Posts by doublelayer

Apple's privacy schtick is just an act, say folks suing the iGiant: iTunes 'purchase histories sold' to data slurpers

Re: Pandora not Apple.

"Android also has granular control for permissions. if you compare them, Android's are actually better, in particular, location fine/coarse and independent reading and writing storage."

I'm very unhappy to here this news about Apple, but I don't think I can call Android's attempt at security controls good. For one thing, these controls only started having an effect in relatively recent builds of the operating system, as they were previously just a warning at install time. Furthermore, it is relatively difficult to deny access to specific information. Applications can request certain permissions, like "read phone state" and some others, that give lots of access to many things. IOS's policy of not letting apps interact with the file systems of other apps let alone the OS may be limiting in some cases, but prevents one of the more annoying kinds of malware frequently seen on Android. In addition, we have the difficulty in disabling things for built-in applications on Android, whereas IOS includes a full list of apps (both user-installed and stock) and system services for which access can be controlled. Finally, the permissions available to android apps often allow them to take actions normally associated with subverting the user's intent; for example, the permission to use bluetooth also allows an app on android to turn it back on if the user has disabled it, whereas the master bluetooth switch on IOS preempts an application that has been granted bluetooth rights.

Mozilla returns crypto-signed website packaging spec to sender – yes, it's Google

How often

The rest of these comments cover the very real security implications of this. I agree on all of that. However, I also need to ask another important question: when would this actually be of much use?

We no longer use the internet of the 1990s, where everyone saw the same page, the pages didn't change frequently, and network bandwidth was limited. Nearly every site and page online falls into one of these categories, none of which would benefit from this at all:

1. Sites with user-specific content, requiring direct contact with the server. Webmail, anything with a login page, etc. falls under this. Obviously, nobody gets an advantage if this is cached, and for privacy and security, this would have to be encrypted from server to device.

2. Sites with very dynamic content, requiring that visitors receive up-to-date versions of the page. Yes, for some sites, you could get a bit of cache benefit by having a small time, perhaps five minutes, of caching. That only works if the site gets accessed by a lot of people and the site only changes every once in a while. News sites might work this way. But many other sites update more frequently than that.

3. Sites that offer small pages. When a site infrequently updates, the pages from that site are often very small, so there isn't much downside to a direct connection.

4. Sites that are rare. Many other sites will be accessed so rarely that, by the time someone else wants a page, either the cache has evicted the copy, or the copy has expired.

We need a page that updates relatively infrequently, has no user-specific content, no private content, is accessed by a bunch of people who all want a small enough set of pages that the cache keeps them, and has large enough files that the cache provides a real benefit. The only one like this that comes to mind is Wikipedia. Of course, you could always save some pages yourself or keep the whole thing offline. Any other sites that come to mind?

'Evolution of the PC ecosystem'? Microsoft's 'modern' OS reminds us of the Windows RT days

Re: The future is called Powerpoint

The major problem I've seen frequently with the attempts to sandbox applications is where they put files and what they do with them. For many use cases, a user will open a file in one application, do something to it, open it in another application, do something else to it, and bring it back up in the first application. Many sandboxing attempts make that a lot harder by storing the file inside the working directory of the first application and making one specifically export it, assuming it even has that option in a usable way. Sandboxing of this type is usually manageable on phones, where it is most visible, because few people do much complex editing on a phone across multiple applications, but trying that on a computer will get in the way of many. I hope Microsoft doesn't try it; if they do, it will fail.

That's a hell of Huawei to run a business, Chinese giant scolds FedEx after internal files routed via America

Re: SD Card

I was hoping they'd forget about that, because the last thing we need is another competing storage card format when we almost had a standard that everyone uses. I guess that's a lost cause now. Do you think the SD people would take this as a convincing argument to let Huawei back in? I'm willing to sign it and send it to their headquarters in California, and it shouldn't take that long to bounce there from Memphis.

