar bounty for iOS zero-day attack » WIRED

Andy Greenberg:

On Monday, the security startup Zerodium announced that it’s agreed to pay out that seven-figure sum to a team of hackers who have successfully developed a technique that can hack any iPhone or iPad that can be tricked into visiting a carefully crafted web site. Zerodium describes that technique as a “jailbreak”—a term used by iPhone owners to hack their own phones to install unauthorized apps. But make no mistake: Zerodium and its founder Chaouki Bekrar have made clear that its customers include governments who no doubt use such “zero-day” hacking techniques on unwitting surveillance targets.

In fact, Bekrar tells WIRED that two teams of hackers had attempted to claim the bounty, which was announced in September with an October 31st deadline. Only one proved to have developed a complete, working iOS attack. “Two teams have been actively working on the challenge but only one has made a full and remote jailbreak,” Bekrar writes. “The other team made a partial jailbreak and they may qualify for a partial bounty (unconfirmed at this time).”

I’d like to see documentary proof of the hack before I take this at face value. Zerodium is clearly seeking publicity; and the incentive to, um, bend the truth around seven-figure annoucements is high.
link to this extract

Ranking Digital Rights – Ranking ICT sector companies on respect for free expression and privacy

For the inaugural Index, Ranking Digital Rights analyzed a representative group of 16 companies that collectively hold the power to shape the digital lives of billions of people across the globe. Leading global ESG research and ratings provider, Sustainalytics, co-developed the methodology.

Eight publicly listed Internet companies and eight publicly listed telecommunications companies were selected based on factors including geographic reach and diversity, user base, company size, and market share. These companies were assessed on 31 indicators across three categories – commitment, freedom of expression, and privacy – drawn heavily from international human rights frameworks, as well as emerging and established global principles for privacy and freedom of expression.

The research revealed a deep need for improvement:

Only six companies scored at least 50% of the total possible points;
The overall highest score was only 65%;
Nearly half the companies in the Index scored less than 25%, showing a serious deficit of respect for users’ freedom of expression and privacy.

Google came top in internet companies. List at https://rankingdigitalrights.org/index2015/. Apple isn’t there – doesn’t it have any impact?

Anyhow, speaking of digital rights and freedom of expression…
link to this extract

A surprisingly difficult question for Facebook: do I have boobs now? » The Guardian

Hannah Jane Parkinson talks to Courtney Demone, a trans woman (ie born male) who asks the question that Facebook apparently finds exceptionally hard to answer:

Demone says that Facebook likes to present itself as a liberal and progressive organisation, but that most of its actions in this regard are decidedly low-risk. She mentions Facebook’s introduction of a widget allowing users to overlay their profile pictures with a rainbow flag and notes that it was to celebrate a gay marriage law which had been passed by the US supreme court – not before, in support of it.

Demone says that [Facebook’s] allowing users to define their gender in a free-form field, and offering a choice of pronouns, is progressive, but it is decidedly lower risk rather than, say, challenging the paradigm that female nipples should be covered up. This, of course, would run the risk of offending advertisers and in the case of Instagram, result in a 17+ user rating in app stores.

This gets to such a deep question: why should American organisations get to decide the mores of the countries that they export their business to? Mark Zuckerberg once said he hoped Facebook could solve the Arab-Israeli conflict by making people friends. But topics such as this shows why it can be seen as more like an enemy of social change.
link to this extract

India LTE smartphone shipments grew 2400% annually climbing to 10m units in Q3 2015 » Counterpoint Technology Market Research

Tarun Pathak has the details. Here’s one of the more interesting pullouts (from lots) about a local OEM:

Micromax maintained the second position in both overall mobile phone market and the smartphone segment with a market share of 13.7% and 17.7% respectively.

The brand’s share from online channel increased during the quarter. However, it is now facing pressure competition in $50-$100 price segment from Intex, Lava and others.

Micromax’s Cyanogen based online only brand ‘Yu’ launched its cheapest LTE model ‘Yunique’ during the quarter and the brand has been growing steadily ever since its launch.

Micromax Yu brand alone is now selling more smartphones than Xiaomi online, depicting it’s going to be challenging even for popular brands such as Xiaomi to scale in Indian market

If Xiaomi can’t succeed in India, it’s going to have a real problem.
link to this extract

Google abandons plan for a retail store in New York City » Crain’s New York Business

Daniel Geiger:

Google has abandoned plans to open its first-ever retail store in New York City.

The company is trying to sublease a 5,442-square-foot SoHo space it leased last year, and wants $2.25m annually in rent for it, according to sources.

The decision to abandon its retail store came after the Internet giant spent $6m renovating the 131 Greene St. location. The outpost was supposed to be one of Google’s first stand-alone stores in the U.S., putting it in direct competition with Apple, which has a host of brick-and-mortar shops that showcase and sell its products in the city, as well as other tech firms with a retail presence. Just last week, Microsoft opened its flagship store on Fifth Avenue.

A spokeswoman for Google didn’t immediately respond to a request for comment.

According to reports, Google planned to begin opening stores to sell products such as the Chromebook, a line of laptops and desktop computers made by several manufacturers that operate on Google software, and smartphones that run its Android operating system. Because Google is subleasing the Greene Street location, it would appear that the company has changed its mind and is pulling back on its plan to open physical stores. However, Google reportedly recently opened a kiosk within a larger electronics store in London earlier this year.

Even so. Why would you have a Google store? It doesn’t make sense.
link to this extract

Over 40% of China’s online sales counterfeit, shoddy: Xinhua » Reuters

Adam Jourdan:

More than 40% of goods sold online in China last year were either counterfeits or of bad quality, the official Xinhua news agency said, illustrating the extent of a problem that has bogged down the fast-growing online sector.

According to the report, which was delivered to China’s top lawmakers on Monday, just under 59 percent of items sold online last year were “genuine or of good quality”, Xinhua said.

China has been trying to shake off a notoriety for pirated and counterfeit goods, long a major headache for global brands targeting the Chinese market from iPhone maker Apple to luxury retailer LVMH.

Chinese e-commerce giant Alibaba Group Holding Ltd has been lobbying to stay off a US blacklist for fakes after coming under renewed pressure this year over suspected counterfeits sold on its shopping platforms.

link to this extract

It’s official: Amazon is opening its first-ever bookstore in Seattle » GeekWire

Taylor Soper:

Internet giant Amazon.com, which got its start selling books online, confirmed this afternoon that it will open its first-ever brick-and-mortar bookstore at Seattle’s University Village on Tuesday morning.

The company sent a letter to customers on Monday with details about the store, which is called “Amazon Books.” In the letter, Amazon Books VP Jennifer Cast calls the store a “physical extension of Amazon.com.”

Someone should disrupt that thing…
link to this extract

Microsoft reneges on ‘unlimited’ OneDrive storage promise for Office 365 subscribers » ZDNet

Ed Bott:

Here’s the key part of tonight’s announcement:

We’re no longer planning to offer unlimited storage to Office 365 Home, Personal, or University subscribers. Starting now, those subscriptions will include 1 TB of OneDrive storage.
100 GB and 200 GB paid plans are going away as an option for new users and will be replaced with a 50 GB plan for $1.99 per month in early 2016.

Free OneDrive storage will decrease from 15 GB to 5 GB for all users, current and new. The 15 GB camera roll storage bonus will also be discontinued. These changes will start rolling out in early 2016.

Microsoft blames a few greedy storage users for the change in heart. “A small number of users,” they wrote, “backed up numerous PCs and stored entire movie collections and DVR recordings. In some instances, this exceeded 75 TB per user or 14,000 times the average.”

That shouldn’t be surprising. If you advertise “unlimited” cloud storage, perhaps you should expect that some people will take you at your word and move large collections to the storage space you so generously offered?

Bott also portrays a division in some upheaval, which doesn’t quite fit the calm exterior Microsoft has been trying to put forward over its cloud work.

That “14,000 times the average” suggests that the average person was storing 5GB of data. Though that probably amounts to 10 Microsoft Word documents, given how the format has bloated. (Thanks @pedrostephano.)
link to this extract

Start up: the convertible laptop dream, Pagefair’s malvertising hack, Samsung’s bulging bottom, and more

Posted on by
Reply


Keeping your personal information out of other sites is hard too. Photo by xiaming on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Count them if you like. I’m charlesarthur on Twitter. Observations and links welcome.

Laptop is a state of mind | Karma

Paul Miller:

There’s no such thing as “best of both worlds” in computers. Choices matter. Hybrids like the Surface Book are great for people who perfectly straddle the tablet and laptop use cases — who constantly switch between keyboard and pen, desk and walk-and-talks, angry memos and Angry Birds. Everyone else’s perfect “laptop” will probably be a lot more boring, and a good deal cheaper.

But.

You know what would be cool? A world where we actually needed Surface Books. What if our lives were like Microsoft Surface commercials? We’d flit effortlessly between different roles. An architect for one moment, consulting with a professional on your home remodel. Then you’re drawing up a clever football play for Russell Wilson. Then you’re playing Madden, streamed from your Xbox. Then you’re answering work emails and flicking away distractions with your finger. And then you’re in some big song-and-dance number, and you can’t even remember where you put your Surface Book because your life is amazing and who even cares anymore you’re going to die happy, loved by your family and respected by your peers.

The Surface Book is not an inferior product because its hardware is too ambitious. It’s an inferior product because its hardware is more ambitious than the digital lives we’ve thus far concocted.

link to this extract

CryptoWall 3.0 cost victims $325m – report » Infosecurity Magazine

Phil Muncaster:

The report noted:

“It was discovered that a number of primary [bitcoin] wallets were shared between campaigns, further supporting the notion that all of the campaigns, regardless of the campaign ID, are being operated by the same entity.”

Unfortunately for those unlucky enough to get infected by CryptoWall 3.0, the report paints the picture of a highly efficient operation running solid encryption, meaning victims usually do have to pay up to get their files back.

Even an FBI Special Agent was quoted as saying last week that it might be better for infected businesses to just pay the ransom.

link to this extract

Who knows what about me? A survey of apps’ behind-the-scenes personal data sharing to third parties » Technology Science

Jinyan Zang, Krysta Dummit, James Graves, Paul Lisker, and Latanya Sweeney:

We found that the average Android app sends potentially sensitive data to 3.1 third-party domains, and the average iOS app connects to 2.6 third-party domains. Android apps are more likely than iOS apps to share with a third party personally identifying information such as name (73% of Android apps vs. 16% of iOS apps) and email address (73% vs. 16%).

For location data, including geo-coordinates, more iOS apps (47%) than Android apps (33%) share that data with a third party. In terms of potentially sensitive behavioral data, we found that 3 out of the 30 Medical and Health & Fitness category apps in the sample share medically-related search terms and user inputs with a third party.

Finally, the third-party domains that receive sensitive data from the most apps are Google.com (36% of apps), Googleapis.com (18%), Apple.com (17%), and Facebook.com (14%). 93% of Android apps tested connected to a mysterious domain, safemovedm.com, likely due to a background process of the Android phone. Our results show that many mobile apps share potentially sensitive user data with third parties, and that they do not need visible permission requests to access the data.

Hardly seems a source of complaint if they’re sharing with Google and Apple, if it’s with permission. As for safemovedm.com, it seems to exist – since February 2008 – but not actually be active in any way; that makes it sound like an Android function.
link to this extract

Chrome OS is here to stay » Google Chrome Blog

Hiroshi Lockheimer, SVP Android, ChromeOS and Chromecast:

Over the last few days, there’s been some confusion about the future of Chrome OS and Chromebooks based on speculation that Chrome OS will be folded into Android. While we’ve been working on ways to bring together the best of both operating systems, there’s no plan to phase out Chrome OS.

