Get HideMyAss! VPN, PC Mag's Top 10 VPNs of 2016 for 55% off for a Limited Time ×
Security

Famed Security Researcher 'Mudge' Creates New Algorithm For Measuring Code Security (theintercept.com) 31

Peiter "Mudge" Zatko and his wife, Sarah, a former NSA mathematician, have started a nonprofit in the basement of their home "for testing and scoring the security of software... He says vendors are going to hate it." Slashdot reader mspohr shares an article from The Intercept: "Things like address space layout randomization [ASLR] and having a nonexecutable stack and heap and stuff like that, those are all determined by how you compiled [the source code]," says Sarah. "Those are the technologies that are really the equivalent of airbags or anti-lock brakes [in cars]..." The lab's initial research has found that Microsoft's Office suite for OS X, for example, is missing fundamental security settings because the company is using a decade-old development environment to build it, despite using a modern and secure one to build its own operating system, Mudge says. Industrial control system software, used in critical infrastructure environments like power plants and water treatment facilities, is also primarily compiled on "ancient compilers" that either don't have modern protective measures or don't have them turned on by default...

The process they use to evaluate software allows them to easily compare and contrast similar programs. Looking at three browsers, for example -- Chrome, Safari, and Firefox -- Chrome came out on top, with Firefox on the bottom. Google's Chrome developers not only used a modern build environment and enabled all the default security settings they could, Mudge says, they went "above and beyond in making things even more robust." Firefox, by contrast, "had turned off [ASLR], one of the fundamental safety features in their compilation."

The nonprofit was funded with $600,000 in funding from DARPA, the Ford Foundation, and Consumers Union, and also looks at the number of external libraries called, the number of branches in a program and the presence of high-complexity algorithms.
The Gimp

After New GIMP Release, Core Developer Discusses Future of GIMP and GEGL (girinstud.io) 50

GIMP 2.9.4 was released earlier this month, featuring "symmetry painting" and the ability to remove holes when selecting a region, as well as improvements to many of its other graphics-editing tools. But today core developer Jehan Pages discussed the vision for GIMP's future, writing that the Generic Graphics (GEGL) programming library "is a hell of a cool project and I think it could be the future of Free and Open Source image processing": I want to imagine a future where most big graphics programs integrate GEGL, where Blender for instance would have GEGL as the new implementation of nodes, with image processing graphs which can be exchanged between programs, where darktable would share buffers with GIMP so that images can be edited in one program and updated in real time in the other, and so on. Well of course the short/mid-term improvements will be non-destructive editing with live preview on high bit depth images, and that's already awesomely cool right...?

[C]ontributing to Free Software is not just adding any random feature, that's also about discussing, discovering others' workflow, comparing, sometimes even compromising or realizing that our ideas are not always perfect. This is part of the process and actually a pretty good mental builder. In any case we will work hard for a better GIMP

Communications

Snowden Questions WikiLeaks' Methods of Releasing Leaks (pcworld.com) 160

An anonymous reader quotes a report from PCWorld: Former U.S. National Security Agency contractor, Edward Snowden, has censured WikiLeaks' release of information without proper curation. On Thursday, Snowden, who has embarrassed the U.S. government with revelations of widespread NSA surveillance, said that WikiLeaks was mistaken in not at least modestly curating the information it releases. "Democratizing information has never been more vital, and @Wikileaks has helped. But their hostility to even modest curation is a mistake," Snowden said in a tweet. WikiLeaks shot back at Snowden that "opportunism won't earn you a pardon from Clinton [and] curation is not censorship of ruling party cash flows." The whistleblowing site appeared to defend itself earlier on Thursday while referring to its "accuracy policy." In a Twitter message it said that it does "not tamper with the evidentiary value of important historical archives." WikiLeaks released nearly 20,000 previously unseen DNC emails last week, which suggest that committee officials had favored Clinton over her rival Senator Bernie Sanders. The most recent leak consists of 29 voicemails from DNC officials.
Robotics

