Tag Archives: security

Start up: Google’s ad stop, hacking phishers, the lost phone mystery, the adblocking browser and more

Posted on by
Reply

A game with these will give you an insight into production processes. Photo by judy_and_ed on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Why is your team falling behind? Ask ‘The Penny Game’ » Atomicobject

Eric Shull:

The book Velocity describes an enlightening simulation, a model of a simple manufacturing line. The game uses pennies and dice to represent pieces of work flowing through stations in a factory. It may be simple, but the penny game can improve our understanding of how software teams work, how the interaction of variable processes affect the system as as whole.

In the penny game, pennies come in at one end of the line, are processed by each station, then exit at the other end. This would be rather mundane but for one complication: each station does not always process the same number of pennies.

In the simulation, rolled dice indicate how many pennies each station is allowed to move.

This is fascinating – and gives you real insight into the problems that have to be overcome in manufacturing to tight deadlines. Imagine now if you were processing millions of “pennies”, except they were phones.
link to this extract

 

Google disabled 49% more ads in 2015 » WSJ Digits blog

Alistair Barr:

More than 1,000 of Google’s 60,000 employees monitor and remove ads, an important task because the company gets about 90% of its revenue from advertising. It’s also been hit financially for not adequately monitoring ads. In 2011, the company agreed to pay $500m to settle allegations by the U.S. Department of Justice that ads for Canadian online pharmacies contributed to the illegal importation of prescription drugs. In the settlement, Google acknowledged it acted “improperly.”

Google blocked more than 12.5m ads in 2015 for drugs that were unapproved or that made misleading claims, up from 9.6m a year earlier.

Ads making misleading weight-loss claims were a big source of user complaints last year, prompting Google to suspend more than 30,000 websites from its ad systems. It declined to give a comparable number for 2014.

Rob Leathern has the growth figure for ad disabling: it’s growing by 50% annually, but still a long way short of catching them all.
link to this extract

 

How I stumbled upon thousands of Facebook passwords » Medium

“Rukshan”, a Colombo-based medical undergrad and hacker, received a Facebook phishing email and twiddled around with the phishing page:

after modifying the url I checked the folder which contained the php script that handles the post requests and I knew at that moment I hit the jackpot.

There was no index.html file to make sure no one else see the files in that directory or any .htaccess modification, well like I said phishing people are too bored to do all these tech stuff anyway, they’d rather get the passwords and go away.

So I opened the password.html file and I was greeted to the sight of hundreds of Facebook passwords, and by looking at the credentials one there was a pattern:

•Almost all of these accounts belonged to girls who are in their early 20s or teens.
• Almost all of the accounts belonged to females who are from Colombo.

Neat idea; neater still would be to wipe the files. But that would be one sizeable hack further (and probably illegal).
link to this extract

 

Why don’t you have an Android version? (Or why we develop for iOS first) » Impossible Ventures

Joel Runyon:

Android users may download more apps, but they spend less money than iTunes users.

But that’s not just fake studies either, in our experience with Paleo (io) – a top 20 app in iTunes and ranked even higher in Google Play – we make about 3x the sales on our iTunes listing as we do on Google Play (even though we have a higher ranking in Google Play than iTunes).

Which brings me to the next point: apps are not free to make.

As an app developer, you have to spend time & money on this concept that you have in your head to bring it to reality. The  MVP on an app can cost anywhere between $2k and $20k to build and launch. It might not seem like much if you spend all your time raising VC money and have a $1M+ in the bank, but it can add up if you’re bootstrapping.

In fact, with every dollar you spend, there’s a very real cost (along with another equally as real, opportunity cost).

Of course the argument is completely different in Asia, where it’s generally Android-first (except in Japan, and who knows in China?).
link to this extract

 

Finding the tennis suspects » Medium

Russell Kaplan, Jason Teplitz, and Christina Wadsworth:

The tennis world was sent reeling when BuzzFeed News and the BBC jointly published The Tennis Racket, which revealed “evidence of widespread match-fixing by players at the upper level of world tennis”. But BuzzFeed refused to publish the names of those players.

We dove into the data and found the names ourselves.

Unless you follow tennis really closely you won’t have heard of any of the names but one, and I do wonder if that one is thrown up by some weird quirk of the analysis. Seems robust, though. I think this might dissuade players – and administrators – from trying to hide this in future, knowing that there are people analysing public data for oddities. Will it put off the gamblers, though?
link to this extract

 

Why do people keep coming to this couple’s home looking for lost phones? » Fusion

Kashmir Hill:

It started the first month that Christina Lee and Michael Saba started living together. An angry family came knocking at their door demanding the return of a stolen phone. Two months later, a group of friends came with the same request. One month, it happened four times. The visitors, who show up in the morning, afternoon, and in the middle of the night, sometimes accompanied by police officers, always say the same thing: their phone-tracking apps are telling them that their smartphones are in this house in a suburb of Atlanta.

But the phones aren’t there, Lee and Saba always protest, mystified at being fingered by these apps more than a dozen times since February 2015. “I’m sorry you came all this way. This happens a lot,” they’d explain. Most of the people believe them, but about a quarter of them remain suspicious, convinced that the technology is reliable and that Lee and Saba are lying.

“My biggest fear is that someone dangerous or violent is going to visit our house because of this,” said Saba by email. (Like this guy.) “If or when that happens, I doubt our polite explanations are gonna go very far.”

It’s billed as “a tech mystery”, and it really is.
link to this extract

 

Brave is the name, ad-blocking the game of new browser » Computerworld

Former Mozilla CEO (for 11 days) Brendan Eich is behind a new browser for desktop and mobile which blocks all ads and tracking by default:

“We are building a new browser and a connected private cloud service with anonymous ads,” Eich said.

In effect, Brave will first scrub websites of most of their ads and all tracking, then replace those ads with its own. But the latter will be aimed not at individuals but at the anonymous aggregate of the browser’s user base. If enough people gravitate to the browser, Brave will share its ad revenue with users and content publishers.

“We will target ads based on browser-side intent signals phrased in a standard vocabulary, and without a persistent user id or highly re-identifiable cookie,” Eich said. “By default Brave will insert ads only in a few standard-sized spaces. We find those spaces via a cloud robot.”

No user data will be recorded or stored by Brave, Eich promised.

Elsewhere, Eich said that 55% of Brave’s revenue would be shared with site publishers, and 15% with users, who could then turn that money over to their favorite sites or keep it.

Al Hilwa, an analyst with research firm IDC, applauded the concept of creating an alternate revenue stream from traditional advertising, but wondered whether the browser could compete, even in the niche that Eich described. “This is a laudable idea, but fighting ‘free’ is always risky,” said Hilwa in an email reply to questions.

Not sure the world has an appetite for a new browser, but one can envisage adblocking becoming built in and then enabled, just as pop-up blocking in browsers went from “pop-up what?” to “optional” to “on by default”.
link to this extract

 

Apple pushes to bolster market share in India » WSJ

Newley Purnell:

India’s smartphone market is expanding quickly and by next year it should overtake the U.S. as the world’s second-biggest behind China, according to research firm IDC.

Just 35% of mobile phones sold in India now are smartphones, meaning there is room for growth as people upgrade from basic devices. Indian consumers, however, tend to purchase inexpensive devices: The average smartphone selling price in the country is likely to fall to $102 in 2018 from $135 in 2014, IDC says.

Apple’s problem has been that the sweet spot for smartphone sales in India has been handsets that cost less than $150. In a country where the average person earns about $1,500 a year and even middle-class consumers make less than $8,000 a year, the standard iPhone — which usually costs between $500 and $1,000 without a data plan — was just too expensive for most people to consider.

“Buying an iPhone is so expensive,” said Sakshi Maurya, a 20-year-old university student in New Delhi. She said she doesn’t understand why an iPhone is five times as expensive as some locally available Android phones. “It’s a luxurious thing.”

India poses a particular marketing challenge for Apple: it’s a mixture of very tech-savvy buyers and low-income buyers. Which does it target first, and how?
link to this extract

 

iPhone 6S/6S Plus underperform year-ago sales » Consumer Intelligence Research Partners

CIRP finds that the new iPhone 6s and 6s Plus accounted for 67% of total US iPhone sales, with iPhone 6s at 48% and iPhone 6s Plus at 19%. In the December 2014 quarter, iPhone 6 and 6 Plus accounted for 75% of total US iPhone sales with 30% iPhone 6 Plus.

“The iPhone 6s and 6s Plus did quite well,” said Josh Lowitz, CIRP Partner and Co- Founder. “Yet, they did not dominate the same way that iPhone 6 and 6 Plus did a year ago. The total share of the new flagship models fell below the share of the then-new phones in 2014, and the large-format iPhone 6s Plus share of sales dropped compared to the iPhone 6 Plus as well. Customers continue to choose the year-old iPhone 6 and 6 Plus, and even the two-year old iPhone 5S.”

CIRP can’t say whether total sales are higher or lower (it samples 500 buyers of Apple devices in the previous quarter), just the mix. This looks like a subtle price deflation of the iPhone as people opt for 2014’s models over 2015’s – after all, they look the same to other people, even if the newer models has extra features.
link to this extract

 

Issue 3434 – android – Add APIs for low-latency audio – Android Open Source Project – Issue Tracker

On Tuesday, Apple released its “Music Memos” app, which is intended to let musicians (of any standard) record little musical thoughts that come to them on the guitar or piano directly to their iPhone or iPad, and add musical accompaniment.

Android doesn’t have that, because as has been noted here before its audio latency is too long – over 10 milliseconds, which is the longest pro musicians can bear. So how long have developers been prodding Google to improve Android’s audio latency?

I am developer of real-time audio signal processing applications. I am interested in creating
applications for sale in the android marketplace, but found that android has no method for real-
time low latency audio.

This is the first entry in a bug/feature request which continues to the present (latest entry is June 2015). The date of the entry? July 31, 2009 – slightly over nine months after the first Android phone. Is six and a half years a long time for a feature request to lie open? (And here’s Google’s official list of device latencies. Look for any at 10ms or below.)

Apple effectively gets 100% of the professional audience through this feature.
link to this extract

 

Errata, corrigenda and ai no corrida:

Start up: writing clickbait, search v the law, IAB disses AdBlock Plus, Android’s future in 2010, and more

Posted on by
Reply

Bitcoin: a failed experiment, or still going strong? Photo by portalgda on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 12 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

The resolution of the Bitcoin experiment » Medium

Mike Hearn:

Why has Bitcoin failed? It has failed because the community has failed. What was meant to be a new, decentralised form of money that lacked “systemically important institutions” and “too big to fail” has become something even worse: a system completely controlled by just a handful of people. Worse still, the network is on the brink of technical collapse. The mechanisms that should have prevented this outcome have broken down, and as a result there’s no longer much reason to think Bitcoin can actually be better than the existing financial system.

Hearn’s article – in which he describes how he has gone from being an enthusiast and believer who left a safe job at Google to work on bitcoin – points to a looming problem: Chinese miners control over 50% of mining capability (the level where fakery becomes possible) and new proposals on fee payments could lead to transaction reversals.

I haven’t seen any adequate rebuttals of Hearn’s post (there are lots of ad hominem “don’t let the door hit you on the way out” responses, or others saying “everything’s GREAT, shuddup”), though this by “Bit Credit” makes a vague attempt. It also contains this passage:

from an economic interest it makes no sense to undermine bitcoin by fracturing it. And so surprise, suprise, bitcoin participants are making rational economic decisions. Bitcoin is not a democracy where 51% rules. In fact that is Bitcoin in a state of attack.

Bitcoin isn’t a democracy, in that its rules are determined by the core developers. But it is a democracy in that if 51% of miners start mucking about, bad things happen. And “attack”? Odd choice of word.
link to this extract

 

How Peach onboards new users » User Onboarding

Peach is the darling of the app world right now, and their onboarding has been heralded as one of the best ever from a newcomer. Care to see why?

Without further ado, here is…

How Peach Onboards New Users

Well, it has sort of fallen out of “darling” status, but any app designer will learn from this – especially the “what is this? What does that word mean? Am I saying this to the whole world? HELLPPP!” It is 120 slides, but easy to click through.
link to this extract

 

‘Shocking celebrity nip slips’: secrets I learned writing clickbait journalism » Broadly

Kate Lloyd:

Laura, another celebrity journalist who has worked online for popular tabloids, explains there are other times when she has had to sex up stories about celebrity women who weren’t even trying to be especially provocative. “You could do a red carpet round-up of ‘all these women look great in these dresses’ but you’d change it to ‘plunging necklines’ or ‘high splits,'” she explains. “Marriage announcements would be sexed up with ‘cleavage enhancing’ or ‘revealing’ outfit descriptions. You’d add in words like ‘nip slip’ even if nipples are nowhere near having a slip because that’s what people are searching for. It was literally just for SEO, and it was soul destroying.”