With the launch of Chrome OS six years ago, we set out to make computers better—faster, simpler and more secure—for everyone. We’ve since seen that vision come to life in classrooms, offices and homes around the world. In fact, every school day, 30,000 new Chromebooks are activated in U.S. classrooms—that’s more than all other education devices combined. And more than 2 million teachers and students in more than 150 countries have the Share to Classroom Chrome extension, which launched in September and gets students onto the same webpage, instantly. Meanwhile, companies such as Netflix, Sanmina, Starbucks and of course Google, are using Chromebooks given the ease of deployment, the ability to easily integrate with existing technologies, and a security model that protects users at all levels, from hardware to user data. (Chromebooks are so secure you don’t need antivirus software!)

“Working on ways to bring together the best of both operating systems” implies that the two are coming together somehow – you wouldn’t have a third OS. Android isn’t going away. So Lockheimer hasn’t explained how ChromeOS is here to stay; instead, by avoiding the question while also acknowledging that something is happening, he’s making it more mysterious.
link to this extract

The Apple iPhone 6s and iPhone 6s Plus review » Anandtech

Ryan Smith and Joshua Ho:

The only real issues I can think of are that the iPhone 6s doesn’t have OIS and that the base SKU is still 16GB of storage. To be fair, the 16GB SKU can become a noticeable user experience issue if you’re constantly dealing with the limits of this storage, and the jump from 16 to 64 GB feels like it’s simply designed to encourage buying a more expensive SKU. There are arguments that users that don’t really take a ton of photos or videos and stream all their media will be fine, but it’s still a user experience problem in this day and age. However, despite these issues I would argue that the iPhone 6s’ are the best phones you can buy today.

Of course, this sounds like a rather hollow recommendation to those that have followed our reviews for the past year. This year, more than ever it feels like Android smartphones at the high end have stood still, as if smartphone improvements have become a zero sum game. To make the best phone this year is therefore a pretty low bar to clear.

The benchmarks, especially for storage, are remarkable: the new iPhones seem to knock everything aside in the raw processing power space. They stumble only a little in the battery life area, and even there it’s not a huge difference. (Thanks @papanic for the link.)
link to this extract

Samsung sells more phones — but for less money » WSJ Digits blog

Jonathan Cheng:

Samsung has been selling more cheaper smartphones, and fewer high-end premium devices, than it did even compared to Samsung’s rocky 2014, according to numbers from data firm Counterpoint Technology Market Research.

Samsung doesn’t separately disclose smartphone sales numbers.

Samsung shipped 84m smartphones in the third quarter of 2015, 6.3% more than during the same stretch last year and more than the No. 2 and No. 3 players, Apple and Huawei Technologies, combined, according to Counterpoint.

But while 55% of its smartphones were priced at $301 per unit or more at this time last year, that high-end segment has fallen to just 40% of Samsung’s overall smartphone sales, Counterpoint said.

Phones priced $200 or below now account for 38% of total units shipped at Samsung, versus 30% this time last year.

So while Samsung is indeed shipping more smartphones, it isn’t charging as much for them — or making as much money from them as it may have during the salad days of 2012 and 2013.

But the numbers also suggest that Samsung is willing and able to take the fight to the low-cost Chinese competitors that emerged in 2013 and 2014, eating away at its market share and profits.

If you calculate the numbers (I did) this means that Samsung sold 10m fewer phones in the $300+ bracket than last year – effectively ceding that chunk of the market to Apple – and sold 8m more than last year in the sub-$200 bracket.
link to this extract

Brazilian smartphone users quicker to adopt new Android OS than Indian users » Jana Blog

Globally, 93% of Android users are using versions of either the Lollipop, KitKat, or Jelly Bean operating systems on their devices. When we looked at the market share of each Android OS in India and Brazil among mCent users, we saw a similar theme. 98% of mCent users in India and 97% of users in Brazil are using either Lollipop, KitKat, or Jelly Bean. KitKat is the most popular OS among mCent users in both countries…

…In the case of Samsung, the top device brand in India and Brazil, older versions of the Galaxy and the Note will never get the new Marshmallow OS update. So while some users may want to upgrade, they simply may not be able to depending on which device and carrier they have…

…When looking across the three popular Android OS, Lollipop, KitKat, and Jelly Bean, Brazilian users are currently pretty evenly spread out across the three. But when we look at India, the majority of users—52%— are on KitKat. As users in Brazil move to new operating systems, users in India are staying on older OS versions much longer.

This is hardly amazing; Jelly Bean was released in late 2012. You’d be more surprised if newcomers to the smartphone market were on much older OSs.
link to this extract

What do recruiters look for in a resumé at first glance? »Quora

Abra Benjamin responded:

Our world is a lot simpler than you think. “Does this candidate seem like they stand a chance of being a good match for this role? If yes, proceed to next step. If no, reject.” Each recruiter is different, so there’s no one way to answer this question. But I’ll highlight briefly (actually, not so briefly) how I personally absorb a resume.  I should preface this by saying that currently I primarily recruit for senior-level software engineers.

It’s definitely useful if you’re looking around for jobs, especially the stuff about education not mattering much, nor formatting (duh), nor “uncomfortably personal details”, nor cover letters.
link to this extract

Halloween Security Breach » Inside PageFair

Pagefair being, of course, the company which is complaining about the cost of adblocking to publishers, and which offers analytics to them:

If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service, which prompted some visitors to these websites to download an executable file. I am very sorry that this occurred and would like to assure you that it is no longer happening.

The attack was sophisticated and specifically targeted against PageFair, but it is unacceptable that the hackers could gain access to any of our systems. We identified the breach immediately, but it still took over 80 minutes to fully shut it down.  During this time, visitors to websites owned by the publishers who have placed their trust in us were targeted by these hackers.

The damage was mitigated by our standard security practices, but the attackers still gained access.  I want to take some time here to describe exactly what happened, how it may have affected some of your visitors, and what we are doing to prevent this from ever happening again.

Spearphish email to take over account on CDN (Content Distribution Network) which offered a fake Adobe Flash advert which would install a bitcoin mining trojan. The breach was spotted within 5 minutes – but it took another 80 to regain control. Among the sites infected was Anandtech.

Once more, episodes like this make people who use adblockers utterly certain that they’ve made the right decision, while making those who haven’t wonder if they should. It’s a ratchet.
link to this extract

Apple indoor positioning app ‘Indoor Survey’ spotted on iOS App Store » Apple Insider

Mikey Campbell:

According to Indoor Survey’s iOS App Store page, spotted by developer Steve Troughton-Smith, the Apple-branded software enables indoor positioning within a venue by using radio frequency signals and an iPhone’s onboard sensors.

“By dropping ‘points’ on a map within the Survey App, you indicate your position within the venue as you walk through,” reads the app description. “As you do so, the indoor Survey App measures the radio frequency (RF) signal data and combines it with an iPhone’s sensor data. The end result is indoor positioning without the need to install special hardware.”

While not an exact match, the described system smacks of technology pioneered by indoor positioning startup WiFiSLAM, a Silicon Valley firm Apple snapped up for $20m in 2013.

Google has been doing something similar since 2012 for museums and a SLAM (simultaneous location and mapping) system since September 2014.
link to this extract

Start up: a shorter rounder Pebble, VW v DMCA redux, Lenovo’s other spyware, IAB defends ads, and more

Posted on by
Reply


This bloke’s car might offer some clues about Apple’s future offering. Photo by Konabish on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 11 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Pebble debuts its first round smartwatch with the Pebble Time Round » TechCrunch

Greg Kumparak:

Pebble is thus far known for its solid battery life; in a world where most smartwatches last a day or so at best, Pebble’s lightweight OS and e-ink display traditionally let it crank on for closer to a week.

Curiously, though, the Pebble Time Round has shaved off a fair bit of that signature battery life in favor of a lighter, slimmer design — instead of five or six days of battery life, Pebble Time Round promises two days. A quick charge feature lets you add 24 hours of juice with just 15 minutes on the charger — but you won’t be taking this one for week long camping trips.

Less battery life?
link to this extract

You have the right… to reverse engineer » getwired.com

Wes Miller:

This NYTimes article about the VW diesel issue and the DMCA made me think about how, 10 years ago next month, the Digital Millennium Copyright Act (DMCA) almost kept Mark Russinovich from disclosing the Sony BMG Rootkit. While the DMCA provides exceptions for reporting security vulnerabilities, it does nothing to allow for reporting breaches of… integrity.

I believe that we need to consider an expansion of how researchers are permitted to, without question, reverse engineer certain systems. While entities need a level of protection in terms of their copyright and their ability to protect their IP, VW’s behavior highlights the risks to all of us when of commercial entities can ship black box code and ensure nobody can question it – technically or legally.

Miller advised Russinovich on whether he could publish. The VW case is surely going to lead to a lot of questions about the DMCA and engine control unit (ECU) software – as highlighted yesterday.
link to this extract

What will the Apple Car look like? Jony Ive’s taste for Bentleys and Aston Martins could influence design » IB Times

David Gilbert:

So what will Apple’s car look like? By talking to the people in the industry and those who know Ive and his work, IBT gleaned some idea.

“If you look at the Apple philosophy of less is more, then apply that to a car then you would have an Apple product,” said Chris Longmore, founder if U.K.-based automotive design consultancy Drive. Longmore, who has worked with Ford, Nissan and Rolls Royce who believes it is a huge benefit for Apple to be starting with a blank sheet of paper. “If you take the iPhone and move into different areas, because the building blocks would be common throughout that, the DNA would be common across all the products and that’s how they should be looking to do it,” he said.

That too is the view of Ive’s former boss, Martin Darbyshire, CEO and founder of London-based design company Tangerine, who worked with Ive for 18 months before he moved to Apple.

“Sometimes coming at something with a fresh perspective is fundamental to finding something new and developing a paradigm shift. Of all the design teams in the world one would expect Apple to do something interesting and different,” Darbyshire told International Business Times.

Smart move asking Darbyshire. When you look at all the fan-generated renders of the “iWatch”, you realise the gulf between what people wish for and what Apple really does.
link to this extract

Lenovo collects usage data on ThinkPad, ThinkCentre and ThinkStation PCs » Computerworld

Michael Horowitz:

The task that gave me pause is called “Lenovo Customer Feedback Program 64”. It was running daily. According to the description in the task scheduler: “This task uploads Customer Feedback Program data to Lenovo”.

I have setup my fair share of new Lenovo machines and can’t recall ever being asked about a Customer Feedback program.

The program that runs daily is Lenovo.TVT.CustomerFeedback.Agent.exe and it resides in folder C:\Program Files (x86)\Lenovo\Customer Feedback Program.

Other files in this folder are Lenovo.TVT.CustomerFeedback.Agent.exe.config, Lenovo.TVT.CustomerFeedback.InnovApps.dll and Lenovo.TVT.CustomerFeedback.OmnitureSiteCatalyst.dll.

According to Wikipedia, Omniture is an online marketing and web analytics firm, and SiteCatalyst (since renamed) is their software as a service application for client-side web analytics.

So, while there may not be extra ads on ThinkPads, there is some monitoring and tracking.