US Military Using $600K 'Drone Buggies' To Patrol Camps In Africa (cnbc.com) 59

An anonymous reader quotes a report from CNBC: The U.S. military is using an unmanned robotic vehicle to patrol around its camps in the Horn of Africa. The remote controlled vehicle is the result of a 30-year plan after military chiefs approved the concept of a robotic security system in 1985. Now the Mobile Detection Assessment and Response System, known as MDARS, are carrying out patrols in the east African country of Djibouti, under the control of the Combined Joint Task Force-Horn of Africa. The area is known as home to a number of hostile militant groups including the al-Qaeda-affiliated al-Shabaab. An operator sits in a remote location away from the vehicle watching the terrain via a camera link which is fixed to the chassis. U.S. military software engineer Joshua Kordanai said in a video presentation that the vehicle drives itself, freeing the remote operator to monitor video. "The vehicle has an intruder detection payload, consisting of radar, a night vision camera, a PTZ [pan-tilt-zoom] camera and two-way audio, so the system will be able to detect motion," he added. One report prices the cost of an earlier version of the military 'drone buggy' at $600,000 each.
Security

WhatsApp Isn't Fully Deleting Its 'Deleted' Chats (theverge.com) 60

Facebook-owned messaging app WhatsApp retains and stores chat logs even after those messages have been deleted, according to iOS researcher Jonathan Zdziarski. The Verge reports: Examining disk images taken from the most recent version of the app, Zdziarski found that the software retains and stores a forensic trace of the chat logs even after the chats have been deleted, creating a potential treasure trove of information for anyone with physical access to the device. The same data could also be recoverable through any remote backup systems in place. In most cases, the data is marked as deleted by the app itself -- but because it has not been overwritten, it is still recoverable through forensic tools. Zdziarski attributed the problem to the SQLite library used in coding the app, which does not overwrite by default. WhatsApp was applauded by many privacy advocates for switching to default end-to-end encryption through the Signal protocol, a process that completed this April. But that system only protects data in transit, preventing carriers and other intermediaries from spying on conversations as they travel across the network.
Television

The Mojave Desert: Home of the New Machine Movement (bloomberg.com) 47

pacopico writes: Most people think of the Mojave Desert as a wasteland located somewhere between Los Angeles and Las Vegas. For decades, though, Mojave has served as something of an engineering playground for people in the automotive and aerospace industries. Bloomberg has produced a documentary that looks at what's taking place with these engineers in 2016. There's a dude trying to make a flying car, Richard Branson with Virgin Galactic, a group called Hackrod using artificial intelligence software to make a car chassis, and the hacker George Hotz taking his self-driving car along the Las Vegas strip for the first time. One of the cooler parts of the show has a team of students from UCSD sending up a rocket with a 3D printed engine -- the first time any university team had pulled something like this off. Overall, it's a cool look at the strange desert rat tinkerers.
The Courts

UK Judge Calls For An Online Court Without Lawyers To Cut Costs 96

mi writes from a report via The Times: A senior judge has called for the establishment of an online court (Warning: source may be paywalled) that does not have lawyers and can deal with claims of up to 25,000 British Pound (around $32,850). The proposal is the centerpiece of a package of reforms to the civil justice system, drawn up by Lord Justice Briggs, a Court of Appeal judge. Just how exactly will this court ensure no one is, in fact, a trained professional on the internet, where no one knows who you really are, is not explained. We discussed the idea last year. Apparently, it is still alive. The judge's report says this computer court would provide "effective access to justice without having to incur the disproportionate cost of using lawyers." The Law Gazette reported earlier in June that Briggs has mused about a three-stage process -- triage, conciliation and final judgement -- in which there might be some lawyer involvement.
Businesses

Microsoft To Lay Off Another 2,850 People In the Next 12 Months (businessinsider.com) 160