One journalist told me she worked on a site where every picture of a female celebrity — including those in full coverage outfits — was tagged with the word ‘panties.’

While you’re groaning at clickbait “shows her ex what he’s missing in tiny bikini” headlines, there’s a whole new level of trickery that lurks behind them. For example, a female celebrity recently posed for a tasteful set of nude photos with a glossy magazine, who published the story with an empowering, “you go girl!” headline. The page’s URL, however, was a chain of sexy keywords that simply ended with “nude-photos.” Things get especially murky once you delve even deeper into the behind-the-scenes sorcery. One tabloid journalist told me she worked on a site where every picture of a female celebrity—including those in full coverage outfits—was tagged with the word “panties.” I’ll also admit to using the phrase “nearly-naked” in headlines just to hit the search term “naked”.

And just when you’re wondering what the world would look like if women were in charge of search engine algorithms:

…Tabloid journalist Laura explains that while the amount of sexualized content about women isn’t decreasing, she’s starting to produce more sexualized content about men.

link to this extract

 

A few keystrokes could solve the crime. Would you press enter? » Just Security

Jonathan Zittrain:

Suppose a laptop were found at the apartment of one of the perpetrators of last year’s Paris attacks. It’s searched by the authorities pursuant to a warrant, and they find a file on the laptop that’s a set of instructions for carrying out the attacks.

The discovery would surely help in the prosecution of the laptop’s owner, tying him to the crime. But a junior prosecutor has a further idea. The private document was likely shared among other conspirators, some of whom are still on the run or unknown entirely. Surely Google has the ability to run a search of all Gmail inboxes, outboxes, and message drafts folders, plus Google Drive cloud storage, to see if any of its 900 million users are currently in possession of that exact document. If Google could be persuaded or ordered to run the search, it could generate a list of only those Google accounts possessing the precise file — and all other Google users would remain undisturbed, except for the briefest of computerized “touches” on their accounts to see if the file reposed there.

A list of users with the document would spark further investigation of those accounts to help identify whether their owners had a role in the attacks — all according to the law, with a round of warrants obtained from the probable cause arising from possessing the suspect document.

So, if you’re the person receiving the search request at Google, should you run it? Zittrain takes you around the back-and-forth, which is subtle.
link to this extract

 

The Long Goodbye » Anne Wheaton dot Com

Anne Wheaton:

I chose to be on Twitter. I am not a celebrity. I am a middle-aged woman who’s a retired hairdresser who now runs a non-profit, is on the Board of Directors at Pasadena Humane Society, has a house FULL of rescue animals, and has two wonderful boys. I do not have a job I need to promote, nor am I looking for a job to take on. I have a full life with an amazing husband and family, wonderful friends, and a successful business I run. If something I choose to do on the side isn’t fun, I need to walk away from it because my free time is pretty scarce. Twitter used to be the fun thing I did on the side, and for the most part, it just isn’t fun anymore, so I need to walk away from it and that’s okay.

I deleted my Twitter account last night and immediately felt relieved.

She’s married to Wil Wheaton, who has been anti-Gamergate, on the basis that reasonable people don’t abuse women and other people pointlessly and unceasingly. Increasingly, Gamergate strikes me as Twitter’s id; untrammelled raging male idiocy, which is never reined in by any form of superego (such as “is this really a good idea?”). And the concern is that that superego will never arrive. (Another thought is that with American politics becoming increasingly polarised, Gamergate backers are more aligned with the extreme Republican line of thinking, and certainly with its refusal to engage with any other viewpoint.)

Read her post from April on how quickly just “being a woman on Twitter” turned into “being someone at whom people post random, vicious, worrying things for no other reason than to be vicious and worrying.”
link to this extract

 

Web-based OAuth is a security nightmare for apps » Terence Eden’s Blog

You know those apps where you go in and it asks you to authorise it using Twitter or whatever? Eden doesn’t like them:

In Periscope’s case, the user has to trust that the app hasn’t just ripped-off the Twitter website. There’s absolutely no way to verify that it is a genuine and secure login page.

Even if you have 2-Factor Authentication (where Twitter texts you a login code) you’re not safe. Why? Because if the app is intercepting your username and password, it can also intercept your 2FA code. Sure, it can only use it for a minute or so (with some restrictions) – but that’s enough time to completely take over your account.

As software developers, we have to stop encouraging this anti-pattern. Periscope is teaching users that it’s OK to type their password into any box which looks like it’s authentic.

link to this extract

 

IAB dis-invites us, disses compromise and buries dissent » Adblock Plus

Ben Willians:

Adblock Plus has some very good relationships within the IAB (Interactive Advertising Bureau), which is the trade organization that represents advertisers and publishers. We coach many IAB members about our Acceptable Ads guidelines for reasonable, nonintrusive ads, and we have spoken on some IAB panel discussions (especially in the UK).

Unfortunately, the top brass at the US IAB don’t want us coming to their Leadership Summit next week in Palm Desert, California. We attended last year, and we signed up again for their 2016 meeting … including paying the hefty entrance fee. We were fully confirmed and they even listed us on their website as a participant.

Then this week we got one of those sudden emails that land in your inbox innocently, then floor you with something weird, unbelievable or ridiculous when you click on them. This one came from an unfamiliar IAB address, and it informed us that our registration for the summit was canceled and our fee refunded.

The IAB hasn’t said anything about why, as of the time of this post. Apart from a statement which said that “The IAB Annual Leadership Meeting is for serious conversation among important digital industry stakeholders.” Does it think adblocking isn’t serious, or isn’t important?
link to this extract

 

There are no secure smartphones » Devever

Hugo Landau:

There are no secure smartphones.

This is a simple fact which is overlooked remarkably often.

Modern smartphones have a CPU chip, and a baseband chip which handles radio network communications (GSM/UMTS/LTE/etc.) This chip is connected to the CPU via DMA. Thus, unless an IOMMU [input-output memory management unit] is used, the baseband has full access to main memory, and can compromise it arbitrarily.

It can be safely assumed that this baseband is highly insecure. It is closed source and probably not audited at all. My understanding is that the genesis of modern baseband firmware is a development effort for GSM basebands dating back to the 1990s during which the importance of secure software development practices were not apparent. In other words, and my understanding is that this is borne out by research, this firmware tends to be extremely insecure and probably has numerous remote code execution vulnerabilities.

Thus, no smartphone can be considered secure against an adversary capable of compromising the radio link (called the Um link). This includes any entity capable of deploying Stingray-like devices, or any entity capable of obtaining control of a base station, whether by hacking or legal or other coercion.

It would, in my view, be abject insanity not to assume that half a dozen or more nation-states (or their associated contractors) have code execution exploits against popular basebands in stock.

Question then is how far up the stack you can get from the baseband.
link to this extract

 

August 2010: Android’s pursuit of the biggest losers » Asymco

Horace Dediu, writing back in the days when Nokia and Sony Ericsson made handsets, and BlackBerry was big, noting that LG and Motorola and Sony Ericsson had lost money, though Samsung was doing OK:

how likely are these disrupted ex-giants to recover and take Android forward? My bet: slim to none. Android does not offer more than a lifeline. It is not a foundation for long-term profitability as it presumes the profits accrue to the network and possibly to Google. Profit evaporation out of devices to Google may be a possibility at some time in the future, but only if the devices don’t need too much attention to remain competitive. But because they’re still not good enough (and they won’t be for years to come), it’s certain that attention to detail is what will be most important to stay abreast of Apple.

So here we have the real challenge to Android:  partnership with defeated incumbents whose ability to build profitable and differentiated products is hamstrung by the licensing model and whose incentives to move up the steep trajectory of necessary improvements are limited.

In other words, Android’s licensees won’t have the profits or the motivation to spend on R&D so as to make exceptionally competitive products at a time when being competitive is what matters most.

He also points out that Windows Mobile had the same problem, seven years earlier.

Five years later, the point about long-term profitability and R+D is being borne out. Only Samsung has managed to stay profitable – because of its components businesses.
link to this extract

 

Xiaomi finally releases 2015 sales stats » Tech in Asia

Erik Crouch:

The case of the missing phone statistics has finally been solved – today, Xiaomi revealed that it sold 70m smartphones in 2015, a number below even their most modest predictions.

It’s been apparent for a while that something went wrong for Xiaomi in 2015. In 2014, the company predicted that they would sell 100m phones in the coming year – an estimate that was promptly bumped down to 80m last March.

When late 2015 rolled around, and China’s techies eagerly awaited the company’s sales report, they were met with silence. CEO Lei Jun talked in December about how the company “does not emphasize goals such as smartphone sales anymore,” which certainly didn’t build anyone’s confidence that the company had met its targets.

As Crouch notes, 2016 could be make or break. With China’s smartphone market slowing down, it really needs to find something fresh.
link to this extract

 

Delicious changes » The Official Delicious Blog

Delicious was the original bookmarking service (admit it, you thought it had just vanished):

My name is Tony Aly, and I’m the CEO of Delicious Media, a new company formed in alliance between my company, Domainersuite, and Science, the company that has managed Delicious since 2013. Science has transitioned control of Delicious to our new entity so that my team and I can dedicate ourselves to the long-term success and stability of this wonderful, useful, trailblazing site.

As part of this transition, over the next few weeks, we will be a making a few fairly prominent changes to the site.

The first big change you’ll notice is our transition from the javascript front-end framework that has been powering the content at https://www.delicious.com. The engineers who crafted this version of the site are incredibly talented, and their code is amazing. It’s beautiful and powerful, but it has posed several significant challenges for us. For example, the search engines have a real problem reading our content, hindering users’ efforts to use Google or Bing to find what they’re looking for on Delicious.

Translation: “damn engineers.” Except what’s the point of search engines indexing a bookmarking site? Delicious has been through so many changes of ownership – bought by Yahoo in 2005, then sold to YouTube’s founders, then sold on and on. Never quite manages to regain momentum. I use Pinboard – reliable, cheap, doesn’t mess about. And has a terrific Twitter feed.

For what might have been, read Bobbie Johnson’s article from 2005 about Yahoo buying Delicious.
link to this extract

 

Wikipedia: an old-fashioned corner of truth on the internet » Telegraph

I wrote about Wikipedia’s 15th birthday (on Friday), and largely I have nothing but applause for its approach that anyone could write or edit, and its pursuit of the “neutral point of view”, and (especially) its ad-free ethos. Though:

That’s not to say it’s without faults. There are plenty, some deeply ingrained. Most of its editors are male, meaning topics relevant to women are underrepresented. As the site (and each editor) ages, it becomes harder to attract new editors as the existing clique becomes embedded. With no overall editor determining its direction or content, the topics and content can vary enormously. The world probably doesn’t need zillions of explanatory articles about the Japanese video game franchise Pokemon – but perhaps could do with some of the articles about less-simple concepts being rewritten to a more novice-friendly standard. That’s what the Encyclopaedia Britannica had that Wikipedia doesn’t: consistency.

But that’s also the web revealing our real character. Those who can be bothered to create are more interested in Pokemon than explaining maths or science. We peer into Wikipedia, and see ourselves peering back.

link to this extract

 

Errata, corrigenda and ai no corrida: none noted.

Start up: smartphone v cars, Oracle v Android, Korea’s browser problem, flat design woes, and more

Posted on by
1


Sony’s Project Morpheus in action. But how many PCs can run this stuff? Photo by wuestenigel on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 10 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

Fun fun fun ’til her daddy takes the iPhone away » ROUGH TYPE

Nick Carr:

“A smartphone can get you a ride but a car can’t get you a date,” blogged venture capitalist Fred Wilson, revealing a remarkable ignorance of the entire modern history of youth culture. “The smartphone wins.”

Wilson’s words were inspired by a November 2013 interview with another prominent VC, Marc Andreessen. America’s love affair with the automobile is over, Andreessen declared. As evidence he pointed to a putative sea change in young people’s attitudes toward cars: “Today, ask kids if they’d rather have a smartphone or a car if they had to pick and 100% would say smartphones. Because smartphones represent freedom. There’s a huge social behavior reorientation that’s already happening.” I’ve never found financiers to be reliable guides to what kids are up to, but in this case Andreessen was just recycling a view that has achieved meme status in recent years: Americans are losing their taste for driving, and that trend is particularly  pronounced among the young.

At about the same time Andreessen was opining about how young folks love their tech but don’t give a crap about their wheels, MTV was launching an extensive survey of the attitudes of millennials. The network interviewed nearly 4,000 people between 18 and 34. One of the topics discussed was cars and driving.