Lenovo confirms in a support note that it does this, but says it’s non-personal. It seems the purpose is to see which applications, service and offers you go for during system setup. Which says something about the parlous state of crapware on Windows PCs in its own right.
link to this extract

The Apple bias is real » The Verge

Vlad Savov, bravely:

The next time you read an iPhone review, keep all these biases in mind. The iPhone is the favored tech product of a vast swathe of our planet’s population, serving both utilitarian and aspirational purposes. It is the catalyst for and sole supporter of entire ancillary industries. It is the nexus where communication and commerce blend most easily, and it is the surest harbinger of the future that is to come. Any review that doesn’t account for all of these factors might be considered technically objective and ubiased, but it would also be frightfully uninformative. Assessing an iPhone against a blank canvas is akin to describing Notre Dame or Sagrada Família as old, large, religious buildings.

Apple bias exists in reviews because it exists in the real world. The company’s track record with the iPhone and other products like it — characterized by a great deal more right decisions than wrong ones — encourages optimism about its riskier new ventures today. The Apple Watch is credited with greater potential than the Samsung Gear S2 because of the two companies’ different histories. The Huawei Mate S has Force Touch similar to the iPhone 6S, but only Apple’s phone is expected to turn that technology into a transformative new mode of interaction.

That’s justified bias. That’s relevant context derived from history and experience. Without it, we’d be reciting facts and figures, but no meaning. Megabytes and millimeters matter only after they’ve been passed through the prism of human judgment, and we shouldn’t pretend that it can, or should, ever be unbiased.

link to this extract

Functioning ‘mechanical gears’ seen in nature for the first time » Phys.org

Each gear tooth has a rounded corner at the point it connects to the gear strip; a feature identical to man-made gears such as bike gears – essentially a shock-absorbing mechanism to stop teeth from shearing off.

The gear teeth on the opposing hind-legs lock together like those in a car gear-box, ensuring almost complete synchronicity in leg movement – the legs always move within 30 ‘microseconds’ of each other, with one microsecond equal to a millionth of a second.

This is critical for the powerful jumps that are this insect’s primary mode of transport, as even miniscule discrepancies in synchronisation between the velocities of its legs at the point of propulsion would result in “yaw rotation” – causing the Issus to spin hopelessly out of control.

“This precise synchronisation would be impossible to achieve through a nervous system, as neural impulses would take far too long for the extraordinarily tight coordination required,” said lead author Professor Malcolm Burrows, from Cambridge’s Department of Zoology.

“By developing mechanical gears, the Issus can just send nerve signals to its muscles to produce roughly the same amount of force – then if one leg starts to propel the jump the gears will interlock, creating absolute synchronicity.

link to this extract

Ad blocking: the unnecessary internet apocalypse » Advertising Age

Randall Rothenberg is president and chief executive of the Interactive Advertising Bureau:

Let’s take these challenges in order. Advertising (as everyone reading these words knows well) pays for the ability for nearly anyone around the world to type in any URL and have content of unimaginable variety appear on a screen. Advertising also subsidizes the cost of apps, which can take hundreds of thousands of dollars to produce, but are often free or low-priced.

Without advertising, digital content and services either will vanish, or the cost for their production and distribution will come directly from consumers’ wallets.

Of even greater importance is the impact on the economy itself. Advertising represents $350 billion of the U.S. gross national product, and consumers depend on it to help make $9 trillion of annual spending decisions. “Advertising helps the economy function smoothly,” said Nobel Laureate economists Kenneth Arrow and George Stigler. “It keeps prices low and facilitates the entry of new products and new firms into the market.”

Ad blocking disrupts this engine of competition. I wish I were crying wolf, but I’m not. Some websites, particularly those with millennial audiences, are already losing up to 40% of their ad revenue because of ad blocking. Our own IAB research found at least 34% of U.S. adults use ad blockers.

Good grief, where to start?
(1) Content was online long before advertising shoved its sweaty arse in front of us;
(2) Advertising doesn’t pay for smartphones, PCs or internet connectivity;
(3) advertising doesn’t subsidise the production, it subsidises the presentation of many apps – but substantial numbers are simply paid-for (think of UsTwo’s Monument Valley);
(4) the cost of content etc already comes from our wallets, because the cost of advertising is a factor in any company’s costs and so its products
(5) adblocking isn’t going to kill the whole advertising industry, just the bit that behaves unreasonably online
(6) adblocking actually intensifies competition, because it creates a new space where would-be advertisers have to figure out how to get their message across
(7) wouldn’t it have been good to notice that your members were pissing people off before desktop adblocking had been adopted by a third of one section of your audience, Mr Rothenberg?
link to this extract

Shut Up: Comment Blocker » iOS App Store

Richard Romero:

Shut Up spares you from Internet troglodytes by hiding all comment sections when browsing the web in Safari. You can even set your favorite websites to show comments by default.

This stuff is only just getting started.
link to this extract

Malware with your news? Forbes website victim of malvertising attack » FireEye Inc

From Sept. 8 to Sept. 15, 2015, the Forbes.com website was serving content from a third-party advertising service that had been manipulated to redirect viewers to the Neutrino and Angler exploit kits.  We notified Forbes, who worked quickly to correct the issue.

This type of malicious redirection is known as malvertising, where ad networks and content publishers are abused and leveraged to serve ads that redirect users to malicious sites.

I promise that FireEye is not paying for its position here or in the next links. It’s just on top of the relevant news. Also: pretty good case for desktop adblocking there.
link to this extract

Protecting our customers from XcodeGhost » FireEye Inc

Immediately after learning of XcodeGhost, FireEye Labs identified more than 4,000 infected apps on the App Store. FireEye has since updated detection rules in its NX and Mobile Threat Prevention (MTP) products to detect the malicious apps and their activity on a network.

FireEye NX customers are alerted if an employee uses an infected app while the iOS device is connected to the corporate network. It’s important to note that, although the CnC servers have been taken down, the malicious apps still try to connect to them using HTTP. This HTTP session is vulnerable to hijacking by other attackers.

FireEye MTP management customers have full visibility when a mobile device is infected in their deployment base. End users receive on-device notifications of malware detection and IT administrators receive email alerts of the infection.

Four thousand is a lot. Does Apple have any means to killswitch those apps? It can’t kill them based on the developer certificate, because there are lots of developer certificates involved – it’s not a single malicious developer, it’s a single malicious library (or set of libraries) used by many developers.
Apple also has an FAQ up about the exploit.
link to this extract

Guaranteed clicks: mobile app company takes control of Android phones » FireEye Inc

FireEye Labs mobile researchers discovered a malicious adware family quickly spreading worldwide that allows for complete takeover of an Android user’s device. This attack is created by a mobile app promotion company called NGE Mobi/Xinyinhe that claims to be valued at more than $100M with offices in China and Singapore.

The malicious adware uses novel techniques to maintain persistence and obfuscate its activity, including installing system level services, modifying the recovery script executed on boot, and even tricking the user into enabling automatic app installation. We have observed over 300 malicious, illegitimate versions of Android apps being distributed, including: Amazon, Memory Booster, Clean Master, PopBird, YTD Video Downloader, and Flashlight…

…has infected 20 different versions of Android from 2.3.4 to 5.1.1. Victims with 308 different phone models from more than 26 countries and four continents have been infected.

Another day…
link to this extract

Start up: DMCA v Volkswagen, cruel opt-outs, self-parking cars win, HP’s irrelevance, and more

Posted on by
2


The tsunami that hit the Fukushima reactor nearly led to a meltdown – but how many people died from radiation release? Photo by NRCgov on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Researchers could have uncovered Volkswagen’s emissions cheat if not hindered by the DMCA » Electronic Frontier Foundation

Kit Walsh:

Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission. We’ve explained before how this allows manufacturers to prevent competition in the markets for add-on technologies and repair tools. It also makes it harder for watchdogs to find safety or security issues, such as faulty code that can lead to unintended acceleration or vulnerabilities that let an attacker take over your car.

The legal uncertainly created by the Digital Millennium Copyright Act also makes it easier for manufacturers to conceal intentional wrongdoing. We’ve asked the Librarian of Congress to grant an exemption to the DMCA to make it crystal clear that independent research on vehicle software doesn’t violate copyright law. In opposing this request, manufacturers asserted that individuals would violate emissions laws if they had access to the code. But we’ve now learned that, according to the Environmental Protection Agency, Volkswagen had already programmed an entire fleet of vehicles to conceal how much pollution they generated, resulting in a real, quantifiable impact on the environment and human health.

This code was shielded from watchdogs’ investigation by the anti-circumvention provision of the DMCA. Surprisingly, the EPA wrote in [PDF] to the Copyright Office to oppose the exemptions we’re seeking.

With a headline like that, it sounds like an episode of Scooby-Doo. The EPA’s argument in the linked letter is actually reasonable: you know that people will hack the ECM, especially if they get the source code.
link to this extract

The Cruelest Opt-Out Forms » Tumblr

A project in which @lydialaurenson collects all those forms where, when you decline, you’re meant to feel guilty for doing so. Such as this:

Of course you don’t have to read it. You could just miss the best chance of your life.
link to this extract

Self-parking cars are better than humans at parking » Fusion

A new study from the AAA put human drivers who considered themselves adept at parallel parking in a “park-off” against five models of self-parking cars. The result? Human drivers got absolutely destroyed by the automated cars in a test of basic parking skills.

Nearly 80% of survey respondents contacted by the AAA said they were “confident in their parallel parking abilities.” But self-parking cars hit the curb 81% less often than human drivers in the road test, and parked themselves with 47% fewer maneuvers. Self-parking cars were also able to park 37% closer to the curb than human drivers, and—to add insult to injury—they did it 10% faster than the humans.

“Self-parking cars” somehow doesn’t sound as sexy, you know? But the clincher is: only one in four of the people in a survey said they’d trust a car to do the parking. This is the knowledge gap that’s so crucial: we don’t know how good robots are at things.
link to this extract

One million Android users infected with malware through an IQ testing application » Softpedia

Catalin Cimpanu:

The app is called Brain Test and is a simple IQ testing utility, which comes packed with a combination of complex malware strands.

According to Check Point’s research staff, the application was detected via the company’s Mobile Threat Prevention system, first on a Nexus 5 device.

Because its owner, after receiving the malware alert, did not manage to uninstall the malicious app, this prompted Check Point’s team to have a closer look at the source of the infection.

By reverse-engineering the Brain Test app, researchers found a very well-designed piece of malware, which allowed attackers to install third-party applications on the user’s phone, after previously rooting the device and even managing to become boot-persistent.

Brain Test came with a complex detection avoidance system

Looking even further into the issue, researchers found a complex system that allowed the malware to avoid detection by Google’s Bouncer, an automated app testing system that checks for known security issues.

The malware contained code that prevented it from executing if it detected it was being run from certain IP ranges, or domains containing “google”, ”android”, ”1e100.”

After managing to get around Bouncer’s checks and getting installed on a user’s phone, Brain Test would execute a time bomb function whenever the user would run it for the first time.

Even after Google zapped it, the app was re-uploaded five days later. Software that detects when it’s being tested really is the flavour of the month, isn’t it?
link to this extract

London Collision Map Beta

Discover where road traffic collisions have happened in London since 2005; then filter by year, road user, collision severity and age group.