An anonymous reader writes from a report via Business Insider: Microsoft is planning to lay off 2,850 more employees in the next 12 months or so, according to Microsoft's full 10-K report it filed with the Securities and Exchange Commission. Part of the document reads: "In addition to the elimination of 1,850 positions that were announced in May 2016, approximately 2,850 roles globally will be reduced during the year as an extension of the earlier plan, and these actions are expected to be completed by the end of fiscal year 2017." Business Insider reports: "The first 1,850 layoffs mentioned here were mainly from Microsoft's struggling smartphone business, including 1,350 employees in Finland working at what was once Nokia world headquarters. These layoffs also included people in Microsoft's salesforce, which was recently reorganized and saw the departure of COO Kevin Turner. In total, Microsoft laid off 7,400 employees in its last fiscal year, which ended on June 30th, 2016. The new layoffs are a continuation of the same plan, and include the sales group as well as others. About 900 people affected by the new layoffs were already informed during the sales reorganization, according to a person familiar with Microsoft's plans."
IT

The End of Gmane? (ingebrigtsen.no) 39

If any of you use mailing list archive Gmane, you would want to start looking at its alternative. Gmane developer Lars Ingebrigtsen announced Thursday that he is thinking about ending the decade-old email-to-news gateway. But first, for those unaware about Gmane, here's is what it does: It allows users to access electronic mailing lists as if they were Usenet newsgroups, and also through a variety of web interfaces. Gmane is an archive; it never expires messages (unless explicitly requested by users). Gmane also supports importing list postings made prior to a list's inclusion on the service.Ingebrigtsen said Gmane machines are under numerous DDoS attacks -- coupled with some other issues -- that have made him wonder whether it is worth the time and effort to keep Gmane ticking. He writes: I'm thinking about ending Gmane, at least as a web site. Perhaps continue running the SMTP-to-NNTP bridge? Perhaps not? I don't want to make 20-30K mailing lists start having bouncing addresses, but I could just funnel all incoming mail to /dev/null, I guess... The nice thing about a mailing list archive (with NNTP and HTTP interfaces) is that it enables software maintainers to say (whenever somebody suggests using Spiffy Collaboration Tool of the Month instead of yucky mailing lists) is "well, just read the stuff on Gmane, then". I feel like I'm letting down a generation here.As Gmane's future remains uncertain, Ingebrigtsen recommends people to have a look at Mail Archive.
Cloud

Oracle To Buy Cloud-Software Provider NetSuite For $9.3 Billion (bloomberg.com) 32

Oracle announced Thursday that it has agreed to buy NetSuite for $9.3 billion, in a move to bolster its cloud-computing offerings as it races to catch up to rivals. Both companies provide applications for running a business called enterprise-resource-planning software. Bloomberg reports: Oracle, which sells software to big corporations, has been trying to shift more sales to cloud-based products increasingly demanded by its customers. New cloud services made up about 8 percent of the company's total sales during its fiscal fourth-quarter. Buying NetSuite -- whose products include customer relationship management software -- will help Oracle compete against the likes of Salesforce.com Inc. and Microsoft Corp. "Oracle and NetSuite cloud applications are complementary, and will coexist in the marketplace forever," said Oracle co-Chief Executive Officer Mark Hurd in a statement Thursday. "We intend to invest heavily in both products -- engineering and distribution."
Crime

Tor Project Confirms Sexual Misconduct By Developer Jacob Appelbaum (theverge.com) 406