Now, guess whether the survey – of thousands of real people – backed up Wilson’s opinion.
link to this extract

Education and underemployment in the age of machine intelligence » Brookings Institution

Daniel Araya (a researcher and advisor to the US government):

what is the role of education in the age of machine intelligence? Even a cursory analysis of educational reform in the United States reveals a deep concern with transforming the education system in the face of systemic economic and social change. It has become painfully clear, for example, that our current education system is not equipped to mitigate the scale of labor dislocation we may soon face. In my view, the most obvious problem with U.S. educational reform today is a misplaced focus on mobilizing systems of measurement and conformity in an era that demands risk and experimentation. The underlying problem is that “factory schools” have evolved from older institutions designed for a different era.

Beyond the bureaucratic systems of the Industrial Age, students must be better prepared to leverage autonomous creativity to solve real-world problems. Beyond basic numeracy and literacy, advanced competencies that build on network collaboration, digital fluency, and entrepreneurial innovation are now foundational to economic mobility. The real challenge today, in other words, is to transform the institutional and pedagogical structures that constitute schooling. Rather than framing educational reform in terms of the needs of a mass industrial society, educational policies must now adapt to the needs of a highly disruptive computational economy.

Sure, but who’s going to tear Americans away from their block-rote testing?
link to this extract

Few computers are powerful enough to support virtual reality » Bloomberg Business

Ian King:

Virtual reality has a very real problem. With several technology giants preparing splashy introductions for the first VR headsets in 2016, few people own hardware capable of fully supporting Facebook’s Oculus Rift or other systems.

Just 13m PCs worldwide next year will have the graphics capabilities needed to run VR, according to an estimate by Nvidia, the largest maker of computer graphics chips. Those ultra-high-end machines account for less than 1% of the 1.43bn PCs expected to be in use globally in 2016, according to research firm Gartner.

And yet IHS estimates that 7m VR headsets will be in use by the end of this year. Seems like a high penetration of those 13m PCs. (And I don’t hold out much hope for HTC/Valve’s effort to save HTC, given its $1,500 price.)
link to this extract

Oracle sinks its claws into Android » Andreas Gal

Gal is the former CTO at Mozilla, and was involved in its efforts with Firefox OS, so he knows his stuff:

While I am no longer working directly on mobile, a curious event got my attention: A commit appeared in the Android code base that indicates that Google is abandoning its own re-implementation of Java in favor of Oracle’s original Java implementation. I’ll try to explain why I think this is a huge change and will have far-reaching implications for Android and the Android ecosystem.

This quickly gets very complicated, hinging on the variations between the GPL, LGPL, GPLv2 and Apache licences. Read alongside this piece at Venturebeat, which has comments from Google.

Upshot seems to be: Oracle gets to dictate some future direction of Android’s Java; app developers who don’t update could see more crashes.
link to this extract

Issue 693 – TrendMicro node.js HTTP server listening on localhost can execute commands » Google Security Research

Tavis Normandy, on the security mailing list:

When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup.

http://www.trendmicro.com/us/home/products/software/password-manager/index.html

This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests.

It took about 30 seconds to spot one that permits arbitrary command execution, openUrlInDefaultBrowser, which eventually maps to ShellExecute().

This means any website can launch arbitrary commands, like this:

x = new XMLHttpRequest()
x.open("GET", "https://localhost:49155/api/openUrlInDefaultBrowser?url=c:/windows/system32/calc.exe true);
try { x.send(); } catch (e) {};

(Note that you cannot read the response due to the same origin policy, but it doesn’t matter – the command is still executed).

Trend Micro reacted quickly, but it turns out this is only the first layer of a stinky security onion.
link to this extract

Pray to Microsoft: Google, Microsoft to stop technical support for older operating systems, browsers » BusinessKorea

Cho Jin-Young:

Google announced on January 11 that it would stop providing security for the Chrome browser on the older versions of the Windows including the Windows XP and the Windows Vista. Earlier, Microsoft said that its technical support for the older versions of the Internet Explorer would be stopped soon. Under the circumstances, Web users in Korea are getting more and more nervous.

At present, more than 80% of them are using Microsoft’s PC operating systems and 30% to 40% of them are using the older versions of the Internet Explorer. Besides, a number of public organizations in Korea are still heavily dependent on the IE, which means they are very vulnerable to security threats. In order to be free from the concerns, users of the Windows 7 and above are required to upgrade their IE to IE 11 or use the other browsers including Chrome, FireFox and Safari.

Problems are complicated for Windows XP and Windows Vista users though. The Chrome browser is unavailable on these operating systems from April this year since Google is going to stop its security update from that month.

People think of South Korea as super-sophisticated because it has really fast broadband. But it relies on absolutely ancient browsers which are vulnerable to all sorts of malarkey. This is going to cause some big problems as they’re either forced to shift or get hacked to hell and back.
link to this extract

Long-term exposure to flat design: how the trend slowly makes users less efficient » Nielsen-Norman Group

Kate Meyer:

To know where they can click on a website, users need signifiers: perceptible clues that help them understand how to use interfaces. Blue underlined text is an example of a traditional signifier of a clickable link that even the least experienced web users understand.

In the old days of rampant skeuomorphism and realism in web design, users were generally able to rely on obvious — but often ugly — signifiers of clickability (such as glossy, raised effects on buttons, or inset shadows that made input fields appear empty). Even though these signifiers varied from site to site, users could usually rely upon two assumptions:

• Elements with strong signifiers were probably clickable.
• Elements without strong signifiers were probably not clickable.

Flat design increased the popularity of designing clickable elements with absent or weak signifiers. Linked text styled as static text is an example of an absent signifier. A ghost button (text with a thin border and no background color) is an example of a weak signifier — a subtler version of a traditional clickability signifier.

Younger users are better at figuring this stuff, but this doesn’t mean it’s good design.
link to this extract

A driverless car saved my life – no, really » Forbes

Joann Muller took a ride in Delphi’s model on the Vegas roads during CES:

One of the first things I noticed was how polite the self-driving car was. It always stayed under the speed limit, and always drove a safe distance behind the car in front of us. It was kind of annoying, frankly, in frenetic Las Vegas, where 170,000 heavily caffeinated tech freaks converged for CES, the big three-day consumer electronics show.

At a busy four-way intersection, the Audi navigated itself into a left-turn lane behind five or six other cars stopped at a traffic light. I thought the gap between us and the car ahead seemed excessive, but that’s how the car is programmed to behave. If I were driving, I would have inched way up behind the other guy’s bumper.

The traffic arrow turned green, and as the cars ahead started moving, so did we. Just as we approached the intersection to make the left turn, the arrow turned yellow and our car stopped abruptly. My Delphi guide, Nandita Mangal, explained that because the car detected stopped traffic on the other side of the intersection it did not feel it was safe to proceed on yellow, even though most drivers (myself included) are probably more aggressive and would have tried to make the light.

That point was driven home just a few minutes later when our car, now first in the left turn lane, got a green arrow to proceed. The Audi drove forward and started turning left, when all of a sudden, out of the corner of my eye, I saw not one, but two cars come speeding through the intersection from the right, running the red light. I wanted to yell “Look out!” but before I could even get the words out, the Audi slammed its brakes as the bad drivers swerved around us. If the self-driving car hadn’t detected what was about to happen and stopped, we likely would have been T-boned on the right side, and I might not be here to write this story.

It will only take a few cases like this for SDCs to be hailed at the best thing since sliced bread. Will the bad drivers (like those running the light) get them first, though? (Note too: this isn’t a Google car.)
link to this extract

China’s Xiaomi under pressure to prove value to investors » WSJ

Eva Dou on Xiaomi, valued at $46bn in its last round, which looks to have missed its 80m phone sales target for 2015 (revised down from 100m):

“The competition in China’s smartphone market has intensified tremendously this year,” said a Xiaomi spokeswoman, who declined to comment on the company’s valuation or say whether it met its 2015 sales target. She said Xiaomi sales were “within expectations” and its flash sales are primarily for new phones when production ramps up.

The lack of its own high-end chip technology also proved to be a competitive disadvantage for Xiaomi last year. When early versions of Qualcomm Inc.’s Snapdragon 810 processor were reported to have overheated, it dampened sales of Xiaomi’s most expensive handset yet, the 2,299 yuan ($349) Mi Note, analysts said.

Xiaomi couldn’t fall back on an in-house developed chip to get around the problem as Huawei and Samsung did.

Xiaomi and Qualcomm declined to comment on the processor. Analysts say the problems have been fixed.

Overseas growth also has been slow for Xiaomi, with the percentage of its smartphones sold overseas in the first nine months of 2015 rising to 8%, compared with 7% in the 2014 calendar year, according to Canalys. Moreover, Xiaomi’s thin patent portfolio became a hurdle as it sought to expand in markets such as India. A lack of patents led to a court ruling that crimped its access to the crucial India market.

Hard to see now how Xiaomi isn’t Just One More Android OEM.
link to this extract

Education – Preview » Apple

This is interesting: coming in iOS 9.3, Apple’s classroom efforts (which in the US are being invaded by Chromebooks) let pupils log into any iPad “and make it their own”, use a “Photo ID” where “each student’s picture appears on the iPad they’ve been using” and younger students can access via a four-digit PIN.

Teachers meanwhile can see what’s on any screen, launch apps across a class, and reset passwords “without calling IT”.

Fraser Speirs (who’s big on education and iPads) points out that it’s going to need some hefty space – a 32GB iPad will be able to cater for 3 users, 64GB for 8, and 128GB for 16.

Wouldn’t mind having some of these for a home setting. (Via former Windows guy Steve Sinofksy.)
link to this extract

Errata, corrigenda and ai no corrida:

Start up: Google open-sources machine learning, Adele v streaming, Facebook’s Belgian problem, and more

Posted on by
Reply


Steve Reich’s Piano Phase, as a video, by Alexander Chen.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Made without nuts. I’m charlesarthur on Twitter. Observations and links welcome.

Preserving security in Belgium » Facebook

Alex Stamos works on online security for Facebook, while a Belgian court has ruled that the “datr” cookie it uses is not legal. Stamos isn’t happy:

The reason I’m bullish on the datr cookie is because for at least the last five years we have used it every day to defend people’s accounts through the following actions:
• Preventing the creation of fake and spammy accounts
• Reducing the risk of someone’s account being taken over by someone else
• Protecting people’s content from being stolen
• Stopping DDoS attacks that could make our site inaccessible to people

If the court blocks us from using the datr cookie in Belgium, we would lose one of our best signals to demonstrate that someone is coming to our site legitimately. In practice, that means we would have to treat any visit to our service from Belgium as an untrusted login and deploy a range of other verification methods for people to prove that they are the legitimate owners of their accounts. It would also make Belgian devices more attractive to spammers and others who traffic in compromised accounts on underground forums…

The datr cookie is only associated with browsers, not individual people. It doesn’t contain any information that identifies or is tied to a particular person. At a technical level, we use the datr cookie to collect statistical information on the behavior of a browser on sites with social plugins, such as the Like button, to help us distinguish patterns that look like an attacker from patterns that look like a real person.

Tricky.
link to this extract

Why streaming doesn’t really matter for Adele » Music Industry Blog

Mark Mulligan:


Looking at mid-year 2015 consumer data from the US we can see that music buyers (i.e. CD buyers and download buyers) are still a largely distinct group from free streamers (excluding YouTube). While this may seem counter intuitive it is in fact evidence of the twin speed music consumer landscape that is emerging. This is why ‘Hello’ was both a streaming success (the 2nd fastest Vevo video to reach 100m views) and a sales success (the first ever song to sell a million downloads in one week in the US). These are two largely distinct groups of consumers.

As a reader of this blog you probably live much or most of your music life digitally, but for vast swathes of the population, including many music buyers, this is simply not the case. Given that the mainstream audience was so key to ‘21’s success we can make a sensible assumption that many of these will also fall into the 27% of consumers that buy music but do not stream.

This is also why it was so tricky for Apple to move into streaming: lots of iTunes users simply don’t. And also why Adele’s audience and prospects are very different from Taylor Swift’s.
link to this extract

Facing pressure in China, Xiaomi also stalls in India » The Information

Amir Efrati:

the domestic Chinese market has slowed, while Xiaomi has dropped to No. 2 there after Huawei Technologies in terms of market share for the third quarter of this year, according to research firm Canalys.

The results in India seem to bear out the bear thesis on Xiaomi’s expansion plans: that it will be harder to succeed outside of China because it would have to work within the bounds of Google’s version of Android, where it can’t customize the software—and run an app store—the way it does inside of China, where Google mobile apps are almost completely absent.

In India, Xiaomi is “just another low-cost phone hardware company,” says one rival executive.

One Indian e-commerce executive whose firm sells smartphones says Xiaomi has “stagnated” online and that sales of Samsung and Motorola phones were much stronger during a recent period of online promotions known as “Big Billions Days.” Xiaomi, bucking its traditional practice of selling phones only online, has been willing to sacrifice some margin and sell phones through some retail stores in India.