Figures for 2014 show that the number of people Killed or Seriously Injured (KSI) on London’s roads fell to the lowest level since records began. Safe Streets for London, London’s road safety plan, set out the ambition to work towards roads free from death and serious injury and the Mayor’s new target is to halve the number of KSIs by 2020 compared to the Government baseline.

Nice idea, but it’s pretty hellish to use. Heatmaps might have worked better.

link to this extract

Why HP is irrelevant » Om Malik

A few years ago, in a conversation with my friend Pip Coburn (who spent a long time as a tech-stocks strategist for UBS before starting his own firm, Coburn Ventures), I mentioned that a certain company was dead, though not many realized it. And by “dead,” I didn’t mean that it was bankrupt, out of money or out of business. I meant it was dead in its ability to find growth, excitement and new ideas. Any positive energy had flattened and turned negative. “With that lens on, HP has been ‘dead’ for 15+ years,” Pip emailed me this morning.

Pip says that “companies have a space and time and purpose and when those fade the company would be wise to steadily shut itself down.” Like some other large tech companies, HP fits that bill. In a note to some of his clients, Pip pointed out, “The company [HP] doesn’t even do a good job of pretending to have a strategy.” And he is right.

It’s true: HP hasn’t made a market since, what the inkjet printer? Bubblejet printer? Laser printer? Whichever, it’s been a long time.
link to this extract

When radiation isn’t the real risk » The New York Times

George Johnson:

This spring, four years after the nuclear accident at Fukushima, a small group of scientists met in Tokyo to evaluate the deadly aftermath.

No one has been killed or sickened by the radiation — a point confirmed last month by the International Atomic Energy Agency. Even among Fukushima workers, the number of additional cancer cases in coming years is expected to be so low as to be undetectable, a blip impossible to discern against the statistical background noise.

But about 1,600 people died from the stress of the evacuation — one that some scientists believe was not justified by the relatively moderate radiation levels at the Japanese nuclear plant.

None of the workers who went into the stricken plant has died of radiation poisoning. The biggest problem for those workers is heatstroke caused by the extra protective equipment they wear.

Truly, the media reaction to Fukushima was enormously overblown; we are all bad at evaluating risk, but the media perhaps worst of all because “if it bleeds, it leads”.
link to this extract

BT pledges better broadband for UK » BBC News

BT has hit back at rivals calling for its break-up, with a strategy to make the UK the fastest broadband nation.

It revealed plans to connect 10 million homes to ultrafast broadband [300-500Mbps] by the end of 2020 and raise the minimum broadband speed for homes that cannot get fibre to 5-10Mbps (megabits per second).

It comes in a week when rivals have denounced the quality of UK broadband.

In a letter to the Financial Times on Monday, they said BT should be split.

Sky, Vodafone and TalkTalk were among signatories to the letter which claimed that millions of customers currently have a “substandard” broadband service.

Homes currently passed by fibre, according to Ofcom: 23.6m (with 30% takeup, ie 7.1m users).
Households in UK: 26.4m.

However, the gap between that pledge of ultrafast and minimum is just absurd. And it’ll be those who need the faster speeds – in rural areas – who won’t get it.
link to this extract

Soft underbelly » Asymco

Horace Dediu suggests that existing carmakers are underestimating the threat they face from computer-industry entrants:

Traditional car making is capital intensive due to the processes and materials used. There are however alternatives on the shelf. iStream from Gordon Murray Design proposed switching to tubular frames and low cost composites.  BMW has an approach using carbon fiber other composites. 3D printing is waiting in the wings. All offer a departure from sheet metal stamping.

With new materials, costs for new plants can be reduced by as much as 80% and since amortizing the tooling is as much as 40% of the cost of new car, the margins on new production methods could result in significant boosts in margin.

There is a downside however. What is usually compromised when using these new methods is volume and scale of production. So that becomes the real question: how many cars can Apple target? 10k, 50k, 100k per year? Could they target 500k? That would be 10 times Tesla’s current volumes but only a bit more than the output of the Mini brand.

Now consider that the total market is 85 million vehicles per year. For Apple to get 10% share would imply 8.5 million cars a year, a feat that is hard to contemplate right now with any of the production systems. On the other hand selling 80 million iPhones and iPads in a single quarter has become routine for Apple and that was considered orders of magnitude beyond what they could deliver. Amazing what 8 years of production ramping can offer.

Given that cars are increasingly computers with fancy cases on wheels, you really don’t want to rule out low-end or even high-end disruption.
link to this extract

Ad tech always wins: Ad blocker users are the new hot ad-targeting segment » Digiday

Lucia Moses:

“We want to find ways to reach these consumers in ways that suit how they want to be communicated to and with,” Laura Mete Frizzell, gm of search/analytics/media at 360i. “They are part of an audience for which the brand is relevant and can offer utility.”

The potential to target ad blockers is “on the radar,” said Jon Anselmo, senior vp, managing director of digital innovation at MediaVest. “People’s behaviors, including ad blocking, do provide us insights about who they are and what they care about. A tech-savvy nature could absolutely be one such insight.”

On the seller side, too, the idea of targeting blockers is starting to pop up in conversations with publishers like Complex, said its CEO and founder Rich Antoniello. “Those are the hardest to reach people,” he said. One response by Complex has been to use the space normally given over to ads to present ad blocker users with a message asking for their emails to target them regardless.

Mark that last one, because it must surely be the dumbest thing you’ll see today. (Via Rowland Manthorpe.)
link to this extract

Start up: explaining XcodeGhost, Monument Valley goes VR, will Venice sink BlackBerry?, and more

Posted on by
Reply


What’s the common factor in iOS devices bricked by trying to update to iOS 9? Photo by marc falardeau on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Monument Valley’s creators just made a stunning VR game » WIRED

Liz Stinson:

Like most early VR games, Land’s End is in many ways an experiment designed to discover what does and doesn’t work in the medium. Ustwo’s Ken Wong, Peter Pashley and Dan Gray spent more than a year developing the game, with many stops and starts and do-overs along the way. “It took a long long time to reinvent all these fundamental things about how you move around a world and how you interact,” says Wong.

Things like navigation took some toying with. “We spent a lot of time trying to figure out the best way to let people move around these worlds in a way that felt kind of almost subconscious,” says Pashley. You make your way through the levels by glancing at “lookpoints,” shimmering spheres of light that burst open and propel you forward when you look at them. The motion is slow and controlled; it feels almost like a moving sidewalk at the airport.

This looks terrific. Presently for Samsung Gear VR + Oculus only. I’d happily buy the soundtrack.
link to this extract

BlackBerry Venice » YouTube

A pretty much full-size touchscreen Android phone sort of running some sort of BlackBerry software. With a big keyboard that slides out from below. See for yourself.

Notice that he never actually tries to type anything. This may be significant: the top end of the phone would have to be very light to stop it overbalancing.

I wonder (with @charlesknight) whether this is John Chen’s last attempt at hardware; if this flops – which seems pretty likely – there’s little point carrying on. In a few quarters, BlackBerry should have swallowed Good Technology completely and can live on software and services revenues, which are much more profitable.
link to this extract

What you need to know about iOS malware XcodeGhost » Mac Rumors

The story so far (which I did notice over the weekend; I apologise for not including it in Monday’s Start Up): impatient iOS developers in China downloaded hacked copies of Xcode from Baidu servers because the ones from Apple came over slow-as-snails links from the US. The hacked copies included malware libraries that were included by default in any apps developed with them. The apps got through Apple’s approval process – and were then noticed by Palo Alto Networks, which itself noticed it on Weibo after analysis by Alibaba researchers.

Q How does XcodeGhost put my iOS devices at risk?
iOS apps infected with XcodeGhost malware can and do collect information about devices and then encrypt and upload that data to command and control (C2) servers run by attackers through the HTTP protocol. The system and app information that can be collected includes:

• Current time
• Current infected app’s name
• The app’s bundle identifier
• Current device’s name and type
• Current system’s language and country
• Current device’s UUID
• Network type

Palo Alto Networks also discovered that infected iOS apps can receive commands from the attacker through the C2 server to perform the following actions:

Prompt a fake alert dialog to phish user credentials; hijack opening specific URLs based on their scheme, which could allow for exploitation of vulnerabilities in the iOS system or other iOS apps; read and write data in the user’s clipboard, which could be used to read the user’s password if that password is copied from a password management tool.

Q Can XcodeGhost affect users outside of China?
Yes. Some of the iOS apps infected with XcodeGhost malware are available on the App Store in countries outside of China. CamCard, for example, is a popular business card reader and scanner app available in the United States and several other countries, while WeChat is a popular messaging app in the Asia-Pacific region.

Q Why would some Chinese developers download Xcode from Baidu?
Xcode is a large file that can take a long time to download from Apple’s servers in China, leading some developers to download Xcode from unofficial sources.

Q How are Apple and Chinese developers dealing with XcodeGhost?
Palo Alto Networks claims that it is cooperating with Apple on the issue, while multiple developers have updated their apps to remove the malware.

There’s a list of affected apps.

This is a significant attack, but it’s also a remarkably hard one to do more than once. I suspect the next attack will involve some sort of man-in-the-middle on security certificates that Apple will surely enforce on Xcode downloads.

Rich Mogull has a great writeup in which he says it’s about the economics of security:

Apple doesn’t believe all attacks can be stopped, and certainly not those from governments or well-funded criminal organizations, but if you make the cost of attack higher than the benefits, you knock out entire categories of bad guys and reduce the impact on users.

link to this extract

French regulator rejects Google appeal on scope of ‘right to be forgotten’ » WSJ

Sam Schechner:

France’s Commission Nationale de l’Informatique et des Libertés, or CNIL, said that Google must now adhere to a formal order in May directing it to apply Europe’s right to be forgotten to “all domain names” of the search engine, including google.com—or face possible sanctions proceedings.

Established just over a year ago by the European Union’s Court of Justice, the right to be forgotten gives European residents the ability to request that search engines remove links that appear in searches for their own name. Google has applied the ruling, but insisted on only removing results from European domain names, such as google.fr, not from google.com.

Google on Monday reiterated that it doesn’t believe the French regulator has the authority to expand the scope of the rule. “As a matter of principle we respectfully disagree with the idea that one national data protection authority can assert global authority to control the content that people can access around the world,” a spokesman said.

Ever so tricky. The US has claimed jurisdiction over sites that are hosted and authored elsewhere in the world that use the “.com” suffix; is that the same?

One suspects that Google will – if it loses in any appeal – work around this by offering filtered content to any IP address identified as being in France, just as it does to identify who to serve .fr content to.
link to this extract

Apple iPhones, iPads BRICKED by iOS 9’s ‘slide-to-upgrade’ bug » The Register

Shaun Nichols:

Reg reader Carlton told us today: “I have just updated my iPad to iOS 9 and found to my horror that once it has ‘successfully’ installed and then gone through the initial setup phase, I cannot progress past the second request to ‘slide to upgrade’ page.

“The setup order is ‘passcode’ – ‘slide to upgrade’ – ‘select Wi-Fi’ – ‘slide to upgrade’ at which point no further actions are possible.”

He was eventually able to upgrade his device to the new iOS using Apple’s suggested clean install procedure, though he said it took multiple attempts to accomplish.

Other fans reported similar problems when they tried to get the latest and greatest version of iOS on their iPads, iPhones and iPod Touch players.

While the issue appeared to be largely relegated to devices running iOS 7 skipping over to iOS 9, Apple would not confirm if that was in fact the case. No word yet on when a fix for the bug will be released.

Apple already has its hands full patching flaws with its firmware updates.