An anonymous reader quotes a report from The Verge: The Tor Project, a nonprofit known for its online anonymity software, says it has verified claims that former employee Jacob Appelbaum engaged in "sexually aggressive behavior" with people inside and outside of its organization. "We have confirmed that the events did take place as reported," Shari Steele, Tor's executive director, tells The Verge. In a blog post today, Steele says that Tor began an investigation into Appelbaum's behavior after several people came forward with allegations of misconduct in late May. In a statement made in June, he said the allegations were "entirely false." He resigned from the Tor Project in May. "I want to thank all the people who broke the silence around Jacob's behavior," Steele writes. "It is because of you that this issue has now been addressed. I am grateful you spoke up, and I acknowledge and appreciate your courage." Steele says that Tor is now implementing a new anti-harassment policy, as well as a process for submitting complaints and having them reviewed. The changes will be put in place this week. Tor also announced last month that it would replace its entire board of directors.
Businesses

Tesla and Autopilot Supplier Mobileye Split Up After Fatal Crash (usatoday.com) 127

An anonymous reader quotes a report from USA Today: Tesla and Mobileye, one of the top suppliers to its Autopilot partial self-driving system, are parting ways in the wake of the May accident that killed an owner of one of its electric Model S sedans. Mobileye is considered a leader in developing the equipment that will be needed for fully self-driving cars. The Israeli tech company will continue to support and maintain current Tesla products, including upgrades that should help the Autopilot system with crash avoidance and to better allow the car to steer itself, said Chairman Amnon Shashua in releasing the company's second-quarter earnings Tuesday. Shashua said moving cars to higher levels of self-driving capability "is a paradigm shift both in terms of function complexity and the need to ensure an extremely high level of safety." He added there is "much at stake" in terms of Mobileye's reputation, and that it is best to end the relationship with Tesla by the end of the year. Tesla CEO Elon Musk, meeting with reporters at the company's new battery Gigafactory outside Reno, indicated that Tesla can go forward without Mobileye. "Us parting ways was somewhat inevitable. There's nothing unexpected here from our standpoint," Musk said. "We're committed to autonomy. They'll go their way, and we'll go ours."
Cloud

Office 365 Gets New Word, PowerPoint and Outlook Features (networkworld.com) 98

New submitter Miche67 writes: As part of the July 2016 update to Office 365, Microsoft is adding several features across the board to Word, PowerPoint and Outlook. Word, however, is getting the biggest new features -- Researcher and Editor -- to improve your writing. "As its name implies, Researcher is designed to help the user find reliable sources of information by using the Bing Knowledge Graph to search for sources, and it will properly cite them in the Word document," reports Network World. "[Editor] builds on the already-existing spellchecker and thesaurus to offer suggestions on how to improve your overall writing. In addition to the wavy red line under a misspelled word and the wavy blue line under bad grammar, there will be a gold line for writing style." The new features are expected to be available later this year. In addition to the two new features added to PowerPoint last year -- Designer and Morph, Microsoft is offering Zoom, a feature that lets you easily create "interactive, non-linear presentations." "Instead of the 1-2-3-4 linear method of presenting slides, forcing you to place them all in the order you wish to display, presenters will be able to show their slides in any order they want at any time," reports Network World. "This way you can change your presentation order as needed without having to stop PowerPoint or interrupt the display." As for Outlook, Focused Inbox is coming to Office 365. Focused Inbox separates your inbox into two tabs. The "Focused" tab is where all of your high-priority emails will be found, while everything else will be in the "Other" tab. Outlook will learn from your behavior over time and sort your mail accordingly. In addition, @mentions are coming to Outlook 365 and Outlook for PC and Mac, "making it easy to identify emails that need your attention, as well as flag actions for others."
Java

C Top Programming Language For 2016, Finds IEEE's Study (ieee.org) 308

IEEE Spectrum, a highly regarded magazine edited by the Institute of Electrical and Electronics Engineers, has released its annual programming languages list, sharing with the world how several languages fared against each other. To assess the languages the publication says it worked with a data journalist and looked into 10 online sources -- including social chatter, open-source code production, and job postings. The publication has rated C as the top programming language this year, followed by Java, Python, C++, and R. From their article:After two years in second place, C has finally edged out Java for the top spot. Staying in the top five, Python has swapped places with C++ to take the No. 3 position, and C# has fallen out of the top five to be replaced with R. R is following its momentum from previous years, as part of a positive trend in general for modern big-data languages that Diakopoulos analyses in more detail here. Google and Apple are also making their presence felt, with Google's Go just beating out Apple's Swift for inclusion in the Top Ten. Still, Swift's rise is impressive, as it's jumped five positions to 11th place since last year, when it first entered the rankings. Several other languages also debuted last year, a marked difference from this year, with no new languages entering the rankings.The publication has explained in detail the different metrics it uses to evaluate a language.
Software