If you have to offer Google Mobile Services, in the end your differentiation will be whittled away.
link to this extract

Tim Cook: Apple CEO on the company’s latest venture – the iPad Pro » The Independent

David Phelan bagged an interview while the Apple chief was in London:

The iPad Pro is the most expensive tablet yet, £679 and up. At a time when iPad sales are flat, was he tempted to do as some competitors have done and released, say, a £50 tablet? “No, there are no good £50 tablets. We’ve never been about making the most, we’ve been about making the best. This was a way of making a product that people can do a lot of things with. I think it will attract a lot of PC users and people who are not currently using Apple products. And I think it will be a reason for people to upgrade who love iPad and who have been waiting for something very different and now here it is.”

Along with the Pencil, there’s a keyboard cover. Cook says it’s different from rival keyboards because with none of those would you say it “came from the same parent” as the tablet itself. “Now all of a sudden you have a keyboard that has been perfectly designed for the iPad, it’s integrated and then you’ve got the software with split view and it’s inherently very productive. I’m travelling with the iPad Pro and other than the iPhone it’s the only product I’ve got.” 

You have to love Cook’s rejection of “why did you do a stylus?” “It isn’t a stylus, it’s a Pencil.” Hear the capital. And his description of his youth as a trombone player is hilarious.
link to this extract

DTEK by BlackBerry » Android Apps on Google Play

Interesting move by BlackBerry: DTEK looks at how often and to what extent other apps have been accessing your location, contacts and so on:

In this world of interconnected apps and networks, controlling what is shared and who it’s shared with can be a challenge. BlackBerry® DTEK for Android™ allows you to view and improve your privacy level and monitor application access to your camera, microphone, location and personal information. Take control with DTEK by BlackBerry.
Key Features:

• Monitor – Know at a glance the overall security rating for your device, as well as for specific security features. You can identify whether or not you need to take any action to improve the security of your device.

And so on. For Android 5.0 and up; seems like it would be a useful app for anyone on Android. Certainly some of the folk at UTB blogs found Facebook taking amazing liberties – such as Facebook accessing the phone location 561 times in 60 hours. That’s roughly every 6 minutes. You were asking about your battery life? (Apparently there’s a version coming for iOS too.)
link to this extract

TensorFlow: smarter machine learning, for everyone » Official Google Blog

Sundar Pichai:

It’s a highly scalable machine learning system—it can run on a single smartphone or across thousands of computers in datacenters. We use TensorFlow for everything from speech recognition in the Google app, to Smart Reply in Inbox, to search in Google Photos. It allows us to build and train neural nets up to five times faster than our first-generation system, so we can use it to improve our products much more quickly.

We’ve seen firsthand what TensorFlow can do, and we think it could make an even bigger impact outside Google. So today we’re also open-sourcing TensorFlow. We hope this will let the machine learning community—everyone from academic researchers, to engineers, to hobbyists—exchange ideas much more quickly, through working code rather than just research papers. And that, in turn, will accelerate research on machine learning, in the end making technology work better for everyone. Bonus: TensorFlow is for more than just machine learning. It may be useful wherever researchers are trying to make sense of very complex data—everything from protein folding to crunching astronomy data.

No quibbles: this is excellent news. Main site is http://www.tensorflow.org. Written in Python; binaries available for Linux and Mac. I’m sure there’s another desktop OS, isn’t there?
link to this extract

RECONSIDER » Medium

David Heinermeier Hansson (he usually goes by “DHH”), who founded Basecamp which – yawn! – is just mildly and continually successful:

it’s hard to carry on a conversation with most startup people these days without getting inundated with odes to network effects and the valiance of deferring “monetization” until you find something everyone in the whole damn world wants to fixate their eyeballs on.

In this atmosphere, the term startup has been narrowed to describe the pursuit of total business domination. It’s turned into an obsession with unicorns and the properties of their “success”. A whole generation of people working with and for the internet enthralled by the prospect of being transformed into a mythical creature.

But who can blame them? This set of fairytale ideals are being reinforced at every turn.
Let’s start at the bottom: People who make lots of little bets on many potential unicorns have christened themselves angels. Angels? Really?

link to this extract

Piano Phase » Alexander Chen

This site is based on the first section from Steve Reich’s 1967 piece Piano Phase. Two pianists repeat the same twelve note sequence, but one gradually speeds up. Here, the musical patterns are visualized by drawing two lines, one following each pianist.

The sound is performed live in the browser with the Web Audio API, and drawn in HTML5 Canvas.

This is really wonderful. Chen is a creative director at Google Creative Lab – he has done lots of other visualisations of music.
link to this extract

The consumerization of the automobile supply chain » DIGITS to DOLLARS

Jonathan Greenberg:

Last week I saw an interesting post on Venture Beat about Acer Launching an Electric All-Terrain Vehicle [quad bike, for UK readers]. This struck a chord because Taiwan-based Acer is a manufacturer of PCs and other consumer electronics (CE) devices. Acer is one of the most prominent companies in Taiwan’s CE complex, which builds almost all of our consumer gadgets. They are closely tied to some of the industry’s most important ODMs, component vendors and contract manufacturers. It is not that surprising to see a consumer electronics giant diversify into higher priced devices as they move up the value chain. However, if you don’t look at Acer as an device maker, but instead view them as a flagship of the Taiwanese electronics industry, the announcement has broader implications.

You can see where this is going, can’t you?
link to this extract

Errata, corrigenda and ai no corrida: none reported.

Start up: Google’s antitrust expansion, Morocco goes solar, Apple Music revealed?, IoT hacked again, and more

Posted on by
Reply


What makes a great selfie? Ask a neural network. Photo by Verónica Bautista on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Lather them on. I’m charlesarthur on Twitter. Observations and links welcome.

EU antitrust chief Vestager speaks about Google and other key cases » WSJ

Amazing to think it’s a year since Vestager took over (and the Google case[s] still aren’t resolved…). She tells Tom Fairless and Stephen Fidler in a long interview that with the cases against various bits of Google’s operations:

what they have in common is that the name Google appears in each one, but apart from that they are very different. And therefore I do not think of it as one Google case but literally as different investigations and different cases.

WSJ: So there’s not a read across from the shopping case to the others?

MV: Well, there may be a lesson learned. It’s a very fine balance. The shopping case may have similarities when we eventually look at maps and travel and a number of other related services, because the complaints sort of tell the same story. People feel or experience that they are either being demoted, or Google preferences its own services. But there is no such thing as you have done one, you’ve done them all. You can’t do that. On the other hand, if you look at the shopping case then there will be insights that will probably also be valid when it comes to other neighboring markets. But it’s a very, very fine balance, because we cannot do one case and then say the rest is the same. In a union of law and with due process, this cannot be the case.

WSJ: But equally, Google has many business lines besides shopping and could have many more in the future, and you would presumably not want to open a new case each time. So you would want to establish some sort of precedent?

MV: Yes, but still whatever precedent comes out has to be taken from the finalization of the case. And since we’re not there yet, it is very difficult to see where that will take us.

link to this extract

What a deep neural network thinks about your #selfie » Andrej Karpathy

Karpathy set a neural network to examine a few million not-liked and well-liked selfies, and draw conclusions:

A few patterns stand out for me, and if you notice anything else I’d be happy to hear about in the comments. To take a good selfie, Do:

• Be female. Women are consistently ranked higher than men. In particular, notice that there is not a single guy in the top 100.
• Face should occupy about 1/3 of the image. Notice that the position and pose of the face is quite consistent among the top images. The face always occupies about 1/3 of the image, is slightly tilted, and is positioned in the center and at the top. Which also brings me to:
• Cut off your forehead. What’s up with that? It looks like a popular strategy, at least for women.
• Show your long hair. Notice the frequent prominence of long strands of hair running down the shoulders.
• Oversaturate the face. Notice the frequent occurrence of over-saturated lighting, which often makes the face look much more uniform and faded out. Related to that,
• Put a filter on it. Black and White photos seem to do quite well, and most of the top images seem to contain some kind of a filter that fades out the image and decreases the contrast.
• Add a border. You will notice a frequent appearance of horizontal/vertical white borders.

You can also tweet your selfies to @deepselfie and get a score (100% is top!).
link to this extract

Morocco poised to become a solar superpower with launch of desert mega-project » The Guardian

Arthur Neslen:

When they are finished, the four plants at Ouarzazate will occupy a space as big as Morocco’s capital city, Rabat, and generate 580MW of electricity, enough to power a million homes. Noor 1 itself has a generating capacity of 160MW.

Morocco’s environment minister, Hakima el-Haite, believes that solar energy could have the same impact on the region this century that oil production had in the last. But the $9bn (£6bn) project to make her country’s deserts boom was triggered by more immediate concerns, she said.

“We are not an oil producer. We import 94% of our energy as fossil fuels from abroad and that has big consequences for our state budget,” el-Haite told the Guardian. “We also used to subsidise fossil fuels which have a heavy cost, so when we heard about the potential of solar energy, we thought; why not?”

Solar energy will make up a third of Morocco’s renewable energy supply by 2020, with wind and hydro taking the same share each.

link to this extract

Lawsuit accuses Apple’s iOS 9 Wi-Fi Assist of burning through $5M+ in data » Apple Insider

Neil Hughes:

Apple was slapped with a class-action suit on Friday, claiming that the company failed to properly warn users that the new Wi-Fi Assist feature in iOS 9 will use data from their cellular plan.

In the complaint, plaintiffs William Scott Phillips and Suzanne Schmidt Phillips allege that because of costs related to Wi-Fi Assist, the “overall amount in controversy exceeds” $5m. Filed in a U.S. District Court in San Jose on Friday, the suit was first discovered by AppleInsider.

Once users update to iOS 9, Wi-Fi Assist is turned on by default. Its goal is ensure a smooth internet experience, switching to cellular data in the event that the user is connected to a weak Wi-Fi signal.
The lawsuit claims that Apple “downplays the possible data overcharges a user could incur” from Wi-Fi Assist.

Some who don’t understand how Wi-Fi Assist works, or even that it exists, have alleged that the new feature has caused them to use more cellular data than anticipated. But the new class-action suit alleges it should be Apple who should reimburse customers for any overages [excess data use].

Default-enabling something that could burn through your mobile data is plain stupid. Why not offer people the chance of whether to use it the first time the chance comes up? This is poor focus – putting user experience in the narrow field of device use ahead of the wider user experience of “how big is my mobile bill?”

It puzzles me how implementations like this get through Apple’s processes. (See also: the pain of being the person working on Wi-Fi inside Apple.)
link to this extract

TalkTalk boss says cybersecurity ‘head and shoulders’ above competitors » The Guardian

Josh Halliday:

TalkTalk chief executive Dido Harding has insisted the company’s cybersecurity is “head and shoulders” better than its competitors in the wake of the massive hack attack affecting thousands of customers.

In an interview with the Guardian, Harding conceded it would be “naive” to rule out the prospect of the telecoms firm suffering a similar cyber-attack in the future, describing the threat from hackers as “the crime of our generation”.

Asked about claims by an IT researcher that he raised concerns about TalkTalk’s security with her office last September, Harding said its security had “improved dramatically” in the last year.

TalkTalk’s customer account details (excluding bank details, but including usernames and phone numbers) were stolen from an India call centre last year, and again, and now it has been hacked in a big way. The hackers are miles ahead of the companies here – which is becoming a depressingly common refrain. Also see the blogpost from last October showing how poor TalkTalk’s cybersecurity was.
link to this extract

Content paywalls on the agenda for digital news sites » FT.com

Matthew Garrahan:

Business Insider, which was acquired by German media group Axel Springer last month for close to $390m already charges for its research service and is now on course to be one of the first digital only news operations to erect a paywall around some of its general content. John Ore, Business Insider’s product manager, said in a recent blog post that the company was planning a broad “subscription offering” for readers “who prefer to pay us directly”.

Sweeping changes to the online advertising market mean other free news sites may follow suit. Sir Martin Sorrell thinks all newspapers should charge for content: the chief executive of WPP, the world’s largest advertising group said this week that paywalls were “the way to go”.

The problem, he says, is the lack of growth in digital advertising — an issue which is likely to get worse as ad blocking software grows in popularity. Ad blockers pose a real threat to the revenues generated by news sites. Meanwhile, rampant online ad fraud and the fact that brands often do not know whether their campaigns are being seen by real people, has shaken confidence in an industry that could do without the additional anxiety.

Would Business Insider try to block people using adblockers, as Axel Springer has?
link to this extract

New screenshots purportedly show Apple Music for Android ahead of release » 9to5Google

Mike Beasley:

In bringing its software to Android, Apple has taken a slightly different approach from Google’s own iOS apps. While Google’s apps attempt to mimic the company’s Material Design principles—even going so far as to include custom-made toggle switches and other elements—Apple relies on UI elements built into Android rather than attempting to recreate the iOS versions of them. The main navigation has even been moved from an iOS-like tab bar to a more Android-friendly slide-out sidebar.