Commenters seem to concur: works fine if you’re just going from iOS 8, kills the device if you’re trying to skip upwards from iOS 7. An Apple support note says “This will be resolved soon in an upcoming iOS update”. Let’s see. (Meanwhile, Apple said in an aside in its press release about the release on Friday of the new iPhone that 50% of devices contacting the App Store as of September 19 were using iOS 9. In less than a week?!)
link to this extract

How to record a phone call on your iPhone – no additional kit of apps required » BBC College of Journalism

Marc Settle discovered (via Mashable) a terrific way to record a call:

A statement is never as good as an interview, which is where the ‘advanced’ function comes in, even if it needs a little willingness from your guest.

Call them from your iPhone and explain what you plan to do. Press ‘add call’ and then call the phone number you’re ringing them from. Yes, you did read that correctly: you need to call your own number from your own phone. As you’re on the phone, your answerphone will kick in. At this point tap ‘merge calls’: you and your interviewee will now be recording your conversation on your answerphone. End the call and then proceed as above to access the recording.

This reminds me of the “huh??” method that used to exist for running (old, old) pre-OSX Macs entirely from RAM, no disk access required, which meant gigantic battery life: you loaded a minimal OS, and then dragged your hard drive into the Trash. Honest. You just had to remember not to empty it.
link to this extract

Why we need a competition inquiry into the UK broadband market » TalkTalk BlogBlog

Dido Harding, TalkTalk chief executive:

Over 500 telecoms companies exist in the UK, but most depend on a shared set of wires that connect individual homes to our networks. When BT was privatised, it was allowed to keep control of this network on behalf of the whole industry, and it is managed today by Openreach, a BT company. It’s like one gas supplier owning the national grid, or one airline owning Heathrow.

Unfortunately, that system isn’t working because BT has used its sole control over the network to its advantage, rather than to benefit the network or customers. Openreach makes a lot of money, but it hasn’t invested enough in maintaining the network, leaving customers suffering from poor quality of service and facing long waits to repair faults or install new lines. It allows BT to abuse its control to restrict choice for customers. It also makes it harder for the regulator to enforce the rules and be a powerful consumer champion. Put simply, it’s a tired model not fit for a superfast future.

Openreach is TalkTalk’s biggest supplier; we couldn’t operate as a business without it. So naturally, I’ve got a vested interest in this debate. But what matters about today’s letter is the breadth of the coalition calling for change. It includes some of the biggest companies in the industry who have tried – and failed – for years to improve the system, as well as smaller players battling to bring innovation and choice to the market, but let down by Openreach.

Agree. Where do I sign up too?
link to this extract

600 ad companies blacklist The Pirate Bay » Music Week

Coral Williamson:

The Pirate Bay has been blacklisted by more than 600 advertisers.

The blacklist, comprising 10 sites so far, is the result of a partnership between anti-piracy group Rights Alliance and Swedish Advertisers, an association of advertisers with more than 600 member companies.

Swedish Advertisers has published a list of  recommendations designed to keep advertisers away from unlicensed sites, including observing good ethics, avoiding advertising contracts that include bulk sales, and considering where ads are ultimately placed.

OK, I have to ask. Is it unethical to use adblockers on torrent sites?
link to this extract

The number of people using search engines is in decline » Business Insider

Lara O’Reilly:

search is facing a huge challenge. The paid search business was built on a desktop browser model. And consumers are increasingly shifting to mobile. On mobile, consumers say they just don’t search as much as they used to because they have apps that cater to their specific needs. They might still perform searches within those apps, but they’re not doing as many searches on traditional search engines (although Google, Bing, and so on do power some in-app search engines.)

It sounds obvious, but there’s new data to show it’s a trend that’s really happening. And it could have a severe impact on Google’s (and Bing, and Yahoo’s) core search business. Indeed, data from eMarketer shows search ad spend growth is set to decline from 2014 through to 2019.

Speaking at digital trade show Dmexco in Cologne earlier this week, global communications agency ZenithOptimedia’s chief digital officer Stefan Bardega and research company GlobalWebIndex’s head of trends Jason Mander gave a mobile trends presentation. It was the slides on search that made the audience really sit up and start taking notes and photos.

And it’s this:

App usage and voice search both contribute too. How do you sell an ad beside a voice search?
link to this extract

Advertising is unwanted, day 2 » Scripting News

Dave Winer, in a followup to a post of a day earlier, suggesting news orgs need to find new ways to bring their readers together:

Here’s an idea for a geography-based news org (i.e. a newspaper) – give readers a place to talk about movies, and then sponsor movie nights based on their interests. Encourage people to provide lists of their favorite movies and do some collaborative filtering. Then collate the reviews and present them alongside your professional reviewer’s post. Work with the movie industry. It can have incredible promotional value, for the movie, the theater, you, the whole idea of going to the movies (as opposed to watching on your home TV, phone or tablet). What’s great for your community is they get to meet people who like the same kinds of movies they do. And you get to know who they are! It’s such a huge, easy win, all-around. That more local news orgs haven’t done it tell you how stuck in old print models we still are. This is an example of a kind of idea that really can only blossom online.

Creating community is a great idea. But what if the community lives all over the world? How does this physically-based idea work?
link to this extract

Start up: YouTube’s smartest change, Google + Huawei, the truth on ads, Windows Phone redux, and more

Posted on by
Reply


When Javascript hits a particular temperature… Photo by Tom Gill on Flickr.

A selection of 11 links for you. Too much, right? I’m charlesarthur on Twitter. Observations and links welcome.

The ‘terrifying’ moment in 2012 when YouTube changed its entire philosophy » Business Insider

Jillian D’Onfro:

the discovery algorithm often recommended videos that weren’t the best fit. For example, if a user searched for the footage from a recent fight, YouTube might recommend a clip with a thumbnail image of a juicy punch and a title about someone getting knocked out. When the user clicked, the actual video would be not fight footage, but a dude sitting in his living room just talking about the epic punch.

But when the frustrated user clicked through several different videos, the algorithm tallied up the views and counted it as an accomplishment.  

“We realized that if we made the viewer click that many times, it didn’t seem to be a good estimate of how much value they were deriving from YouTube,” [YouTube’s director of engineering for search and discovery, Cristos] Goodrow said. “Instead, we realized that if they didn’t leave a video and continued watching, that seemed like a better estimate of the value they were getting.” 

So, after bouts of data collection and analysis coupled with countless meetings, YouTube re-jiggered its search-and-discovery algorithm on March 15 to make watch time, not views, the determining factor in what videos to recommend.

Seems obvious. But actually, that’s the sort of customer dissatisfaction that’s really hard to spot in the first place, and then really hard to change – because it upsets the existing order.

Google’s best Android friend » The Information

Amir Efrati:

Unlike other Android hardware partners like Samsung and Xiaomi, Huawei has no ambition whatsoever to compete with Google in mobile software and services. Huawei has agreed to help Google distribute a mobile app store in China, a market where Google has largely been shut out, say people briefed on the talks between the companies. (It remains to be seen whether Google can get a green light from the government to do so.)

Huawei, whose core networking-equipment business has helped it develop relationships with wireless carriers globally, could help Google expand its nascent wireless network service outside the U.S. and work on other wireless experiments to expand Internet access in emerging markets. Google might also seek to license some of Huawei’s patents in that area.

Meanwhile, Huawei this fall will become the first mainland China manufacturer to produce a “Nexus” smartphone together with Google, people with direct knowledge of the project have said. While the phone likely won’t be a big seller, it will serve as a status symbol for a privately-held Chinese firm that is trying to boost its consumer brand around the world and be as beloved as Coca-Cola.

Risky game for Google: Huawei has found it impossible to shake off suspicions in the US about its Chinese ownership and allegations of spying. There’s absolutely no evidence against Huawei, but that isn’t an obstacle for some.

Content blockers, bad ads, and what we’re doing about it » iMore

Rene Ritchie explains why there are sometimes tons of ads on iMore pages – which led one person to write a content blocker for iOS 9. This part though is worth noting:

Just as desktop ads pay far less than old-fashioned print ads, mobile ads pay far less than desktop. Because phone displays are smaller than desktop, ads are also far harder to ignore. They’re not off to the side or a small strip on a big screen. They’re in our faces and in our way.

As more and more people move to mobile, revenue goes down, and the typical response is to amp up the ads in an attempt to mitigate the loss. That, of course, just makes them even more annoying.

Ad networks have not responded well to any of this. Hell, they still haven’t fully responded to Retina and HiDPI displays, and those came out in 2011.

You’d think the ad industry would be at the forefront of user experience, and that making gorgeous, high performance, highly engaging ads would boost conversion and ultimately income for everyone. Unfortunately, it seems like whatever math they’re running shows crappy ads perform well enough that making great ads isn’t worth the extra effort.

Note that first paragraph: “because phone displays are smaller than desktop, ads are also far harder to ignore”. In that case, why do they pay less on mobile, which has more readers?

Scary internet scam becoming disturbingly common » TidBITS

Randy Singer:

While the legions of Mac viruses still haven’t appeared, there is a new nasty out there that takes advantage of this paranoia. It isn’t a virus, a Trojan Horse, or any other sort of actual malware. Instead, it’s more like a phishing scam, using social engineering to get you to do something that the bad guys want you to do. It does it by scaring the willies out of you, and it is becoming disturbingly common. Some call it “scareware” or “ransomware.”

What happens is that you visit a Web site and seemingly have your browser maliciously frozen. You’ll find that you can’t quit, nor can you navigate away from the page by clicking the Back button.

Next, a page or pop-up appears telling you any of a number of stories (often tailored to your location), perhaps that your Mac has a problem or has illegal material on it, or that your data has been encrypted by some malevolent entity.

The real culprit: a (non-destructive) Javascript hack. But if you follow the scam instructions, you will have a real problem.

Musings on autonomous transport: are self-driving Starbucks the future? » Core77

Michael Ditullo:

what happens when the car evolves from a means of transport to a place itself? Commuting to work? Take a Starbucks owned and operated car where you can get a latte and lounge at a table while working on your laptop along the way. A long drive to see the in-laws? Call for a movie car where you can watch a Michael Bay blockbuster in full surround sound on that two hour ride. Need to run some errands and grab lunch? Sounds like a burrito car. Need to work off the day’s stress on the way home? Pick from a workout car or a zen meditation car.

Once upon a time Starbucks called itself the “third place.” Not home, not work, that other place you wanted to go in-between. The self-driving car could very well evolve into that third place, but a place on-the-go. The in-between place becomes something that can also get you where you need to go. I imagine an entire crop of small businesses existing solely on cars. The payment in exchange for the goods and services these businesses provide would pay for the car journey itself.

This all assumes that we’ll need to travel to exactly the same extent. Can we be sure that’s true? Why take the Michael Bay blockbuster car if you could get the same at home? Does the car become a relief from home? So many assumptions are built into the way we view self-driving cars. More working from home, less travel?

The three unlikely lessons from the Microsoft/Nokia Adventure » VisionMobile

Michael Vakulenko:

Looking at the industry through the lens of software-defined business models has helped us to accurately predict years before the story unraveled the duopoly of Apple and Google (2009), the demise of Palm (2009), the outcome of HP’s foray into mobile with WebOS (2010), BlackBerry’s meltdown (2010), and the failure of Windows Phone (2012).