Re: "Inadvertently misrouted." Wow, that's what I call a spectacular display of contempt.

I'm not buying the "inadvertence" either, but they do manage to inadvertently misdirect other packages (not them specifically, just the general class of package delivery companies) often enough that they've probably had this statement sitting on a shelf for a while.

It's all in the RISC: Arm legs it to Computex with a head full of Cortex-A77 CPU, Mali-G77 GPUs

As I understand it, it can only use one of these cores, but would run. However, if it didn't run, you could have a full Linux kernel spin up just to virtualize it and still wouldn't realize it. It's sometimes a bit amazing to think how old software's requirements compare to available technology today.

It's the curious case of the vanishing iPhone sales as Huawei grabs second place off Apple in smartmobe stakes

Re: They can test all they want

I'm wondering whether this is actually just AOSP with their layer on top, for the simple reason that the app market has made it pretty clear that they're not going to start writing for another mobile platform what with the failures of Windows Phone, Firefox OS, and Ubuntu Touch, all of which had some buy-in from a few hardware manufacturers. I could see Huawei spending a bit longer reimplementing some compatibility with Google Play Services because they know a lot of apps will refuse to run otherwise, so that might explain it. It could also be a project run by a small team as a just-in-case, so not a major priority with many devs until it really became important.

Re: Yes this is their Hongmeng OS

I would actually be more likely to assume a startup would do this properly, for the simple reason that most startups have fewer types of devices and use cases that need to work properly. I do not have any confidence in Huawei's ability to replace android with something else on devices in the field without requiring extra assistance from users. They will need to deal with users who have very little internal memory free, users who have made unusual system modifications, users who have replaced parts of the hardware (cracked screens, etc.), devices running on 2, 3, and 4G cell networks all over the world, and running in some cases firmware developed specially for specific mobile providers to lock them to that provider and to interact with providers' systems. These from the same people who forgot to turn off telnet for their routers (it wasn't an intentional backdoor, probably not at least, but it was a pretty bad mistake). No confidence at all. However, I also would not have confidence in any manufacturer who tried this, not Samsung, not Google, not Apple, not anybody. It's too large a change to go perfectly, at least in my experience, and I don't see any reason to believe that Huawei has a special method of escaping that.

Re: Yes this is their Hongmeng OS

They might have done that. Microsoft might have tested the 1809 build of Windows on lots of models, preventing the driver blue screens. Router manufacturers might have security tested their basic firmware, having fewer vulnerabilities. Samsung might have put some of their Galaxy Folds into the field before sending them to reviewers, catching the easily damaged mechanisms. Samsung might also have put their Galaxy Note 7s into more vigorous testing, catching the exploding batteries.

Just because a company is big, that doesn't mean they will be perfect. Huawei doesn't have a reputation as some technogenious which always knows what is going on and produces flawless products. If they did, your defense of them based on nothing might have some logic. In reality, they're a normal tech company that has its history of making mistakes and being generally fine. Saying that they might have some trouble trying to update a billion devices in the field to something that might be an entire replacement of the operating system is a very sensible worry, born out by the experience of trouble that happened every other time such a massive change was attempted.

Re: Marketing

No on all counts.

"So I can buy the one phone that I'm sure the US/UK government don't have backdoors to?"

You can't be sure of that. Nobody really knows to what extent if at all there is a backdoor running on current phones. Huawei might harbor one just as well as any other manufacturer. If the backdoor you've supposed into existence was part of Android, perhaps inside Google's blobs, it would apply to all Android phones including those from Huawei. If you're concerned enough that the U.S. and U.K. have backdoored phones, you should at least give thought to other countries, like, just to pick a name at random, the People's Republic of China having one too.

"With an open source OS and alternatives to the Google spyware?"

You've supposed the open source into existence too? Can I suppose things about these devices and that will just happen? They'll have a magic chip inside them that emits a new type of radio frequency that cures cancer. You have no basis for that. While Google's spyware will be gone, plenty of Huawei and partner's spyware will have replaced it. If you want open, get open, such as Lineage OS with FDroid apps on it. Do not expect a company to ride in as a savior; it isn't going to happen.