Despite this, the company hasn’t managed to stick completely to Google’s design guidelines and has injected some of its own style into the app. For example, the For Me page almost identically mirrors its iOS counterpart.

The images appear to be legitimate and match up with the design Apple teased during the Apple Music announcement at WWDC this year. Not every feature of the app is shown off in the screenshots below, but you can get a feel for how the app will look and behave from our gallery of screenshots.

Looks quite Android-y, though not a full dive into Material.
link to this extract

DoJ to Apple: your software is licensed, not sold, so we can force you to decrypt » Boing Boing

Cory Doctorow:

The Justice Department lawyers argue [in a case where a defendant’s phone has been seized but they won’t give up the passcode; Apple has however acknowledged that it can bypass the code in pre-iOS 8 devices] that because Apple licenses its software – as opposed to selling it outright – that it is appropriate for the government to demand that Apple provide assistance in its legal cases.

To my knowledge, this is an entirely novel argument, but as I say, it has far-reaching consequences. Virtually every commercial software vendor licenses its products, rather than selling them. If the DoJ establishes the precedent that a product’s continued ownership interest in a product after it is sold obliges the company to act as agents of the state, this could ripple out to cars and pacemakers, voting machines and tea-kettles, thermostats and CCTVs and door locks and every other device with embedded software.

Might work in this particular case, but devices running iOS 8 onwards it won’t. That of course doesn’t apply to the many more internet-enabled “things”. Though those bring their own associated problems…
link to this extract

Compromised CCTV and NAS devices found participating in DDoS attacks » Slashdot

the security firm Incapsula [reports] that its researchers discovered compromised closed circuit cameras as well as home network attached storage (NAS) devices participating in denial of service attacks. The compromised machines included a CCTV at a local mall, just a couple minutes from the Incapsula headquarters.

According to the report, Incapsula discovered the infections as part of an investigation into a distributed denial of service attack on what it described as a “rarely-used asset” at a “large cloud service.” The attack used a network of 900 compromised cameras to create a flood of HTTP GET requests, at a rate of around 20,000 requests per second, to try to disable the cloud-based server. The cameras were running the same operating system: embedded Linux with BusyBox, which is a collection of Unix utilities designed for resource-constrained endpoints.

The Internet of Compromised Things is growing faster than our ability to cope with its effects.
link to this extract

Start up: sneaking iOS apps, spoofing Spotify, CIA director gets hacked, and more

Posted on by
1


One of these is probably chewing up your battery by playing silent audio (on Android too). But which? Photo by microsiervos on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Like champagne for the mind! Perhaps. I’m charlesarthur on Twitter. Observations and links welcome.

iOS apps caught using private APIs » SourceDNA

Nate Lawson and team:

we noticed that these functions were all part of a common codebase, the Youmi advertising SDK from China.

We then associated the clusters of this SDK’s code with the release dates of the apps that contain them to see how it has evolved over time. The older versions do not call private APIs, so the 142 apps that have them are ok. But almost two years ago, we believe the Youmi developers began experimenting with obfuscating a call to get the frontmost app name.

Once they were able to get this through App Review, they probably became more confident they weren’t being detected and added the above behaviors in order. They also use the same obfuscation to hide calls to retrieve the advertising ID, which is allowable for tracking ad clicks, but they may be using it for other purposes since they went to the trouble to obfuscate this. The latest version of the Youmi SDK (v5.3.0), published a month ago, still gathers all the above information.

Apple has been locking down private APIs, including blocking apps from reading the platform serial number in iOS 8. Youmi worked around this by enumerating peripheral devices, such as the battery system, and sending those serial numbers as a hardware identifier.

Find out now! Just select your developer accounts from a list, and we’ll tell you what we found about your apps. We’ll also show the commercial and open-source code you’re using and alert you to future issues we find.

We found 256 apps (est. total of 1 million downloads) that have one of the versions of Youmi that violates user privacy. Most of the developers are located in China. We believe the developers of these apps aren’t aware of this since the SDK is delivered in binary form, obfuscated, and user info is uploaded to Youmi’s server, not the app’s. We recommend developers stop using this SDK until this code is removed.

Apple’s yanking the apps. Developer? Check it here. It’s always China, isn’t it? But nothing to stop apps from other countries doing the same.
link to this extract

The background data and battery usage of Facebook’s iOS app » MacStories

Federico Viticci:

With iOS 9’s improved energy consumption stats, it’s easier to guess one of the various tricks Facebook may be employing to stay active in the background and drain battery. On my girlfriend’s iPhone, for instance, iOS 9 reports 5 hours of on-screen usage for the last 7 days, and another 11 hours of background audio usage with Background App Refresh turned off.

My guess is that Facebook is hijacking audio sessions on iOS by keeping silent audio in the background whenever a video plays in the app. And because, by default, videos on Facebook auto-play on both Wi-Fi and Cellular and few people ever bother to turn it off, that means there’s a high chance the Facebook app will always find a way to play a video, keep audio in the background, and consume energy to perform background tasks. I’m not alone in noticing the mysterious “Facebook audio” background consumption, and video auto-play seems to me the most likely explanation at this point. I don’t know if turning off auto-play may fix the problem, but I’d recommend doing that anyway to save data.

Un-fricking-believable. The web is suddenly alive with people who have used iOS 9’s better battery monitoring system and discovered that Facebook is eating their battery like nobody’s business.

More discussion here, and a full-on Medium post, which shows Facebook using 3.4hrs in the background with background app refresh turned off.

Just delete it, and use the mobile site – navigate there and create a home page icon for it. And close the tab when done.
link to this extract

Microsoft announces price of 1TB Surface Book — $500 more than the top 13-inch MacBook Pro » GeekWire

James Risley:

The top-of-the-line 1TB Surface Book comes with 16GB RAM and a Core Intel i7 processor for a cool $3,199, $500 more than the fully tricked out 13-inch MacBook Pro, and the same price as the fully enhanced, much larger 15-inch option. The Surface Book does have a few more tricks up its sleeve than the MacBook Pro, including a touchscreen, removable keyboard and a 360-degree hinge, so the price difference isn’t without reason.

The 1TB option joins the lineup that starts at $1,499 for a 128GB Core i5 version. Microsoft isn’t offering many fine-grained customizations for its first laptop, like allowing for more RAM on its 128GB model, but most models look adequately powerful for the everyday user.

“Everyday user”? Wasn’t the point of the Surface Book that it was for some slightly mythical ultra-user? As for the touchscreen and removable keyboard… the case for the touchscreen is still pretty weak for the “everyday user”.
link to this extract

Teen says he hacked CIA director’s AOL account » New York Post

Philip Messing, Jamie Schram and Bruce Golding:

Hillary Rodham Clinton’s email scandal didn’t stop the head of the CIA from using his own personal AOL account to stash work-related documents, according to a high school student who claims to have hacked into them.

CIA Director John Brennan’s private account held sensitive files — including his 47-page application for top-secret security clearance — until he recently learned that it had been infiltrated, the hacker told The Post.

Other emails stored in Brennan’s non-government account contained the Social Security numbers and personal information of more than a dozen top American intelligence officials, as well as a government letter about the use of “harsh interrogation techniques” on terrorism suspects, according to the hacker.

The FBI and other federal agencies are now investigating the hacker, with one source saying criminal charges are possible, law enforcement sources said.

The hacker is getting investigated for criminal charges? Brennan is the one who ought to be prosecuted. If a kid in high school could do this, any Chinese or Russian hacker would have.
link to this extract

Why it’s OK to block ads » Practical Ethics

James Williams:

Think about the websites, apps, or communications platforms you use most. What behavioral metric do you think they’re trying to maximize in their design of your attentional environment? I mean, what do you think is actually on the dashboards in their weekly product design meetings?

Whatever metric you think they’re nudging you toward—how do you know? Wouldn’t you like to know? Why shouldn’t you know? Isn’t there an entire realm of transparency and corporate responsibility going undemanded here?

I’ll give you a hint, though: it’s probably not any of the goals you have for yourself. Your goals are things like “spend more time with the kids,” “learn to play the zither,” “lose twenty pounds by summer,” “finish my degree,” etc. Your time is scarce, and you know it.

Your technologies, on the other hand, are trying to maximize goals like “Time on Site,” “Number of Video Views,” “Number of Pageviews,” and so on. Hence clickbait, hence auto-playing videos, hence avalanches of notifications. Your time is scarce, and your technologies know it.

But these design goals are petty and perverse. They don’t recognize our humanity because they don’t bother to ask about it in the first place.

Neatly argued, by stepping right back from the debate as framed by the ad industry.
link to this extract

I built a botnet that could destroy Spotify with fake listens » Motherboard

William Bedell:

I decided to prototype a robot with an endless appetite for music to see if Spotify could detect what it was doing.

Here is what I coded into life:

Image: William Bedell
First, a remote server used browser automation to sign up for Spotify accounts with randomly generated names, ages, and email addresses. This gave me a limitless supply of accounts to stream songs, so as not to alert Spotify by having a handful of users with inhuman amounts of activity.

A central command server periodically sent out Spotify login credentials to cloud servers (or repurposed personal computers) running dozens of Spotify clients, all masked behind virtual private networks. Each “user” logged in, listened to a few hours of music, then logged out. Their playlists were random selections from various artists I like. Then, I deployed the botnet using a patchwork of free cloud instances and my own hardware.

It was mesmerizing to watch the plays rack up. Unknown albums from minor celebrities I adore suddenly had tens of thousands of hits, where before they had virtually none. With minimal effort, I was generating $32.26 per day in royalties. Inevitably, my thoughts wandered to greed: how profitable would this music royalty factory be if I turned it on music I owned the rights to?

link to this extract

Intel has 1,000 people working on chips for the iPhone » VentureBeat

Mark Sullivan:

Intel now has a thousand people or more working to outfit a 2016 iPhone with its lauded 7360 LTE modem chip, sources say. If all goes well, Intel may end up providing both the modem and the fabrication for a new Apple system on a chip.

Sources close to the matter say Intel is pulling out the stops to supply the modems for at least some of the iPhones Apple manufactures in 2016. This phone will likely be the iPhone 7. VentureBeat was the first to report on the two companies’ work together, and more pieces are falling into place as the project progresses and grows.

Apple may dual-source the LTE modems in its new iPhones from both Intel and Qualcomm. Today, Qualcomm’s 9X45 LTE chip is baked into all iPhone modems.

This story makes one go “hmm..” right up to the point where it talks about dual-sourcing. Then it suddenly makes perfect sense: Apple would look to play the two off against each other, as with CPU supply.
link to this extract

E.U. rule change could be big headache for small businesses » Advertising Age

Kate Kaye:

“I think everybody was hoping [the ECJ] wouldn’t [rule against Safe Harbour], but we were kind of expecting them to rule it this way,” said Acxiom Chief Privacy Officer Jennifer Glasgow. But, she said, “This is not going to disrupt a lot of data flow today or tomorrow or next week.”

The Safe Harbor compact has helped streamline the data flow for more than 4,000 companies including data brokers, ad technology firms and ecommerce companies among others for 15 years. But alarmed by Edward Snowden’s revelations, the E.U. court decided the agreement is not strong enough to protect Europeans’ privacy, including against U.S. spies.

Most large firms handling massive amounts of data such as Google, Facebook and Amazon should already have other legal contracts in place, including previous agreements guiding heavily-regulated health and financial data, that should allow them to continue data transfer as usual. Smaller marketers and data vendors won’t be so lucky, which could have ripple effects throughought the marketing ecosystem.

Correction: the ECJ wasn’t “alarmed” by the revelations; it made a judgement in the light of those revelations about whether EU law could still be applied to data transferred to the US under Safe Harbour.

What’s weird is how people are acting as though this won’t make a difference. If you’re not allowed to transfer data US-owned servers on the basis that it might be rifled through by the US government, how can it not? (Of course, everyone would be howling for safety if these were Chinese-owned servers and companies; witness the US administration’s lockout of China’s Huawei from communications contracts.)
link to this extract

The secrets of a billionaire’s blood-testing startup » The New Yorker

Eric Lach:

Part of the Theranos story is the tension between commerce, science, and secrecy. Ken Auletta explored this tension in the magazine late last year, in his December profile of Holmes. For most of its existence, Auletta wrote, Theranos has “operated with a stealth common to many Silicon Valley startups.” The company has published little data in peer-reviewed journals describing its devices or its test results, and it has kept the workings of its technology a closely guarded secret. Holmes herself prefers speaking about the coming revolution that her company will bring rather than the specifics of the technology itself.