The story repeats in Internet of Things. Much like in mobile, software-defined business models cause deep shifts in how value is created and delivered. The IoT winners will be decided by business model innovation, not by technology, product features or standard committees. VisionMobile’s Stijn Schuermans wrote about it here – What the Internet of Things is not about.

How bad is it for Microsoft if it misses out on the IoT?

Microsoft takes $7.6bn Nokia writedown and cuts 7,800 jobs » FT.com

Richard Waters and Richard Milne with the collateral damage:

The job cuts will include 2,300 of the 3,200 remaining Nokia handset workers in its home country of Finland, adding to a decline in the pulp and paper industry that has led some to dub it the new “sick man” of Europe as unemployment and public debt levels have risen.

Microsoft took on 25,000 workers with the acquisition in April last year, inflating its headcount to 128,000. By the end of March this year it had cut its workforce back to about 119,000.

“In practice, this means the end of Nokia’s old business in Finland,” Juha Sipilä, the country’s prime minister, told a hastily-convened press conference on Wednesday. The situation is so serious in the country, which has been mired in recession for the past three years, that the new centre-right government has called for an extra budget in September to help the affected workers.

Also in the story:

“It’s a repudiation of the Ballmer strategy to buy Nokia,” said Ken Dulaney, an analyst at Gartner. Microsoft should have acquired BlackBerry instead to focus on its core business users, he added — a strategy that the company backed on Wednesday, as Mr Nadella announced a narrowing of the handset division’s focus to making handsets for workers and a smaller number of “flagship” devices.

Yes: Microsoft really should have bought BlackBerry. Wouldn’t have cost much more, and would have been a valuable asset adding to what it’s trying to do. Love to know the discussions that happened, or didn’t, over that.

Wikileaks release indicates Hacking Team sold spyware to FSB, Russia’s secret police » Forbes

Tom Fox-Brewster:

in December 2012, a NICE employee asked Hacking Team whether it had sold directly to the FSB rather than via the Israeli company.

“Yes we did,” the Hacking Team employee responded. “We discussed this opportunity in the past and you were aware of the fact we were working there. I’d like to take advantage of this conversation to ask you a feedback about Azerbaijan.”

Asked about working in Russia, Hacking Team head of communications Eric Rabe said: “We have not sold to blacklisted countries — at least when they were actually on a blacklist. As you know these things can change and a country, that is considered respectable, may later on turn out not to be.”

So classy. Here’s the Wikileaks link, if you’ve got a few spare years to read through the emails.

Hacking Team Flash zero-day tied to attacks in Korea and Japan… on July 1 » Trend Micro

Weimin Wu:

Earlier this week several vulnerabilities were disclosed as part of the leak of information from the Italian company Hacking Team. We’ve noted that this exploit is now in use by various exploit kits. However, feedback provided by the Smart Protection Network also indicates that this exploit was also used in limited attacks in Korea and Japan. Most significantly, these took place before the Hacking Team leak took place; we first found this activity on July 1.

The exploit code we found is very similar to the code published as part of the Hacking Team leak. As a result of this, we believe that this attack was carried out by someone with access to the Hacking Team tools and code.

According to the Adobe security bulletin, the vulnerability CVE-2015-5119 affects all of the latest Flash versions on Windows, Mac, and Linux. Adobe has since provided a security update for this vulnerability.

Not clear from this – and apparently not to Trend Micro either – whether this attack was by Hacking Team, or by someone who had already broken into their systems and was using this attack for themselves.

In other news, Adobe’s security update team must be one of the hardest-working in the industry.

Apple plans record number of new iPhones » WSJ

Lorraine Luk and Daisuke Wakabayashi say it has ordered 85m-90m devices – up from 70m-80m last year:

The changes in the iPhone models expected to be released later this year will be less noticeable than last year’s. The phones are expected to feature Apple’s Force Touch technology that can distinguish between a light tap and deep press, allowing users to control a device differently depending on how hard they push on the screen, according to people familiar with the matter. Apple has added this feature to the Apple Watch and MacBook laptop computer.

In addition to keeping the display size unchanged, Apple is expected to keep the screen resolution about the same, according to people familiar with the matter.

It may offer a fourth color for the aluminum casing of the iPhone, in addition to silver, gold and space gray, these people said.

Force Touch is being signalled so strongly it would be surprising if it weren’t there. (I’ll elucidate later.)

Finland enlists convicted Lizard Squad hacker to fight cyber crime » Newsweek

Caroline Baylon:

17-year-old Julis Kivimaki, a member of the infamous Lizard Squad hacking group, was found guilty of over 50,000 counts of computer crime by a Finnish court, local media have reported, but rather than face prison time, the judge has ordered that Kivimaki himself help “fight against cyber crime”.

The extent of Kivimaki’s punishment will be a two-year suspended sentence, the confiscation of his computer, and being made to return some €6,500 in profits earned from cyber crime.

Kivimaki, known by the online nickname “zekill”, has been hacking since age 15 and committed a wide range of attacks directed at individuals, engaging in online harassment and identity theft, as well as corporations, where he triggered data breaches, hijacking of emails, and stealing credit card information.

To catch a thief…

Start up: Windows Phone hits the buffers, more Flash woes, do Google ads discriminate?, and more

Posted on by
Reply


If there’s a stream and nobody listens… hang on. Photo by jjjj56cp on Flickr.

A selection of 9 links for you. They flip, they bend, they twirl away. I’m charlesarthur on Twitter. Observations and links welcome.

Zero-day Flash player exploit disclosed in ‘Hacking Team’ data dump » The Hacker News

Swati Khandelwal:

While analyzing the leaked data dump, researchers discovered at least three software exploits – two for Adobe Flash Player and one for Microsoft’s Windows kernel.
Out of two, one of the Flash Player vulnerabilities, known as Use-after-free vulnerability with CVE-2015-0349, has already been patched.

However, the Hacking Team described the other Flash Player exploit, which is a zero-day exploit with no CVE number yet, as “the most beautiful Flash bug for the last four years.”
Symantec has also confirmed the existence of the zero-day flaw in Adobe Flash that could allow hackers to remotely execute code on a targeted computer, actually allowing them to take full control of it.

Researchers found a Flash zero-day proof-of-concept (POC) exploit code that, after testing, successfully worked on the most latest, fully patched version of Adobe Flash (version 18.0.0.194) with Internet Explorer.

Successful exploitation of the zero-day Flash vulnerability could cause a system crash, potentially allowing a hacker to take complete control of the affected computer.

Flash depresses me. I removed it from my machine some time ago; it’s basically a malware vector whose functions can almost always be replaced with HTML5 by normal users. See below.

How to enable click-to-play plugins in every web browser » Hot-To Geek

Chris Hoffman:

Most web browsers load Flash and other plug-in content as soon as you open a web page. Enable “click-to-play” plug-ins and your browser will load a placeholder image instead — click it to actually download and view the content.

Click-to-play allows you to conserve download bandwidth, improve page load times, reduce CPU usage, and extend laptop battery life. This feature gained popularity with Flashblock for Firefox and is now built into modern browsers.

Do this, for the safety of your system.

Satya Nadella email to employees on sharpening business focus » Microsoft News Center

Phones. Today, we announced a fundamental restructuring of our phone business. As a result, the company will take an impairment charge of approximately $7.6bn related to assets associated with the acquisition of the Nokia Devices and Services business in addition to a restructuring charge of approximately $750m to $850m.

This isn’t actual lost money, but lost value of the business – a “goodwill” writedown. The phones aren’t any more or less profitable as a result.

I am committed to our first-party devices including phones. However, we need to focus our phone efforts in the near term while driving reinvention. We are moving from a strategy to grow a standalone phone business to a strategy to grow and create a vibrant Windows ecosystem that includes our first-party device family.

Translation: phones that don’t run Windows are not needed. Say goodbye to those Nokia featurephones (24.7m in Q1, likely fewer in Q2, probably zero by Q4).

In the near term, we will run a more effective phone portfolio, with better products and speed to market given the recently formed Windows and Devices Group. We plan to narrow our focus to three customer segments where we can make unique contributions and where we can differentiate through the combination of our hardware and software. We’ll bring business customers the best management, security and productivity experiences they need; value phone buyers the communications services they want; and Windows fans the flagship devices they’ll love.

Translation: cheap Lumias continue; will do a flagship. Business customers will get support on whichever platform.

In the longer term, Microsoft devices will spark innovation, create new categories and generate opportunity for the Windows ecosystem more broadly. Our reinvention will be centered on creating mobility of experiences across the entire device family including phones.

Translation: phones aren’t so important, are they?

September 2013: The deal that makes no sense » Stratechery

Ben Thompson, back in September 2013:

Early this morning Microsoft acquired Nokia for €3.79 billion (plus €1.65 billion for patents). It is a deal that makes no sense.

While industry observers love to pontificate about mergers and acquisitions, the reality is that most ideas are value-destroying. It is far better to form an alliance or partnership; most of the benefits, none of the costs.

A partnership similar, in fact, to the one formed just two years ago between Microsoft and Nokia.

From Microsoft’s perspective, that was a brilliant deal; Matt Drance characterized it as “Microsoft Buys Nokia for $0B,” and he wasn’t far off. The premier pre-iPhone phone maker, with what was even then one of the best supply chains, distribution networks, and brands in the world would be exclusively devoted to Windows Phone.

There is nothing further to be gained by an acquisition.

Actually, turned out to have negative value, financially speaking. (The whole post is very well worth re-reading in hindsight.)

Two-Factor authentication » Apple Developer

Is going to be built in to iOS 9 and OSX 10.11 (aka “El Capitan”):

Whenever you sign in with your Apple ID on a new device or browser, you will verify your identity by entering your password plus a six-digit verification code. The verification code will be displayed automatically on any Apple devices you are already signed in to that are running iOS 9 or OS X El Capitan. Just enter the code to complete sign in. If you don’t have an Apple device handy, you can receive the code on your phone via a text message or phone call instead.

Once signed in, you won’t be prompted for a verification code again on that device unless you erase your device, remove it from your device list, or need to change your password for security reasons. When signing in on the web, you can choose to trust your browser so you won’t be prompted for a verification code the next time you sign in from that computer.

The problem with 2FA is always “what if I lose my phone?” Google gets around this by letting you have printed codes that act as verification numbers; it’s a good idea that Apple might do well to take up.

But this looks a lot better than the version used at present in iCloud.

Study suggests Google’s ad-targeting system may discriminate » MIT Technology Review

Tom Simonite:

Researchers from Carnegie Mellon University and the International Computer Science Institute built a tool called AdFisher to probe the targeting of ads served up by Google on third-party websites. They found that fake Web users believed by Google to be male job seekers were much more likely than equivalent female job seekers to be shown a pair of ads for high-paying executive jobs when they later visited a news website.

AdFisher also showed that a Google transparency tool called “ads settings,” which lets you view and edit the “interests” the company has inferred for you, does not always reflect potentially sensitive information being used to target you. Browsing sites aimed at people with substance abuse problems, for example, triggered a rash of ads for rehab programs, but there was no change to Google’s transparency page.

What exactly caused those specific patterns is unclear, because Google’s ad-serving system is very complex. Google uses its data to target ads, but ad buyers can make some decisions about demographics of interest and can also use their own data sources on people’s online activity to do additional targeting for certain kinds of ads. Nor do the examples breach any specific privacy rules—although Google policy forbids targeting on the basis of “health conditions.” Still, says Anupam Datta, an associate professor at Carnegie Mellon University who helped develop AdFisher, they show the need for tools that uncover how online ad companies differentiate between people.