Tesla Model S In Fatal Autopilot Crash Was Going 74 MPH In a 65 Zone, NTSB Says (latimes.com) 603

An anonymous reader quotes a report from Los Angeles Times: The Tesla car involved in a fatal crash in Florida this spring was in Autopilot mode and going about 10 miles faster than the speed limit, according to safety regulators, who also released a picture of the mangled vehicle. Earlier reports had stated the Tesla Model S struck a big rig while traveling on a divided highway in central Florida, and speculated that the Tesla Autopilot system had failed to intervene in time to prevent the collision. The National Transportation Safety Board released a preliminary report Tuesday that confirms some details of the May 7 collision, along with a photo that shows the car with its windshield flattened and most of its roof sheared off. The federal agency also included a photo of the big rig, circling an area on the right side of the tractor-trailer that showed the light damage the truck received from the collision. The 2015 Model S was moving at 74 mph, above the posted 65 mph speed limit, when it struck a 53-foot trailer being pulled by a Freightliner Cascadia truck. Tesla's semi-autonomous Autopilot driving feature was engaged, the report says.
Facebook

Facebook Open Sources 360 Surround Camera With Ikea-Style Instructions (techcrunch.com) 31

Reader joshtops writes: Facebook needs you to fill its News Feed, Oculus Rift, and Gear VR with 360 content. So today it put all the hardware and software designs of its Surround 360 camera on Github after announcing the plan in April. Thanks to cheeky instruction manual inspired by Ikea's manuals, you can learn how to buy the parts, assemble the camera, load the image-stitching software, and start shooting 360 content. Essentially 17 cameras on a UFO-looking stick, the 360 Surround camera can be built for about $30,000 in parts. The 4-megapixel lenses can shoot 4K, 6K, or 8K 360 video, and fisheye lenses on the top and bottom remove the blindspots. Facebook forced a random engineer to try to build the 360 Surround from the open source instructions, and found it took about four hours.FastCompany has more details.
Android

Motorola Confirms That It Will Not Commit To Monthly Security Patches (arstechnica.com) 162

If you are planning to purchase the Moto Z or a Moto G4 smartphone, be prepared to not see security updates rolling out to your phone every month -- and in a timely fashion. After Ars Technica called out Motorola's security policy as "unacceptable" and "insecure," in a recent review, the company tried to handle the PR disaster, but later folded. In a statement to the publication, the company said: Motorola understands that keeping phones up to date with Android security patches is important to our customers. We strive to push security patches as quickly as possible. However, because of the amount of testing and approvals that are necessary to deploy them, it's difficult to do this on a monthly basis for all our devices. It is often most efficient for us to bundle security updates in a scheduled Maintenance Release (MR) or OS upgrade. As we previously stated, Moto Z Droid Edition will receive Android Security Bulletins. Moto G4 will also receive them.Monthy security updates -- or the lack thereof -- remains one of the concerning issues that plagues the vast majority of Android devices. Unless it's a high-end smartphone, it is often rare to see the smartphone OEM keep the device's software updated for more than a year. Even with a flagship phone, the software update -- and corresponding security patches -- are typically guaranteed for only 18 to 24 months. Reports suggest that Google has been taking this issue seriously, and at some point, it was considering publicly shaming its partners that didn't roll out security updates to their respective devices fast enough.
Blackberry