Holmes and the company say this is normal, that Theranos is only trying to protect itself and its trade secrets while it creates something new. The company says that it has taken steps to get its tests approved by the F.D.A. But there are many who say that health-care technology can’t be afforded the same hushed reception as a new model of the iPhone. “Science is peer-reviewed,” Lakshman Ramamurthy, a former F.D.A. official and a vice-president at the consulting company Avalere Health, said, reacting to the Journal article this week.

Of course, Holmes could be a billionaire, or a zeroinaire, depending how things pan out over the next few months.

What the WSJ story also shows (by its impact, and the puzzled followups) is how little understanding there is of biotech among most journalists. Science journalists tend to shy away from it because it involves business, and business journalists aren’t good at figuring out what questions to ask experts about the science.
link to this extract

Start up: lightening YouTube, more Flash vulnerability, farewell to Apple’s store fan, NSA cracking, and more

Posted on by
Reply


“Yeah, pretty frazzled after a long day writing clickbait headlines. You?” Photo by peyri on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 8 links for you. Hand-picked by fingers. I’m charlesarthur on Twitter. Observations and links welcome.

Page weight matters » Chris Zacharias

At YouTube, Zacharias was challenged to get the standard 1.2MB page down below 100KB:

Having just finished writing the HTML5 video player, I decided to plug it in instead of the far heavier Flash player. Bam! 98KB and only 14 requests. I threaded the code with some basic monitoring and launched an opt-in to a fraction of our traffic.

After a week of data collection, the numbers came back… and they were baffling. The average aggregate page latency under Feather had actually INCREASED. I had decreased the total page weight and number of requests to a tenth of what they were previously and somehow the numbers were showing that it was taking LONGER for videos to load on Feather. This could not be possible. Digging through the numbers more and after browser testing repeatedly, nothing made sense. I was just about to give up on the project, with my world view completely shattered, when my colleague discovered the answer: geography.

The explanation is rather smart.
link to this extract

Forbes: a quick adtech video » Medium

Rob Leathern wanted to read an article – you know, one of those text things – on Forbes:

In order for me to read that one article I had to receive 1,083 URL calls from 197 different domains adding up to 18.3 Megabytes of data, summarized here in an Excel spreadsheet. I closed any videos as soon as I could if they had the ability to do so.

Is it worth it? I like Alex Konrad and the article was probably a good one, but given I’m not sure where my data is going, or who some of these entities are (jwpltx.com? wishabi.com?) I just don’t know.

link to this extract

Auto-generating clickbait with recurrent neural networks » Lars Eidnes’ blog

To generate clickbait, we’ll train such an RNN [recurrent neural network] on ~2,000,000 headlines, scraped from Buzzfeed, Gawker, Jezebel, Huffington Post and Upworthy.

How realistic can we expect the output of this model to be? Even if it can learn to generate text with correct syntax and grammar, it surely can’t produce headlines that contain any new knowledge of the real world? It can’t do reporting? This may be true, but it’s not clear that clickbait needs to have any relation to the real world in order to be successful. When this work was begun, the top story on BuzzFeed was “50 Disney Channel Original Movies, Ranked By Feminism“. More recently they published “22 Faces Everyone Who Has Pooped Will Immediately Recognized“. It’s not clear that these headlines are much more than a semi-random concatenation of topics their userbase likes, and as seen in the latter case, 100% correct grammar is not a requirement.

The training converges after a few days of number crunching on a GTX980 GPU. Let’s take a look at the results.

The results are spooky – such as “Taylor Swift Becomes New Face Of Victim Of Peace Talks” and “This Guy Thinks His Cat Was Drunk For His Five Years, He Gets A Sex Assault At A Home”. Because, you know, if you looked out of the corner of your eye, isn’t that what was on some site somewhere? (They weren’t.)

One feels Eidnes’s work should have happened in a Transylvanian laboratory in a thunderstorm. Next you get a machine to write the story that fits the headline, and.. we can all knock off for the century.
link to this extract

Broadband in the UK ‘to stay top of the 5 major EU countries until 2020’ » ISPreview UK

Mark Jackson:

A new BT-commissioned report from telecoms analyst firm Analysys Mason has perhaps unsurprisingly found that the take-up and availability of superfast broadband (30Mbps+) connectivity in the United Kingdom is ahead of Spain, Germany, Italy and France, and will remain there until at least 2020.

The benchmarking report marks the United Kingdom as the “most competitive broadband market of all the countries it features“, although there are a few caveats to its findings. For example, the report overlooks most of Europe’s other states, including those with superior broadband infrastructure to ours, and seems to only focus on fixed line networks.

Furthermore it also makes an assumption that the current roll-out progress will hold to the Government’s promised targets, which may well be the case but we won’t know for certain until 2020. In addition, the study only appears to consider “superfast” services (defined as 30Mbps+ in the report), which overlooks the important area of “ultrafast” (100Mbps+) connectivity.

BT tweeted this headline and added “thanks to BT’s rollout of fibre”, and the culture/media/sport minister Ed Vaizey retweeted it without comment.

Is it really healthy that during an Ofcom examination of BT’s position a minister is doing that? Meanwhile Jackson’s longer analysis provides much-needed scepticism about the claims, and the lack of data in the report.
link to this extract

Adobe Flash Player security vulnerability: how to protect yourself » BGR

Zach Epstein:

The fun never ends with Adobe Flash.

Just one day after Adobe released its monthly security patches for various software including Flash Player, the company confirmed a major security vulnerability that affects all versions of Flash for Windows, Mac and Linux computers. You read that correctly… all versions. Adobe said it has been made aware that this vulnerability is being used by hackers to attack users, though it says the attacks are limited and targeted. Using the exploit, an attacker can crash a target PC or even take complete control of the computer.

And now for the fun part: The only way to effectively protect yourself against this serious security hole is to completely uninstall Flash Player from your machine.

Here’s the security note: “Adobe is aware of a report that an exploit for this vulnerability is being used in limited, targeted attacks. Adobe expects to make an update available during the week of October 19.” Spear phishing, no doubt; but Flash really is beginning to look like the worst thing you can have on your machine, especially if you’re in any sort of sensitive work.
link to this extract

Why Google is wrong to say advertisers should shift 24% of their TV budgets to YouTube » Business Insider

Lindsey Clay in chief executive of Thinkbox, which just happens to be a commercial TV marketing body, and doesn’t like Google’s suggestion:

why would an advertiser remove a quarter of the money they invest in the most effective part of their advertising and give it to something that hasn’t shown any proof of actually selling anything? 

However, it needs a response lest anyone believes Google on this. Here are some things to consider:

This is Google’s data. We’ve asked to see the data itself, but usually Google doesn’t share. If and when it does, we’ll comment on it but we obviously need to comment now. We understand the TV elements are based around a panel of Google users managed by Kantar that does not measure all TV and that the YouTube element is provided by Google themselves.

If that isn’t flaky and biased enough, it is also unaudited. They even called it the “Google Extra Reach Tool”; it is a self-fulfilling prophecy. And does it take account of the 50% of online ads that are not seen by humans? And how does it square with the report in the FT recently revealing that YouTube has been selling fraudulent ad views to advertisers?

Their recommendation also seriously challenges common sense when official industry sources including comScore show that YouTube accounts for 7.5% of 16 to 24-year-olds’ video time, with TV at 65%. The numbers for the whole population are 3.5% and 81%. Ad minutage on commercial TV is approximately 15% of that time, but is much lower on YouTube, and that is before you consider users’ impatient use of its ‘Skip ad’ button.

Clay is hardly impartial, but she raises worthwhile points.
link to this extract

Apple’s biggest fan has died » The Washington Post

Michael Rosenwald:

There are plenty of goofballs — like me — who stand outside Apple stores all night waiting for the company’s latest, thinnest, must-have offering.

There was nobody like Gary Allen, who died Sunday from brain cancer at 67.

Allen didn’t care so much about Apple’s new products (though he bought many of them.) He cared about the stores, the sleek and often innovative ways Apple presented itself to the world — the winding staircases, the floor-to-ceiling glass, the exposed brick.

Allen, a retired EMS dispatcher, traveled around the world — obsessively and expensively — to be among the first in line at the company’s new stores. He attended more than 140 openings, collecting all sorts of trivia. He could even tell you where Apple store tables are made (Utah; he stopped by the factory once to say thanks).

The headline is a trifle unfair; Allen was a fan of the stores, and their design. Rosenwald recounts a story of someone who just liked paying attention to detail; it’s a delightful mini-obituary.
link to this extract

How is NSA breaking so much crypto? » Freedom To Tinker

Alex Halderman and Nadia Heninger:

The Snowden documents also hint at some extraordinary capabilities: they show that NSA has built extensive infrastructure to intercept and decrypt VPN traffic and suggest that the agency can decrypt at least some HTTPS and SSH connections on demand.

However, the documents do not explain how these breakthroughs work, and speculation about possible backdoors or broken algorithms has been rampant in the technical community. Yesterday at ACM CCS, one of the leading security research venues, we and twelve coauthors presented a paper that we think solves this technical mystery.

The key is, somewhat ironically, Diffie-Hellman key exchange, an algorithm that we and many others have advocated as a defense against mass surveillance. Diffie-Hellman is a cornerstone of modern cryptography used for VPNs, HTTPS websites, email, and many other protocols. Our paper shows that, through a confluence of number theory and bad implementation choices, many real-world users of Diffie-Hellman are likely vulnerable to state-level attackers.

Estimated cost: $100m for a system that could break a single Diffie-Hellman key per year. But after two years, with the correctly chosen keys, you could passively eavesdrop on 20% of the top million HTTPS sites. Don’t underestimate the NSA. But of course, don’t underestimate the Chinese, Russians, and so on..
link to this extract

Start up: inside a content factory, US reacts to Safe Harbour sinking, why Surface?, Android lemons and more

Posted on by
Reply


In China, such literalism might really happen. Photo by GotCredit on Flickr.

A selection of 8 links for you. Fee fi fo fum. I’m charlesarthur on Twitter. Observations and links welcome.

The Chicago End-Times » The Awl

Sam Stecklow on the “content factory” at the Chicago Sun-Times, churning out meaningless content because ads:

Network staffers were concerned with the quality of work they were being asked to do, too. Marty Arneberg, a former intern, told me, “When I was applying to jobs, I would send very few Sun Times Network articles. I would mention in my résumé, forty hours a week I worked here, but I would not send them any examples. Because it was such a content factory, you just had to pump stuff out all the time. It was just like, get it out there, we need some pageviews now.” A former editor told me, “I wouldn’t read most of what I wrote if given the choice.” He added, “Spending more than thirty minutes on any article was generally frowned upon.” Arneberg told me that a “post got me the most pageviews of any post that I wrote and it was complete bullshit. It was a total hoax,” he said. “The weird thing is, when it came out that that was a hoax, nobody spoke to me. Nobody said anything, like, ‘Hey, you gotta watch out for that.’ It was just ignored.”

The question of whom, exactly, Sun Times Network is supposed to be for is one I asked everyone I interviewed for this story, and none of them could provide a good answer. I can’t either.

Stecklow’s descent into the toxic hellstew is well-described; it’s like a modern version of The Jungle. This is where content is heading. And not long after that, the stories will be “written” by computers, and you’ll wonder why we don’t just get computers to read them too, and go and do something more worthwhile, such as digging ditches. Oh, and reading The Awl.
link to this extract

The company behind Relish wireless broadband makes a big loss » Engadget

Nick Summers:

Relish’s dream to connect London homes with wireless broadband, rather than traditional landlines, could be in trouble. UK Broadband, the company behind the service, has reported losses of £37.5m for 2014 – almost four times what it was the year before. To make matters worse, turnover slipped from roughly £2m to £1.5m over the same period. Relish was launched in June 2014 as a simpler, but capable broadband alternative to the likes of BT, Sky and Virgin Media. Instead of copper and fibre cables, the company relies on 4G connections to deliver the internet to its customers. The advantages are plentiful — you don’t need to pay for a landline, and because Relish’s network is already up and running, you don’t need an engineer to install anything. Once you’ve signed up, a router is sent round within the next working day and you can instantly get online. The concept is similar to the mobile broadband packages offered by EE, Three and other UK carriers, although here there are no restrictive data allowances. So what’s gone wrong?

Nobody, it seems, knows.
link to this extract

China is building the mother of all reputation systems to monitor citizen behaviour » Co.Exist

Ben Schiller:

“They’ve been working on the credit system for the financial industry for a while now,” says Rogier Creemers, a China expert at Oxford University. “But, in recent years, the idea started growing that if you’re going to assess people’s financial status, you should equally be able to do that with other modes of trustworthiness.”

The document talks about the “construction of credibility”—the ability to give and take away credits—across more than 30 areas of life, from energy saving to advertising. “It’s like Yelp reviews with the nanny state watching over your shoulder, plus finance, plus all of these other things,” says Creemers, who translated the plan.