Google didn’t respond to the researchers’ requests. But, oddly, it changed the language on that transparency page. This is the AdFisher study

Apple Music and the listener-to-buyer ratio » Music Industry Blog

Mark Mulligan on the maths of streaming v buying:

What quickly becomes apparent is that the most viable route to ensuring Apple Music streaming revenue offsets the impact of lost iTunes sales revenue is as big an installed base of streaming users as possible. The more Apple Music users there are, the more likely more of them will find and listen to your music. This is why the scale argument so is so important for streaming and also why small labels feel the effect less quickly. If you have a vast catalogue you don’t need to worry too much about the listener-to-buyer ratio because you have so many tracks that you are a much bigger target to hit. The laws of probability mean that most users are going to listen to some of your catalogue.

Let’s say you are a big major with 1 million tracks out of the 5 million tracks that get played to any meaningful degree in streaming services. That gives you a 20% market share. But if you are an independent with 50,000 tracks that gives you 1%, 20 times less than the major. Which means that you are 20 times less likely to have your music listened to. And that is without even considering the biases that work in favour of the majors such as dominating charts and playlists, and other key discovery points.

YouTube gaming star PewDiePie ‘earned $7m in 2014’ » BBC News

YouTube continues to be a profitable enterprise for its top tier stars, who earn money from advertisements placed around their videos.

The site’s terms and conditions forbid creators from disclosing how much they earn, but on Monday gamer Olajide Olatunji, known as KSI, told the newspaper Metro he had earned enough money to buy his parents a house.

Although some stars supplement their income with product placement deals, [Felix] Kjellberg [aka PewdiePie] says he does not do very many.

“I make more than I need from YouTube,” he wrote on Reddit. “With that freedom, but also to respect my fans for making that possible, I don’t end up doing many endorsements.”

[Ian] Maude [of Enders Analysis] has a word of caution for anybody eyeing up YouTube with dreams of becoming a millionaire.

“As with many things, a few people at the top do exceptionally well but there’s a long tail of people who don’t make any money at all,” he said.

Why can’t they disclose how much they earn?

Apple Watch sales plunge 90% » MarketWatch

Brett Arends:

two-thirds of the watches sold so far have been the lower-profit “Sport” version, whose price starts at $349, according to Slice, rather than the costlier and more advanced models that start at $549.

In an ambitious bid for the luxury market, Apple also unveiled a gold “Edition” model priced at $10,000 or more. So far, fewer than 2,000 of them have been sold in the U.S., Slice contends.

Slice bases its research on electronic receipts sent to millions of email addresses following purchases. The company conducts market research on behalf of consumer-goods companies, among others, many of them in the Fortune 500.

Wall Street has been desperately trying to work out how well the new watch has been selling, but Apple has been refusing to say. The company, which in the past has updated Wall Street on the sales of new products soon after the launch, has yet to release any numbers about the watch.

Those Edition watches will have made a ton of profit. But apparently the fall in sales is “ominous”. Seems like about 3m sold in the US in the quarter. That’s about four times the number of Android Wear devices sold in seven months or so from multiple manufacturers at lower prices worldwide last year. Ominous.

Start up: SLR death throes, why fusion won’t change things, Apple’s waterproof phone?, Samsung’s big spend, and more

Posted on by
Reply


What are those funny phones they’re holding, dad? Photo by w|©kedf|lm on Flickr

A selection of 10 links for you. Slather over the body when nobody is looking. I’m charlesarthur on Twitter. Observations and links welcome.

Prediction: the age of the standalone still camera is coming to an end for all but pros » Vincent Laforet’s Blog

who wants to stick a CF/SD card in a computer, import, edit, tone, export, share / publish a website anymore – when you can do the same thing in 1-3 clicks of your thumb on a smartphone?

The battle is over… the smartphones and iOSs have won. The quality is good enough on a smartphone/iPhone today, that when combined with software the need for a dedicated still camera can appear to be a burden to the majority of people out there: unless they have a specific technical need that only a DSLR or speciality lenses can offer.

With platforms like Twitter, FB, Storehouse, Instagram, 500 pixels, Tumblr etc etc – it’s too late to go back to the clunky way of doing things unless you are TRULY a big time hobbyist who loves the process. And I do! But not that often… and truth is: we’re in the vast minority…

The technological trends and shift towards digital and now smartphones that are connected to the web are undeniably the most important factors at play here: we’re all gotten used to having a $300-$900 mini computer on us at ALL times, and you can’t compete with a tool that is glued to your end-user… no camera company can compete with that, and they simply haven’t even tried to put editing/social media software into their cameras, which is a potentially devastating oversight long term.

It’s not that dramatic a prediction, but it’s the relentlessness that’s so imposing.

If Lockheed’s recent announcement on nuclear fusion energy is true, how would it change the world? » Quora

Ryan Carlyle, who says he’s a BSChE (chemical engineer?) and subsea hydraulics engineer, is here to rain on the parade:

Real-world fusion reactors aren’t going to be like “Mr Fusion” style reactors from Back To The Future. I mean, seriously -it ran on garbage and powered a flying car. That almost makes the time travel plot seem realistic in comparison. But that’s what people seem to think when they hear “miniature fusion plant.”

Pro tip: the physics of fusion power do not support the concept of automobile-scale fusion. Seriously, this isn’t Tony Stark’s Arc Reactor; it’s just a thermoelectric power plant with a slightly smaller heat source. You need a giant steam turbine and ridiculously giant cooling system to generate serious electricity from a fusion reactor. Even if you miniaturize the reaction chamber, the support equipment required for electricity generation will still be extremely large.

Here’s a small nuclear power plant. I have helpfully indicated the size of the actual fission reactor inside the containment structure:

And here’s my detailed conceptual rendering of a “miniature” fusion reactor power plant with the same power output:

And that’s only the start of it.

Ghacks is dying and needs your help » gHacks Tech News

Martin Brinkmann, who started the site in 2005 and was able to make it his full-time job, now faces the chasm:

In addition to [Google downranking the site in 2011 with its Penguin search update], ad blockers and script blockers became increasingly popular. Since advertisement is what keeps this site alive, a yearly increase between 5 and 10% in ad-block usage is not something that you can endure for long especially if it goes hand in hand with a decline in traffic.

Currently, between 42% and 44% of all users use blockers when they visit the site and if the trend continues, more than 50% might before the end of the year.

If you take these two factors together, it is only a matter of time before ad revenue won’t be sufficient to pay for the site’s upkeep anymore.

Advertising is dying in its current form. While I could make a quick buck throwing popups, auto-playing videos or other nasty stuff at you, I’d never do that.

Heck, those are the things that make people use ad-blockers in the first place and as much as I like this site to survive, I like to protect the integrity of this site and you from these diabolical monetization methods even more.

Advertisements won’t be sufficient to keep this site up and there is not really much out there that I could implement or try instead to make sure this site is not taken off the Internet in the next year.

He’s going to try Patreon. Presently the pledges aren’t enough to cover the server costs – $280 per month?! I wish him luck, but I’m not optimistic. (I’ll return to see how things are in a few months.)

I think Brinkmann’s business problems are probably echoed all over the web by small sites which were once able to make money from ads, but are now finding them sucked up by Facebook, or Twitter, or the effect of Google invisibility.

US DOJ accuses three men in largest email breach ‘in the history of the Internet’ » GeekWire

Frank Catalano:

The indictments against two Vietnamese citizens and a Canadian citizen — operating from Vietnam, the Netherlands, and Canada — alleges the trio were involved in hacking at least eight U.S. email service providers, spamming tens of millions of email recipients, getting money from affiliate relationships for spammed products, and laundering the proceeds.

“The defendants allegedly made millions of dollars by stealing over a billion email addresses from email service providers,” U.S. Assistant Attorney General Caldwell said in a statement. “This case again demonstrates the resolve of the Department of Justice to bring accused cyber hackers from overseas to face justice in the United States.”

The Department of Justice (DOJ) estimates the accused allegedly took in approximately $2 million through the affiliate marketing sales linked to spam. One of the three is said to have already pleaded guilty.

Brian Krebs suggests it was a breach of the email marketing company Epsilon in 2011 – whose servers were then hijacked to send the spam. A reminder that spam is still big, big business.

Why do we care about Xiaomi? » Benedict Evans

Evans (who works at VC company a16z) thinks we care (or should) because of what it implies for the “next stage” of Android:

Historically, Google’s lock on Android outside China has therefore been based on three things: 

• You can’t experiment outside very tight constraints: making even one forked device means Google won’t allow you to sell a single phone running Google services. And all the OEMs have too much to lose to risk experimenting
• There’s a widespread belief that an Android device without Google services (really, this means Maps and the app store) is unsaleable outside China (I’m not entirely sure about this, as I wrote here)
• No OEM managed to build a compelling set of services or tools of its own that might offer alternatives to Google, because, well, that was impossible (see above)

These new trends place all of those in question. The growth of smaller operators pursuing different models, with no existing base of sales and hence nothing to fear from  Google ban, may mean more experiments with forks. Xiaomi and its imitators point to a new potential model to differentiate (and note that Xiaomi is not a fork), and Cyanogen (an a16z portfolio company) offers the tools to do it. Smaller OEMs are less powerful than Samsung as a counterpart to Google, but also harder collectively to impose upon – Google can’t shout at them all.

Apple researching device waterproofing via vapor deposition, silicone seals » Apple Insider

Mikey Campbell:

As published by the US Patent and Trademark Office, Apple’s filing for “Methods for shielding electronic components from moisture” outlines a process for coating sensitive device components using advanced vapor deposition technology and protecting solder leads with silicone seals.

Instead of sealing off the entire device housing like a common wristwatch, Apple proposes coating integral components, like the printed circuit board (PCB), with a hydrophobic coating. Depositing the coating via plasma-assisted chemical vapor deposition (PACVD) would create an acceptable insulating layer to protect against short circuits that occur when high voltage parts are exposed to liquid.

I’ve thought for some time that Apple would add waterproofing (well, water resistance) to its phones in due course, but that it sees no rush while it’s not completely commonplace elsewhere. (Look at how Samsung has taken it out of the Galaxy S6.) This would also require factory equipment, so might be something for 2016’s range.

Technology helps visually impaired navigate the Tube » BBC News

Hugh Pym (the health editor):

Members of the Youth Forum of the Royal London Society for Blind People (RLSB) said they wanted to navigate the tube system independently.

Currently most have to rely on friends to help them get used to familiar routes or phone ahead to request assistance from London Underground staff. Many do not feel confident about using the whole network. They group teamed up with a digital products designer, ustwo, which then devised a system which was effective below ground.

The Bluetooth beacons transmit signals which can be picked up by smartphones and other mobile devices. Audible directions are provided to users via “bone conduction” earphones which allow them to hear sounds around them as well.

The directions warn users when they are approaching escalators and ticket barriers and which platforms they may be approaching. It’s the first such trial of a technology which can guide blind and partially sighted people underground or in areas with limited mobile phone reception.

Developers say it could be used in other subway networks like those in Newcastle and Glasgow or in other busy public transport hubs

That’s ustwo, as in Monument Valley. Many strings to their bow. Wonderfully clever application.

Samsung breaks records with £45m push behind Galaxy S6 » Daily Telegraph

Chris Williams:

Samsung is launching a record-breaking £45m marketing barrage to support its new Galaxy S6 smartphone and regain ground lost to Apple.