"And it has the same premium hardware as Apple/Samsung but costs half as much"

It has different premium hardware, and it costs the same. Their flagships are also ludicrously overpriced. They have cheaper models, and just like those from every mid-range and low-range manufacturer, they are just fine and will work for lots of people, but do not have the latest and greatest components. If you want latest and greatest at a lower pricepoint, choose a company like Xiaomi or the Oppo brand who do not have a ridiculously-expensive lineup and are better at charging a price commensurate with performance.

I've seen several of these comments recently. Just because you don't like the action of the U.S. government, that doesn't make the company harmed by that action into the best thing on Earth. I am inclined to agree that the restrictions placed on them don't make sense from the stated security benefit and are a purely political stunt for the purposes of a continued trade war. I think that, as such, they should be reversed. That doesn't make Huawei a wonderful company that is out to make my life great and is being repressed by someone who wants to keep the underdog down. The goal of this is money, not a backdoor. It's shortsighted to assign good and evil tags out without considering the large area in the middle where these things reside.

Activist shareholders to target Zuck with giant angry emoji inflatable at Facebook AGM

Re: Separate CEO and Board Chair

It does make a lot of sense and that's why most companies do it. However, a company that is run by one person with all the power, while frequently inefficient or actively mismanaged, isn't the same as a dictatorship. The power over a corporation is based on how much of it, or in this case, its voting shares, a person owns. Even if he left as CEO, he would still be able to dictate policy by choosing another CEO and telling them what to do. This is entirely legal if inadvisable.

Re: Who?

In this case, the stake in the sense of how much power can be wielded is exactly the same, and better described as imaginary than real. Since there is a majority shareholder, whatever they say goes. The activist with 10% and the activist with 10 shares have exactly the same amount of power and will receive the same amount of respect. Yes, they could try to do a stunt like dropping all 10% at once, but A) they don't actually own that large a chunk, B) they wouldn't want to take that kind of loss to send a message, and C) someone else would buy it and Facebook would not care at all about the former investor.

Minecraft's my Nirvana. I found it hard, it's hard to find. Oh well, whatever... Never Mined

Re: Sorry, none of this means anything..

I think these new things that look like toys at first only look like toys to people who weren't intimately familiar with the products and their users. Take small single-user drones. Perhaps, like me, you didn't really think of them very much until lots of people were buying them for no real purpose except to fly them around and take pictures of their houses and make annoying noises. However, certain people had been buying them before they got to that level, and most of them wanted specific information, such as aerial surveys of farmland or photos of something best viewed from a great height. We didn't see them, because they were not flying them near us, but they existed. I think the same probably applied to microcomputers; while some people clearly bought an early and expensive one because they wanted to play around with it, a lot of other people bought one to use it for computing. By the time everyone was getting one, the future had already arrived. People were just noticing it.

Never let something so flimsy as a locked door to the computer room stand in the way of an auditor on the warpath

Re: Wouldn't Happen Here

Just because some set of people who do something have qualifications, that doesn't mean that everyone else using the verb has those qualifications or that those qualifications are important. For example, penetration testing can be very well done and very useful, with lots of different attack vectors that can be tested by very experienced people in real world scenarios. You can also get a penetration tester who just tries a small number of really obvious things. That's why you have to choose one who knows what they're doing. In this case, the audit seems to have found some problems with security, who didn't do anything when they saw people breaking through a door. Yet they seem to have blamed the IT people, who did everything well as far as they knew.

Computer room has a door? Check. Computer room door is locked? Check. Locked door doesn't unlock with unauthorized cards? Check. Door is sturdy enough not to be shoved open? Check. So I think they yelled at the wrong group. If they were supposed to test security, they did something potentially useful, but if they were there just to audit IT, they were wrong to try to break through a door.