The system, overseen by the State Council, is made possible by two factors. One, it’s now possible to gather information about behavior as never before. As we use the Internet and different devices, we’re leaving behind a huge footprint of data. Second, the Chinese government sees no reason to safeguard its citizens’ data rights if it thinks that data can benefit them, says Creemers.

“In Europe and the U.S., there’s a notion that the state should be constrained, that it’s not right to intervene in people’s lives, unless for justified reasons. In China, the state has no qualms about that. It says ‘data allows us to make society for better, so we’re going to use it,'” he says.

link to this extract

Behind the European privacy ruling that’s confounding Silicon Valley » NYTimes.com

Robert Levine:

American technology firms are especially worried because they routinely transfer so much information across the Atlantic. “International data transfers are the lifeblood of the digital economy,” said Townsend Feehan, chief executive of IAB Europe, which represents online advertising companies including Google as well as small start-ups. The ruling “brings with it significant uncertainty as to the future possibility for such transfers.”

As Mr. Schrems sees it, however, what is at stake is a deeper conflict between the European legal view of privacy as a right equivalent to free speech and that of the United States, where consumers are asked to read and agree to a company’s terms of service and decide what’s best for themselves. “We only do this in the privacy field — dump all the responsibility on the user,” Mr. Schrems said. He pointed out that consumers are not expected to make decisions about other complex issues, like food or building safety. “In a civilized society,” he said, “you expect that if you walk into a building it’s not going to collapse on your head.”

But if it collapses on your head and kills you, then you sue! No, hang on. (Bonus point to Levine for the handwringing quote from the advertising industry.)
link to this extract

Microsoft Surface: from cross-bearer to standard-bearer » Fast Company

Ross Rubin:

As the Surface Pro customer base has grown, it’s likely that Microsoft is just accommodating potential customers who prefer a more laptop-like device than the Surface Pro 4, which is still a tablet propped up with a kickstand.

While Microsoft is quick to compare its “ultimate laptop”—which starts at $1,500 and goes way, way up—to Apple’s portables, it will walk a far narrower tightrope in competing with its own hardware partners with the Surface Book. Not only does the first model stand to do battle with the best that HP, Dell, Acer, and Lenovo have to offer, but the company is poised to come downmarket with a lower-priced mainstream version, as it did with the $500 Surface 3.

The Surface experience story isn’t quite as good as it looks on paper. Even with the considerable reconciliation of Windows 10 and the arrival of a touch-optimized Office as well as other universal apps, Windows’ interface is still in transition. Many people with Surfaces spend much of their day working not so differently than they would with a no-touch Windows 7 laptop. Even on the marketing side, Microsoft needs to rethink the Surface Pro, which it’s been promoting as the tablet that can replace your laptop. Now that the company wants to sell you a laptop, where does that leave the Surface Pro?

This is slightly the problem: why Surface Pro, if there’s Surface Book? Rubin also thinks there’s a Surface iMac (for want of a better name) brewing in Redmond. This seems unlikely though – the sales figures would be so miniscule it would never make money for anyone. Speaking of which…
link to this extract

Why Apple is still sweating the details on iMac » Medium

Steven Levy was given access to Apple’s Ergonomic Design Lab to get the inside story of how the new iMacs and Magic Mouse and so on were built. But what are they for? Phil Schiller, Apple’s head of marketing, explains:

“The job of the watch is to do more and more things on your wrist so that you don’t need to pick up your phone as often. The job of the phone is to do more and more things such that maybe you don’t need your iPad, and it should be always trying and striving to do that. The job of the iPad should be to be so powerful and capable that you never need a notebook. Like, Why do I need a notebook? I can add a keyboard! I can do all these things! The job of the notebook is to make it so you never need a desktop, right? It’s been doing this for a decade. So that leaves the poor desktop at the end of the line, What’s its job?”

Good question. And the answer?

“Its job is to challenge what we think a computer can do and do things that no computer has ever done before, be more and more powerful and capable so that we need a desktop because it’s capable,” says Schiller. “Because if all it’s doing is competing with the notebook and being thinner and lighter, then it doesn’t need to be.”

But – take note – no intention of introducing a touchscreen iMac. None at all, says Schiller: “The Mac OS has been designed from day one for an indirect pointing mechanism. These two worlds are different on purpose.”
link to this extract

​Android security a ‘market for lemons’ that leaves 87% vulnerable » ZDNet

Liam Tung:

“The difficulty is that the market for Android security today is like the market for lemons,” Cambridge researchers Daniel Thomas, Alastair Beresford, and Andrew Rice note in a new paper.

“There is information asymmetry between the manufacturer, who knows whether the device is currently secure and will receive security updates, and the customer, who does not.”

Their analysis of data collected from over 20,000 Android devices with the Device Analyzer app installed found that 87% of Android devices were vulnerable to at least one of 11 bugs in the public domain in the past five years, including the recently discovered TowelRoot issue, which Cyanogen fixed last year, and FakeID.

The researchers also found that Android devices on average receive 1.26 updates per year.

“The security community has been worried about the lack of security updates for Android devices for some time,” Rice said.

The “security community” hasn’t had much effect, then. The study was part-funded by Google.
link to this extract

US says Apple e-books antitrust monitor no longer needed » Reuters

Nate Raymond:

The US Justice Department has determined that Apple Inc has implemented significant improvements to its antitrust compliance program and that a court-appointed monitor’s term does not need extended, according to a court filing.

The Justice Department in a letter filed late Monday in Manhattan federal court said its recommendation was despite Apple’s “challenging relationship” with Michael Bromwich, who was named monitor after the iPad maker was found liable for conspiring to raise e-book prices.

The Justice Department said its decision to not recommend extending the monitorship beyond its two-year term was “not an easy one,” as Apple “never embraced a cooperative working relationship with the monitor.”

But the department said it was giving greater weight to Bromwich’s “assessment that Apple has put in place a meaningful antitrust compliance program than to the difficult path it took to achieve this result.”

Apple is still considering an appeal to the Supreme Court. The antitrust thing must feel like a stain.
link to this extract

No, wait! You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

Start up: Euler programs, adblocking wars redux, Android M’s security measure,

Posted on by
Reply


At last: HTML5 iPlayer on the desktop. Only a beta for now.. Photo by Julie70 on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. Use them wisely. I’m charlesarthur on Twitter. Observations and links welcome.

(No, there aren’t any links about the new Google offerings – two phones and a tablet – because I couldn’t find any useful analysis of them beyond “they’re phones” and “it’s a tablet with a keyboard”. If you do want to know about them, try “The nine most important things from Google’s Nexus event” from The Verge.)

About » Project Euler

What is Project Euler?
Project Euler is a series of challenging mathematical/computer programming problems that will require more than just mathematical insights to solve. Although mathematics will help you arrive at elegant and efficient methods, the use of a computer and programming skills will be required to solve most problems.

The motivation for starting Project Euler, and its continuation, is to provide a platform for the inquiring mind to delve into unfamiliar areas and learn new concepts in a fun and recreational context.

Who are the problems aimed at?
The intended audience include students for whom the basic curriculum is not feeding their hunger to learn, adults whose background was not primarily mathematics but had an interest in things mathematical, and professionals who want to keep their problem solving and mathematics on the cutting edge.

The first problem should feel pretty easy if you’ve done any programming. If not, give yourself a little time to solve it. (A different sort of programmer hacked its database in August.) They’re presently up to problem 527; No.528 is up on October 3.
link to this extract

IAB enters publicity, engineering war against ad blockers – Special: Advertising Week 2015 » Advertising Age

Nat Ives:

The IAB has come up with code, for example, that it said will help small publishers detect consumers who show up with ad blocking activated. “We believe this script will actually help enable them in their fight just by enabling their ability to detect,” said Scott Cunningham, senior VP at IAB and general manager of the IAB Tech Lab, at a press conference during the annual IAB Mixx conference, which coincides with Advertising Week.
Related Stories

Some publishers that see ad-blocking visitors arrive greet them with dialogue boxes encouraging a change of heart or, failing that, perhaps becoming paid subscribers. But the open architecture of many web pages has allowed ad blockers to hide even those dialogue boxes, Mr. Cunningham said. The IAB is recommending that publishers switch to more secure protocols to prevent that.

Going to war with people because they’re not your customers isn’t the way to persuade them to become your customers.
link to this extract

Medium: PR Newswire revisited » Business Insider

Biz Carson:

“With this [$57m funding] round we aim to make Medium the dominant pipeline for connecting quality content and conversation,” Andy Doyle wrote. “We don’t focus on page views, unique visitors, or click metrics. We don’t litter the platform with ads that are low-quality, high-clutter.”

That part is true. There are no ugly ads that flash advertising before crashing your browser.

Instead, everyone from San Francisco’s local supervisors to the White House are publishing articles, essays, and press releases, surrounded by the same swaths of white and clean fonts. The bylines are tucked away in the top left corner.

Companies may call this “content.” A lot of it looks like advertising.

And let’s face it: Medium has become a dumping ground for a different generation’s press releases.

Seems harsh, but Carson has a point. Then again, that makes Medium a pretty good “native advertising” supplier; there’s lots of other non-advertising, desirable, readable content in there. I keep finding links to it.
link to this extract

New HTML5 Player beta trial for BBC iPlayer » BBC Internet Blog

James East, product manager for media playout:

Although we’ve been using HTML5 to deliver video to iOS devices for some time, until recently we felt that the consistent experience and efficient media delivery offered by Flash outweighed the benefit of moving to HTML5 on the desktop. However, we’ve been regularly evaluating the features offered by the most popular web browsers and we’re now confident we can achieve the playback quality you’d expect from the BBC without using a third-party plugin.

To opt in, visit our HTML5 Player beta page. This will allow you to set a cookie in your browser so you can access our HTML5 player on BBC iPlayer. If you clear your cookies or switch browsers, you’ll have to return to this page to re-enter the trial. You can also visit this page if you want to opt out and return to our non-beta player.

At last. Alternatively, do what I do: uninstall Flash and invoke the “developer” option in Safari (Preferences » Advanced » “Show Develop menu in menu bar”), and when you visit the BBC and it wants Flash to play a video, change the user-agent to “iPad”. (Via Stef Pause.)
link to this extract

Android Marshmallow’s best security measure is a simple date » The Verge

Russell Brandom:

Android security has always faced a daunting challenge — scrambling to get users, manufacturers, and carriers in sync — but the new Marshmallow operating system has a small feature that could make a big difference in that fight. You’ll find it in the Settings menu, a header titled “Android security patch level,” followed by a date. As of that day, your device is protected with all known Android patches.

Championed by Adrian Ludwig, Google’s head of Android security, the date represents a public bet on the industry’s ability to keep Android devices updated. “It should make it really simple for users to understand the state of the device,” Ludwig says, as part of Android’s larger push toward “making sure that security information and patch level information is available to users.”

That’s going to be a good one to watch.
link to this extract

You can now turn off ads on Techdirt » Techdirt

Mike Masnick:

We’ve even been approached by multiple companies who claim to offer a form of ad blocker blocker, that will either insert new ads even when users have ad blockers, or otherwise pester users with ad blockers turned on.

This seems like the exact wrong approach. It’s somewhat reminiscent of the way the RIAA and MPAA reacted to the internet challenging their business models. Rather than listen, recognize what the public wanted and adapt, they whined, screamed about ethics and went to court. And how’s that worked out for everyone? We’ve always said that those who adapt to these challenges are likely to do better, and part of that means actually listening to your fans and helping them do what they want. So that’s what we’re doing: if you choose to disable ads, you just need to go to your preferences and click a button and that should do it.

Such a smart move. Masnick has built a strong community at Techdirt, and so offering this – while pointing out gently that it costs money to run the site, and there are ways to donate – is a terrific way forward.
link to this extract

The dark, scammy history of JustFab and Fabletics » BuzzFeed News

Sapna Maheshwari:

while JustFab has revenue streams befitting a unicorn, its predecessor companies were less ethereal beasts. For more than a decade, starting at MySpace’s parent company, [Adam] Goldenberg and [Don] Ressler’s customers have frequently complained of getting tricked into recurring credit card charges and fooled by deceptive advertising and misleading promises — promises the FTC said sounded “like magic pixie dust” in a warning to consumers regarding the diet product Sensa. It made more than $300 million in sales before the federal regulator intervened.

The ugly hallmarks of those past enterprises live on in JustFab: The company and its affiliates, for all their happy customers, have often been accused of deceiving shoppers who think they’re making a single purchase into signing up for a subscription that automatically charges them each month unless they opt out within a five-day window. The sites use terms like “VIP Membership” instead of “subscription,” and JustFab and Fabletics in particular downplay the options for avoiding charges each month; cancellations require lengthy phone calls.