BlackBerry Says Its New Android Smartphone DTEK 50 Is the 'World's Most Secure' (theverge.com) 94

BlackBerry, which once assumed the tentpole position in the mobile market, announced on Tuesday the BlackBerry DTEK 50, its second smartphone powered by Google's Android operating system. The Canadean company is marketing the DTEK as the 'world's most secure' phone. It is priced at $300, and will go on sale in select markets on August 8. The Verge adds:The DTEK50 has a 5.2-inch, 1080p display, Qualcomm Snapdragon 617 processor, 3GB RAM, 13-megapixel camera, and 2,610mAh battery. The 8-megapixel front camera also includes a flash for taking selfies. It runs Android 6.0 Marshmallow with BlackBerry's software features, such as the Hub. The software is similar to the software on the Priv released last year. The security features are highlighted right in the device's name, as it has BlackBerry's DTEK software that protects users from malware and other security problems often seen on Android smartphones. The DTEK app lets users quickly get an overview of their device's security and take action on any potential issues. BlackBerry says that it has modified Android with its own technology originally developed for the BB10 platform to make it more secure. The company is also committing to rapid updates to deliver security patches shortly after they are released.
Microsoft

Steam On Windows 10 Will Get 'Progressively Worse': Gears of War Developer (ndtv.com) 410

Microsoft's Universal Windows Platform, or UWP, approach isn't sitting well with many game developers. Four months after criticising UWP ecosystem for being a walled-garden, curtailing "users' freedom to install full-featured PC software, and subverting the rights of developers and publishers to maintain a direct relationship with their customers," Tim Sweeney, co-founder of Epic Games, the studio behind the Gears of War and Unreal franchises has once again lashed out at the Redmond-based company. He alleges that Microsoft plans to make Steam -- the world's largest PC gaming platform, "progressively worse and more broken." in a move to bolster people's reliance on the Windows Store. From a Gadgets 360 report: "Slowly, over the next five years, they will force-patch Windows 10 to make Steam progressively worse and more broken. They'll never completely break it, but will continue to break it until, in five years, people are so fed up that Steam is buggy that the Windows Store seem like an ideal alternative. That's exactly what they did to their previous competitors in other areas. Now they're doing it to Steam. It's only just starting to become visible. Microsoft might not be competent enough to succeed with their plan but they are certainly trying," Sweeney said. He adds the outcome of this would be forcing every app and game to be sold through the Windows Store alone. "If they can succeed in doing that then it's a small leap to forcing all apps and games to be distributed through the Windows store. Once we reach that point, the PC has become a closed platform. It won't be that one day they flip a switch that will break your Steam library -- what they're trying to do is a series of sneaky manoeuvres. They make it more and more inconvenient to use the old apps, and, simultaneously, they try to become the only source for the new ones," he claims.
Earth

Feds To Deploy Anti-Drone Software Near Wildfires (thehill.com) 170

An anonymous reader quotes a report from The Hill: Federal officials are launching a new "geofencing" program to alert drone pilots when they're flying too close to wildfire prevention operations. The Department of Interior said Monday it would deploy software warnings to pilots when their drones pose a risk to the aircraft used by emergency responders fighting wildfires. The agency said there have been 15 instances of drones interfering with firefighter operations this year, including several leading to grounded aircraft. Drone-related incidents doubled between 2014 and 2015, the agency said. Officials built the new warning system with the drone industry, and the agency said manufacturers could eventually use it to build drones that automatically steer away from wildfire locations. The program is in its pilot phase, the agency said; officials hope to have a full public release in time for next year's wildfire season. "No responsible drone operator wants to endanger the lives of the men and women who work to protect them and we believe this program, which uses the global positioning system to create a virtual barrier, will move us one step closer to eliminating this problem for wildfire managers," Mark Bathrick, the director of the Interior Department's Office of Aviation Service, said in a statement.

Slashdot Top Deals