WikiLeaks boss Assange acted as a foreign spy, Uncle Sam exclaims in fresh rap sheet

Re: Spy vs Journo

Person 1: "But journalists also need to be held to account, if their actions cause harm."

Person 2: "[Y]ou are dangerously wrong. [...] Was the Washington Post responsible for Nixon's resignation?"

If I understand both of you, you're arguing different points. Person 1 was saying that journalists who cause problems should be held to account, which would not include things like a resignation; that was a result of revealing facts. If, instead, the result of the leak was that someone died (E.G. location of person targeted by assassins), then there would be a more serious problem. Meanwhile, person 2 is worried that "cause harm" is a very general term that can be defined more broadly than it should. Again, I may be misunderstanding the points here, but I think there's something valid in both.

Re: This will be fun to watch...

"He isn't charged with treason, he is charged with espionage."

This part of the discussion has escaped specifically the topic of the article and now is considering treason and related legal frameworks from a theoretical perspective. Nobody is arguing that he has committed treason; they just want to know whether a non-citizen can be charged with treason given its definition. In fact, some are arguing that it would be impossible for people in his situation to commit treason.

Why telcos 'handed over' people's GPS coords to a bounty hunter: He just had to ask nicely

Re: It's a hard problem

"There are so many agencies that unless the States take charge of implementing some sort of authentication or 2FA challenge-response mechanism, the telcos have really no viable way to do so in an emergency situation."

Then telco and police alike should get going and build "some sort of authentication or 2FA challenge-response mechanism". In the meantime, they should not respond to any request unless they can confirm the entity calling and the legitimacy of the request. After the system is implemented, they should reject immediately any request to go around this system. If a police unit forms, it can choose to set up under that system with required auditing and transparency, or it can resign itself to the fact that it can't access this information. "Because it's hard" is not an acceptable reason to violate people's rights.

FCC boss blesses T-Mobile US-Sprint merger amid sketchy promises, lashings of incoherency

"What I'd like to know is how letting them fail and leaving us with just Verizon and ATT as the only abusive duopoly in town is good for us?"

That couldn't functionally happen. These companies are massive and can continue or restructure in time to avoid a financial failure. However, let's assume that they don't do so and do eventually fail. Market share of 12% and 17% is a valuable commodity to a buyer. That buyer could not be either remaining company for antitrust reasons, and could not be the same company. So there would be a lot of administrative restructuring, but there would still be four providers. It is conceivable that one could be mismanaged so much that it loses all its market share, but that's a lot of supposition and previous market share numbers don't seem to show that. So regulation is likely to prevent a triopoly and at least delays one for a while, hopefully long enough for other people to get into the market because they know that competition will be supported and they will have a chance.

iPhone gyroscopes, of all things, can uniquely ID handsets on anything earlier than iOS 12.2

Please don't do that

"[T]he actual technique does not necessarily have to be malicious in practice (for example, a bank might use it to uniquely fingerprint your phone as an anti-fraud measure)"

About that... NO! The bank does not need to fingerprint my phone, given that they won't be fingerprinting anyone's non-Apple devices. Nobody needs a unique fingerprint that I can't wipe. History to determine whether a request is likely to be legitimate or not, sure. Sneaky tracking data, no. In addition to it being creepy, it wouldn't actually help very much given that only a small number of devices can use it even if Apple unpatches the vulnerability.

Saying things like that makes it sound like you think there is a legitimate use for this invasive technique. There isn't.

An app can probably be more trusted, but the more concerning one is a script on a website. A user can be tracked inside an app by many more reliable mechanisms, so the only benefit to apps. in using this is to try to track a user after they've deleted an app and reinstalled it. Concerning, yes, but not a very frequent thing to do. Meanwhile, sites that can fingerprint via scripts are much more worrying. If it takes a second to do that, lots of sites will do it successfully. If we can extend this to a minute, fewer sites will bother and plenty won't get a chance to finish before the user closes it. Still, I think the best way is to deny sites access to those measurements. If a thing needs those, they can write an app.