Ugh. Inertia marketing – such a horrible, scummy business model, and doomed to failure once customers get wise. The only question is how long that will take.
link to this extract

Axel Springer buys Business Insider » Re/code

Peter Kafka:

The deal values Business Insider at $442m — we had previously told you it would peg the site’s value at $560m — but Springer already owned 9% of the company, and Amazon CEO Jeff Bezos, who had previously put his own money into the company, will leave it in there. When factoring out the cash still on the books, the value comes down to $390 million. Springer will end up writing a check for $343m when the deal closes; it says Business Insider has 76 million readers and 325 employees worldwide.

However you count it, the deal sets a new mark for native digital publisher sales, previously held by the Huffington Post, which AOL acquired for $315m in 2011. While several big digital publishers have taken on financing that values their companies above Business Insider’s sale price, none of them have actually sold at those levels yet.

That’s a big vote of confidence in people carrying on reading content online. 76 million readers is substantial.
link to this extract

Marissa Mayer’s take on ad blocking: ‘It hurts the Web experience’ » Digiday

Ricardo Bilton:

The Yahoo CEO told an Advertising Week audience that ads, particularly those tied to people’s interest and browsing history, actually improve the experience of using the Web rather than hurt it.

“I think that for anyone that uses their browser’s incognito mode and starts getting untargeted ads or no ads at all, the experience on the Web becomes a lot less rich. I personally think it’s a mistake to install ad blockers,” she said at an IAB event during Advertising Week in New York City on Monday. “If I have friends or family members asking if they should install them, I tell them ‘please don’t because I think that your experience on the Web will get worse’.”

As Bilton then points out, Yahoo was responsible for serving malware to millions of people through its ads for nearly a week in August. Those using adblockers will have been fine.

But, you know, tell people what they want to hear.
link to this extract

Start up: the Foodpanda takeaway scam, watch iOS 9 grow!, 2 billion lines of Google, and more

Posted on by
Reply


“Hi! You look like you want an (artificially) intelligent conversation!” Photo by RomitaGirl67 on Flickr.

You can now sign up to receive each day’s Start Up post by email. You’ll need to click a confirmation link, so no spam.

A selection of 9 links for you. May cause. I’m charlesarthur on Twitter. Observations and links welcome.

Mixpanel Trends » Mixpanel Mobile Analytics

The link is to the iOS 9 adoption curve from Mixpanel; it’s live, so when you click through it’ll be the latest figures. At the time of writing, three hours after iOS 9 went live, its adoption was at 3.2%, against 7.2% for “older than iOS 8” and 89.6% for iOS 8. (Apple’s own stats on September 14 were 87% iOS 8, 11% iOS 7, 2% earlier.)
link to this extract

The trouble with Foodpanda » Livemint

Ashish Mishra with a terrific tale of a much-funded startup which didn’t quite figure out that not everyone is honest:

Let’s say you are a restaurant. Now, place 10 orders using 10 names or even the same name, each for Rs.300. Every order is a takeaway. Pay online using the BOGO voucher, a campaign (Buy One Get One) run by Foodpanda. So for Rs.300, get Rs.300 free. So for a Rs.600 order, you paid only Rs.300. How much does Foodpanda have to return to you, the restaurant? Rs.600. After deducting 12% as its cut, Rs.528. How much did you make in the process? Rs.228 . Did you have to deliver that order? Nope. So, a straight profit of Rs.228.

Now, let’s say you processed 100 such orders a day. For a month. Total investment: Rs.9 lakh. Reimbursed by Foodpanda: Rs.15.84 lakh. Your total gain, by just processing fake orders: Rs.6.84 lakh.

Now imagine you are not the only restaurant on the platform doing this.

link to this extract

Issue 178139 – android – Android full lockscreen bypass – 5.1.1 PoC » Android Open Source Project

John Gordon at the University of Texas at Austin:

Android 5.1.1 Lockscreen Bypass
—–
Summary: Unlock a locked device to access the homescreen, run arbitrary applications, and enable full adb access to the device. This includes access to encrypted user data on encrypted devices.
Prerequisites: Must have a password lockscreen enabled. (PIN / swipe untested)
Hardware: Nexus 4
Software: Google factory image – occam 5.1.1 (LMY47V)

Attack details:
Pasting a sufficiently large string into an input field will cause portions of the lockscreen to become unresponsive and allow the user to terminate those processes. An attacker can construct a large string by typing characters into the Emergency Dialer, then select all + copy + paste repeatedly to increase the string size exponentially. Once the string has been pasted, either into the Emergency Dialer or the lockscreen password prompt, attempting to type more characters or performing other intaractions quickly and repeatedly causes the process to become overloaded and crash, or produce a dialog allowing the user to kill the process. If done in a password prompt in the foreground of the camera application, this crash results in the homescreen or Settings applcation being exposed.

PIN/swipe is untested, rather than safe (as far as we can see). This seems to be pretty hard to do – the video is 18 minutes long, involving lots of copy/pasting. It’s not really a giant flaw like Stagefright; and Apple has had some egregious lockscreen bypasses in the past. (Though none in iOS 8 that I’ve seen.) The problem though is that this doesn’t help Android’s reputation among businesses considering whether to buy it. It’s not the exploit; it’s the suggestion of vulnerability.
link to this extract

Popping the publishing bubble » Stratechery

Ben Thompson, in his weekly “free to view” article, says that iOS 9’s adblockers are just going to finish what was already happening:

It is easy to feel sorry for publishers: before the Internet most were swimming in money, and for the first few years online it looked like online publications with lower costs of production would be profitable as well. The problem, though, was the assumption that advertising money would always be there, resulting in a “build it and they will come” mentality that focused almost exclusively on content product and far too little on sustainable business models.

In fact, publishers going forward need to have the exact opposite attitude of publishers in the past: instead of focusing on journalism and getting the business model for free, publishers need to start with a sustainable business model and focus on journalism that works hand-in-hand with the business model they have chosen. First and foremost that means publishers need to answer the most fundamental question required of any enterprise: are they a niche or scale business?

• Niche businesses make money by maximizing revenue per user on a (relatively) small user base
• Scale businesses make money by maximizing the number of users they reach
The truth is most publications are trying to do a little bit of everything: gain more revenue per user here, reach more users over there.

Worth it for the illustrations. You should subscribe so he can afford an iPad Pro and a stylus.
link to this extract

Google is 2 billion lines of code — and it’s all in one place » WIRED

Cade Metz:

Google has built its own “version control system” for juggling all this code. The system is called Piper, and it runs across the vast online infrastructure Google has built to run all its online services. According to [Google’s head of… big stuff? Rachel] Potvin, the system spans 10 different Google data centers.

It’s not just that all 2 billion lines of code sit inside a single system available to just about every engineer inside the company. It’s that this system gives Google engineers an unusual freedom to use and combine code from across myriad projects. “When you start a new project,” Potvin tells WIRED, “you have a wealth of libraries already available to you. Almost everything has already been done.” What’s more, engineers can make a single code change and instantly deploy it across all Google services. In updating one thing, they can update everything.

There are limitations this system. Potvin says certain highly sensitive code—stuff akin to the Google’s PageRank search algorithm—resides in separate repositories only available to specific employees. And because they don’t run on the ‘net and are very different things, Google stores code for its two device operating systems — Android and Chrome — on separate version control systems. But for the most part, Google code is a monolith that allows for the free flow of software building blocks, ideas, and solutions.

The point about Android and Chrome being on separate version control systems is one to note. Can’t merge the code until those two come together.
link to this extract

IPv6 will get a big boost from iOS 9, Facebook says » Computerworld

Stephen Lawson:

Even when all the pieces are in place for IPv6, iOS 8 makes an IPv6 connection only about half the time or less because of the way it treats the new protocol. With iOS 9, and IPv6 connection will happen 99% of the time, Saab predicts. 

IPv4 is running out of unused Internet addresses, while IPv6 is expected to have more than enough for all uses long into the future. Adoption has been slow since its completion in 1998 but is starting to accelerate. The release of iOS 9 may give a big boost to that trend. 

“Immediately, starting on the 16th, I’m expecting to see a lot more v6 traffic show up,” said Samir Vaidya, director of device technology at Verizon Wireless. About 50% of Verizon Wireless traffic uses IPv6, and Vaidya thinks it may be 70% by this time next year as subscribers flock to the iPhone 6s. 

Apple’s change should help drive more IPv6 use on Comcast’s network, too. About 25% of its traffic uses the new protocol now, and that figure could rise above 50% by early next year, said John Brzozowski, Comcast Cable’s chief IPv6 architect. 

This is the point, again and again. Android has the installed base; but iOS adoption is so rapid that it can drive change almost immediately.
link to this extract

Barbie wants to get to know your child » The New York Times

James Vlahos:

Hello Barbie is by far the most advanced to date in a new generation of A.I. toys whose makers share the aspiration of Geppetto: to persuade children that their toys are alive — or, at any rate, are something more than inanimate. At Ariana’s product-testing session, which took place in May at Mattel’s Imagination Center in El Segundo, Calif., near Los Angeles, Barbie asked her whether she would like to do randomly selected jobs, like being a scuba instructor or a hot-air-balloon pilot. Then they played a goofy chef game, in which Ariana told a mixed-up Barbie which ingredients went with which recipes — pepperoni with the pizza, marshmallows with the s’mores. ‘‘It’s really fun to cook with you,’’ Ariana said.

At one point, Barbie’s voice got serious. ‘‘I was wondering if I could get your advice on something,’’ Barbie asked. The doll explained that she and her friend Teresa had argued and weren’t speaking. ‘‘I really miss her, but I don’t know what to say to her now,’’ Barbie said. ‘‘What should I do?’’

‘‘Say ‘I’m sorry,’ ’’ Ariana replied.

‘‘You’re right. I should apologize,’’ Barbie said. ‘‘I’m not mad anymore. I just want to be friends again.’’

We now return you to our regular scheduled programming of “Philip K Dick short stories brought to life.” Take your pick: War Game, Second Variety or The Days of Perky Pat?
link to this extract

One great reason to update to iOS 9 – a nasty silent AirDrop attack is in town » Forbes

Australian researcher Mark Dowd, who heads up Azimuth Security, told FORBES ahead of Apple’s iOS 9 release on Wednesday that the flaw allowed anyone within range of an AirDrop user to install malware on a target device and tweak iOS settings so the exploit would still work if the victim rejected an incoming AirDrop file, as seen in the video below.

Users should update to iOS 9 and Mac OS X El Capitan, version 10.11, as soon as possible to avoid losing control of their phones and PCs to malware. Any iOS versions that support AirDrop, from iOS 7 onwards, are affected, as are Mac OS X versions from Yosemite onwards. There are few protections outside of upgrading, other than turning AirDrop off altogether. The service is off by default, though it’s possible to start it running from the lockscreen.

By carrying out what’s known as a “directory traversal attack”, where a hacker enters sections of the operating system they should not be able to access, Dowd found it was possible to exploit AirDrop and then alter configuration files to ensure iOS would accept any software signed with an Apple enterprise certificate. Those certificates are typically used by businesses to install software not hosted in the App Store and are supposed to guarantee trust in the provenance of the application. But, as FORBES found in a recent investigation into the Chinese iPhone jailbreaking industry, they’re often used to bypass Apple security protections.

I dunno, getting AirDrop to work is usually the biggest challenge I face. (The mitigation is pretty easy on any version – turn off Wi-Fi or Bluetooth, or turn Airdrop to accept files from Contacts Only or off; this leaves Wi-Fi and Bluetooth untouched.)
link to this extract

Google taken to court to uncloak ebook pirates » TorrentFreak

Early June, GAU [the Dutch trade organisation representing dozens of book publishers in the Netherlands] reported that Google appeared to be taking steps to prevent rogue sellers from offering illegal content via its Play store. The group also noted that BREIN was attempting to obtain the personal details of the ‘pirate’ seller from Google.

Unsurprisingly that wasn’t a straightforward exercise, with Google refusing to hand over the personal details of its user on a voluntary basis. If BREIN really wanted the seller’s identity it would have to obtain it via a court order. Yesterday the anti-piracy group began the process to do just that.

Appearing before the Court of The Hague, BREIN presented its case, arguing that the rogue seller was not merely a user of Google, but actually a commercial partner of Google Play, a partnership that earned revenue for both parties.

“The case is clear,” BREIN said in a statement.

“There was infringement carried out by an anonymous seller that was actually a commercial ‘partner’ of Google via Google Play. This is how Google refers to sellers in its own terms of use.”

BREIN says that ultimately Google is responsible for the unauthorized distribution and sales carried out via its service.

“There is no right to anonymously sell illegal stuff, not even on Google Play while Google earns money,” the anti-piracy group concludes.

In the UK I think this would be a fairly straightforward “Norwich Pharmacal” case. Wonder if Holland has anything comparable.
link to this extract