The figure, disclosed by industry sources, is the largest ever for a mobile phone launch and is believed to be the largest for any single product in the UK.

Samsung is spending heavily across all traditional and new media marketing channels, but is understood to be especially targeting the mass audiences provided by television and high-profile outdoor advertising sites.

The Galaxy S6 is already being heavily promoted on the digital billboards on the London Underground network, for instance.

Samsung also paid for a special advert based on the Galaxy S6 launch event last week in Barcelona. It aired three hours later in the UK on Sunday evening during ITV’s primetime drama Mr Selfridge.

Samsung has long been among the world’s biggest marketing spenders, devoting a larger proportion of its annual sales to promoting its products than any other top 20 global company.

Reading the comments under Apple articles always reveals two trains of thought, often following each other: (1) Apple is only popular because it spends so much on marketing (2) [when it’s pointed out that Samsung spends more] Apple is only popular because “the media” pushes it.

On the basis of (1), the S6 is going to be the most humungous hit, surely?

Popular Xiaomi phone could put data at risk » Bluebox Security

There’s a big asterisk on this one, but first read what Andrew Blaich found:

We ran several of the top malware and antivirus scanners on the Mi 4 to determine if any questionable apps came pre-loaded on the device. We used several scanners to compile a comprehensive list as some scanners returned nothing and others flagged different apps. Ultimately, we found six suspicious apps that can be considered malware, spyware or adware; a few were more notable than others.

One particularly nefarious app was Yt Service. Yt Service embeds an adware service called DarthPusher that delivers ads to the device among other things[2]. This was an interesting find because, though the app was named Yt Service, the developer package was named com.google.hfapservice (note this app is NOT from Google). Yt Service is highly suspicious because it disguised its package to look as if it came from Google; something an Android user would expect to find on their device. In other words, it tricks users into believing it’s a “safe” app vetted by Google.

Other risky apps of note included PhoneGuardService (com.egame.tonyCore.feicheng) classified as a Trojan, AppStats classified (org.zxl.appstats) as riskware and SMSreg classified as malware[3]

However, Xiaomi says that the device “appears to have been tampered [with] in the distribution/retail process by an unknown third party”. But as Blaich points out, if it’s that easy to mess with, that raises other questions too. Selling smartphones isn’t as simple as just choosing a spec list.

The Apple Watch is time, saved » TechCrunch

Matthew Panzarino does that thing where, you know, you talk to sources to find stuff out, which he then collects in this fascinating article:

Here’s a tidbit you might not know — in order to receive notifications from apps, the Watch must be on your wrist and locked. The Watch requires contact with your skin to receive notifications. There will be no in-app dropdown notifications or constant pinging while it’s off your wrist. Push notifications also cease when the battery reaches 10%. Those decisions speak to the care with which Apple is handling notifications.

The notifications are also different at an elemental level than the ones on your phone — both on the developer and user side of things. These are seen right away rather than at some point. You act on them quickly and they don’t stack up like they do on the phone.

There is that added bit of context because you know exactly when they got it, which means that time-sensitive notifications like those that recommend a precise establishment or ping you during a live event become much more germane.

And this is a key point:

the only resource we all have exactly in common is time. Kings don’t have more of it than peasants. Not everyone will be able to afford an Apple Watch (or even an iPhone), but if they’re in an economic situation where that’s feasible then they’re also in the situation where they are probably willing to trade money for time.

Start up: thin those CDs!, U2’s many listeners, IT price hikes coming?, YouTube’s zero profit, and more

Posted on by
Reply


These guys just get everywhere. Photo by Dunechaser on Flickr.

A selection of 9 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Kantar data on free U2 album consumption by Apple device users » Kantar

Annoyed as some Apple customers may have been over being “force-fed” U2’s new album last fall, the impact of the free release is still visible five months later: 23% of all music users on Apple’s operating system listened to at least one U2 track in January-more than twice the percentage who listened to the second-placing artist, Taylor Swift (11%).

Quite a few of those who complained to me about the U2 album weren’t iTunes users at all. This seems to back up the suspicion that a lot of this noise was just commentariat chatter. (Link via Neil Cybart.)

MELTDOWN: Samsung, Sony not-so-smart TVs go titsup for TWO days » The Register

Shaun Nichols:

Samsung smart TVs have been turned into dumb goggle boxes for the past two days – after the devices have been unable use the internet. Coincidently, Sony smart TVs are also having troubles using the web.

A Samsung spokesperson told The Register it is investigating reports that some of its web-connected tellies and Blu-Ray players are unable to stream video from YouTube, iPlayer, Netflix and other sites. The issue appears to affect Samsung D and E series TVs worldwide.

The televisions’ Smart Hub software, which helps people find stuff to watch and apps to use, is refusing to work – in fact, any software on the sets that tries to use the internet just simply won’t work, Reg readers have told us.

Problem seems to be DNS-related – the IP address at the far end has moved and the TVs can’t figure out how to find it. A dress rehearsal for the Internet Of Broken Things.

EFF unearths evidence of possible Superfish-style attacks in the wild » Ars Technica

Dan Goodin:

It’s starting to look like Superfish and other software containing the same HTTPS-breaking code library may have posed more than a merely theoretical danger to Internet users. For the first time, researchers have uncovered evidence suggesting the critical weakness may have been exploited against real people visiting real sites, including Gmail, Amazon, eBay, Twitter, and Gpg4Win.org, to name just a few.

I wonder how much feverish activity there is in other PC OEM headquarters as they check all their third-party install apps and contracts.

YouTube: 1 billion viewers, no profit » WSJ

Rolfe Winkler, with one of the tightest, hardest-hitting intros [ledes, for American readers] you’ll see this week:

Google nurtured YouTube into a cultural phenomenon, attracting more than one billion users each month. Still, YouTube hasn’t become a profitable business.

The online-video unit posted revenue of about $4bn in 2014, up from $3bn a year earlier, according to two people familiar with its financials, as advertiser-friendly moves enticed some big brands to spend more. But while YouTube accounted for about 6% of Google’s overall sales last year, it didn’t contribute to earnings. After paying for content, and the equipment to deliver speedy videos, YouTube’s bottom line is “roughly break-even,” according to a person with knowledge of the figure.

By comparison, Facebook Inc. generated more than $12bn in revenue, and nearly $3bn in profit, from its 1.3 billion users last year.

Google would like people to turn to YouTube as though it were TV. To which an analyst retorts that “there’s a lot of junk” and that it needs investment to get TV ad budgets. That’s been tried before, though.

Also, just 9% of viewers account for 85% of page views. It’s the “whale” model used by games like Candy Clash – not the “many watching a bit all the time” of TV.

Why I’m saying goodbye to Apple, Google and Microsoft » Medium

Dan Gillmor has renounced Those Three and is using Linux and a phone running CyanogenMod:

The tools I use now are, to the extent possible, based on community values, not corporate ones.

I’m not acting on some paranoid fantasies here. I’m emulating, in the tech sphere, some of the principles that have led so many people to adopt “slow food” or vegetarian lifestyles, or to minimize their carbon footprint, or to do business only with socially responsible companies.

Nor do I intend to preach. But if I can persuade even a few of you to join me, even in some small ways, I’ll be thrilled.

I know and like Dan, though one has to pause a bit: the PC is a Lenovo (made in China, home of a not-at-all oppressive government). He doesn’t specify who made the handset. I fear his quest is quixotic; even Taiwan-owned companies manufacture in China. So is China’s government better or worse than Google, Microsoft or Apple?

Exclusive: Sundar Pichai on Google’s vision, mobile revenue, Apple and China » Forbes

Miguel Helft tries hard, but this is largely a snoozer because people like Pichai provide answers that are so vague and distant – and won’t give a hard statistic for anything. This seems a relevant point, though:

Q: Messaging outside of email has become huge, as proven by things like WhatsApp, Snapchat and Facebook Messenger. Does Google need a play there to be competitive?

A: We think about it at two levels. We build platforms. We don’t expect Google as a first party service to provide all the answers. Part of the reason a platform is successful is because there are very very important things from other companies and other developers on top of the platform. Things like WhatsApp are a great example of success that others have had on Android, which we see as welcome innovation on the platform. It’s great for users, it’s great for our platform and I think it’s a virtuous cycle. In the aggregate, we also care about building great services for people. At that level, we view communications as an important area. But that doesn’t mean the answer is always a vertical service. We do have products like Hangouts which we will invest in and evolve. But we also care about the platform in these areas, how we evolve the platform so we support others to do these innovations as well. It’s a more nuanced answer. It’s a more complicated approach. I think we are comfortable with where we are.

Also covers Google+, Android, and China. Doesn’t have a truly interesting insight on any of them; you have to work it out from what isn’t said (he doesn’t emote about Android at Home; won’t talk about how enterprise is going).

Of course various blogs have filleted it for comments about Apple, but that’s a snooze too.

Weak euro puts pressure on hardware pricing » InCONTEXT

Marie-Christine Pygott is senior analyst at the research company:

Towards the end of January, the euro hit a new low against the US dollar. Having lost 11% of its value between July and the end of December last year, the Eurozone currency was down by another 6.8% against the US dollar in January after the new year opened with a series of events that led to increased pressure on the currency.

For the large, non-European IT manufacturers, this has been bad news; where components are sourced in US dollars and revenues generated in euros, the devaluation has meant a significant increase in production costs and a strain on margins. Our distributor pricing data shows a 7% rise in the euro cost of components in the few months between July and December last year, despite a small decline in dollar terms. While prices did not go up to the same extent in real life, it is only a question of time before pricing shifts will show in our Channel data.

And show, it will. It is clear that IT vendors cannot just simply absorb the recent rise in costs.

List prices are already rising for PCs, it seems. That’s going to be a problem. Will smartphones be affected too?

High End Produkte und feinmechanische Geräte » Audiodesksysteme Gläß

The tuning of a CD with the CD Sound Improver is incredibly easy and takes barely a minute. The tungsten carbide blade is automatically set at the right angle during manufacture of the unit. A test CD is included in the delivery package. All following CDs are bevelled under exactly the same conditions. Shavings are removed via the vacuum cleaner link.

Shavings! It’s trimming your CD!

Starting out on Android » iA Writer team

iA Writer (it’s a writing app) has been ported to Android, which was a learning experience for the team who’d previously written for iOS:

The core APIs offered by the Android SDK have proven to be very stable. Lollipop is at its core a completely new OS with a new VM philosophy, but when we updated our first device, the app just continued to work. That’s an amazing feat. Whenever the iOS people took a break from laughing at the stack of test devices, they were toiling away updating their app to work with one iOS upgrade after the other.

Whatever madness has flown into the Android core APIs, it’s there to stay. That can be seen as the reverse side of the coin. Hanging indents are not rendered correctly? Yep, since 2011 — it’s a feature by now. Want to handle a text larger than a few 1000 characters? Sorry, the guy who wrote the SpannableString Builder class is now enjoying early retirement in Malibu. The Android APIs are stable, but sometimes we’d have wished them to be less stubborn.

Via Russell Ivanovic, who cites this as evidence that (in his words) 2015 will be the year of Android. However, this doesn’t show anyone going Android-first; quite the opposite. It’s more that, having wrung the market pretty much dry on iOS and the Mac, they’re now targeting the Android market, which must have a high end who will want to use this.

It’ll be interesting to follow up with iA and see how sales/installs/piracy goes on Android and compares to iOS.