Pushed around and kicked around, always a lonely boy: Run Huawei, Google Play, turns away, from Huawei... turns away

What shop? A bunch of them are owned by the mobile providers or have signed a contract with one of them. The devices are locked. You can get plenty of unlocked devices from online or the occasional retailer, but your choice is much reduced because they don't always have the specific one you want. You can get into the area of importing devices from other places, but that's a lot of hassle compared to the benefit.

Re: The US refusing to sell components to China?

It's only a ban against Huawei, not China as a whole. And in practice, both countries could hurt each other quite strongly by refusing to export chips. Most of the chips concerned are designed in the U.S. and manufactured in China. If the U.S. won't export them, the Chinese can't use them. If the Chinese won't allow them to be manufactured, the U.S. can't use them. Of course, the U.S. could shift manufacturing to other places, mostly Taiwan and South Korea, and the Chinese could either design their own replacements or start manufacturing the chips from designs they had previously, but both would take longer and come with major downsides. So if either country tries that, expect some pain.

Re: apps such as Whatsapp and skype

You're troubled about the privacy implications of social media and your primary suggestion is QQ? The one that transmits a bunch of cleartext messages straight into the servers run by the Chinese government? They of social credit score fame? Viber doesn't have those implications but isn't exactly known for their privacy, either. Try things like Signal or Telegram.

Please no on the GSMA-run app store. The last thing we need is extra control over our phones by the mobile providers. They've already made it so it's hard to get a device without being locked into a provider. I don't want them deciding or even knowing what applications I can run.

I appreciate the enthusiasm. I really hope it is proven correct. Unfortunately, I don't think we will see a viable third alternative. Huawei will probably have something. Whether that is AOSP-based or something less compatible, I doubt it will be released as open source for everyone else, and I doubt that it will really provide useful things over standard AOSP let alone something less supported but more powerful like Lineage OS. Meanwhile, while other companies may indeed worry about android access being cut off, they will probably worry even more about a third OS eating into their market share because they would have to expend resources on building and maintaining it, let alone advertising it. If it dies like every other attempt at a mobile OS (Windows phone, Ubuntu Touch, Firefox OS, ...) they will be out that development cost, the hardware that didn't sell cost, the loss of android market share cost that Apple can try to pick up, and the made Google angry cost. Companies have a lot of financial people who do not like that type of mathematics.

Google services are blocked in China, including the play store. No Chinese phone accesses this store directly, though there exist side channels to access some of it. For this reason, lack of Google play availability will not dramatically impact the ability to sell the devices inside China. Outside China is a very different story. It is also worth considering that even those phones in China need chips from the various companies who have agreed not to sell them to the company, which may cause problems for them in the short term until they find alternate suppliers for the functionality or arrange for a third party to purchase the chips and send them on.

Do Not Track is back in the US Senate. And this time it means business. As in, fining businesses that stalk you online

Re: Wait a second...

It's also important to realize that American parties aren't as unified as some parties in other countries. Although lots of other countries compete for internal chaos inside political parties, the parliamentary systems popular outside the Americas make consistent discord more fragile than does the presidential systems in the U.S. and many Latin American countries. One member of a party may be totally in favor of something that another member is extremely opposed to, and they can get into fights about whether it goes through or not before any other party gets involved. This particular lawmaker doesn't necessarily have the support of his party, and may not even have the support of many people in the legislature at all.

Want a good Android smartphone without the $1,000+ price tag? Then buy Google's Pixel 3a

Re: Google to host videos ...

The problem with rooting the device and installing a custom OS is that very few phones are supported. I'm happy to do so, and I have one phone here already running lineage OS, but the list of devices for that, while the longest I've seen for such a build, is quite short. The phone I was talking about, an older LG one sitting in a drawer, has no known rooting path described online, and certainly no build already for it. I may have enough knowledge to build the lineage OS build for the device, but that would be a lot of work that wouldn't help much because I do not have access to install it. I don't know enough about low-level manufacturer-specific things to find my own rooting path without spending a lot of time learning about it, and since this phone is an old one I haven't thrown away, it's not really worth the trouble to me. The result being that I can't actually do anything with this device to disable Google's data collection.

Re: As an iPhone user

I beg to differ. Let's consider the processor in an older iPhone and the one in the Pixel 3a:

Iphone 7: four cores (two 2.3GHZ high performance plus two more lower-power ones)

Pixel 3A: 8 cores, two 2.0GHZ cores and six 1.7 GHZ cores

The iPhone's cores have a pretty good single-threaded performance, better than many snapdragon cores, but not dramatically so depending on what the cores are called on to do. Now, let's look at some phones that cost less than 200 currency units, as defined by GSM Arena. I'm not sure exactly what currency unit they're using, but it's either euros, pounds, or U.S. dollars, as they use all three on various pages. Also take note that GSM Arena uses old prices, usually a price that was seen shortly after launch, so this includes only devices whose release price was under 200 units. Many other candidates are available whose price has been reduced to that level, but don't show up in the quick search I did.

Xiaomi Redmi Note 7 specs: eight cores: two at 2.2GHZ and six at 1.8GHZ, 4/6GB memory, clearly outstripping the pixel

Realme X specs: eight cores: two at 2.2GHZ and six at 1.7GHZ, 8GB memory, clearly outstripping the pixel

Samsung Galaxy A20 specs: eight cores: two at 1.6GHZ and six at 1.35GHZ, 3GB memory: not as good as the pixel, but not all that much worse

Nokia 4.2 specs: eight cores: two at 2.0GHZ and six at 1.45 GHZ, 3GB memory: A little worse than the pixel

Oppo A3S specs: eight cores: eight at 1.8GHZ: probably about on par with the pixel

These aren't all of the models, as I only considered one for each manufacturer. As you can see, several outstrip the pixel, and if I had included multiple candidates from each manufacturer, it would be even more of them. Even those that do not exceed the pixel in power have respectable processor performance, having eight cores and not having weirdly underpowered cores either. If you're doing something very processor-intensive on a phone, these might not be enough, but this is not the budget android device of old. It is perfectly capable of the standard smartphone use case.

I don't think anyone thinks Apple's prices are in any way justifiable, but that doesn't suddenly make this phone well-priced. Yes, it's better than Apple, Samsung, and Huawei in the flagship realm. But you can get a phone for much less that has similar specifications. This article has described it as similar to a flagship, but it's really not. It has a slower processor, less memory, and less internal storage than all other flagships and many other low or mid-cost phones. That doesn't make it insufficient; I've long contended that it is hard to tell whether an android phone has 4, 6, or 8 GB of memory, but it is important to avoid categorizing it as one of the most advanced, because that misleads potential customers into thinking that the price tag is a bargain, when it is in fact a bit overpriced.

Re: As an iPhone user

I would not get a pixel, instead going with a cheaper android device. There are a few good reasons to do that:

1. A lot of them have comparable specs and can't really be told apart.

2. Many of these, especially Xiaomi devices, are supported by lineage OS, so you can use that if you prefer it or want to extend the life of the device.

3. Looking in the low-cost field gives you more options so you can find a phone that has features you are more likely to want (for example, you can have a headphone jack, SD card slot, waterproofing, or a removable battery in various models, though all at once is harder to find).

4. If it turns out you really hate android, which happens from time to time, you have spent less money on your device and don't feel as bad when you sell it again.

I have to say that point 1 is the most important. While this article is extremely laudatory of the pixel, calling it low-cost, it really isn't when you compare it with the numerous good phones in the 100-200 price range. It's low-cost only when it is compared with flagships, which are all so high-cost as to be utterly ridiculous. The only thing I've consistently heard about being better in the pixel is the camera, but you will certainly get a serviceable camera in a cheaper phone, so it depends on your requirement for mobile photography.

Re: Google to host videos ...

Oh can it? I've never heard that before. Nobody's ever told me that. I have this phone over here that I can do that on. Just give me a few minutes... You want to explain why this phone, on which I don't have any google account configured, is still making DNS requests to google domains and shows play services as using a bunch of CPU and network on some occasions? It's also informed me that its performing a play protect scan of my phone. I have no malware, at least so sayeth Google when they checked my list of installed software against Google's servers. Which is some data. If this is happening, I'm guessing other data is coming out, too. Yes, I can go into settings and disable play protect. I can't disable google play services, though.

CIA traitor spy thrown in the clink for selling secrets to China. Stack Overflow, TeamViewer admit: We were hacked...

Re: Need for accounts ?

One major reason is to provide an extra obstacle to the mass creation of accounts. Since each account needs a unique email address, a spammer would need to create separate addresses for each account created. Yes, they could set up a mailserver and have a nearly infinite supply of those, but a monitor could notice this and ban all addresses under the domain they're using. So that means they have to use publicly available accounts, most of which have some method of preventing a very large number of accounts from being set up in short order or by one user. This also lets them report things should a user do something like break the law, and provides them a method of communicating with the user if the user needs to, for example resetting the password, informing of data breaches, etc. Most of this would not work anymore given a key-based authentication system, so people don't do it so often.

RIP Hyper-Threading? ChromeOS axes key Intel CPU feature over data-leak flaws – Microsoft, Apple suggest snub

Re: HypermarkeTing

It depends very heavily on what the chips are doing. For operating systems under heavy use, the extra threads can produce real benefits because a lot of threads are cycling through those times they need to compute and those times where they don't. Whenever you really need performance on a multithreaded process that doesn't use much disk, network, etc., you would be best advised not to use it because four threads running under max capacity are usually better (exceptions apply) than eight threads that keep handing control over to others. This again varies, including how much memory each thread uses and how it makes use of a cache.

Re: Why not give users the choice?

You can do exactly that. Not many people have decided to prevent you from using hyperthreading. Google has, but their OS is so lightweight (just a big browser) that it is unlikely to have a need for it and BSD has always been a configure all you like OS. Other things leave it on. However, we can't give you an accurate number of ongoing exploits because first, this is new and people haven't really had a chance to try to use it yet and second, nobody tells us when they're starting to exploit this and it doesn't have a simple definable signature we can search for. You'll have to make your decision on whether to hyperthread or not to hyperthread based on the technical descriptions alone.

Legal bombs fall on TurboTax maker Intuit for 'hiding' free service from search engines

Re: Not being an American

Unfortunately, situations can be a lot more complex than they need to be. A "complex investment portfolio" can at times be created merely by having retirement accounts, even if there are no investments after that point. This differs greatly upon which country's tax regime is being considered, but you don't need to be super-rich, have created some complex set of accounts, or done something all that out-of-the-ordinary for the tax forms to become a lot less straightforward.

It's 2019 and a WhatsApp call can hack a phone: Zero-day exploit infects mobes with spyware

Re: What about Signal

If that's the paramount problem for you, you can take that source and compile it yourself. But that's not really that concerning, because the risk of someone maliciously compiling a different binary and somehow getting it to you is less than someone finding a bug in existing code. The latter is much easier and more likely to occur. The former requires that signal themselves do that, or maybe that Google does so (you have things like FDroid, though), and that could be detected without much difficulty. So my point, that it is easier to audit the code if you can read it, still stands and your objections as stated are largely irrelevant.

Re: What about Signal

Signal is not vulnerable to this, but could conceivably have a similar bug. It is open source, so that bug is more likely to be detected if introduced. What's app was not forked from signal (in fact it existed years earlier), nor was signal in any way forked. They're just two apps that look kind of similar. All the infrastructure, people involved, and app code is entirely different.

Re: Removing the infection

You are correct in both cases. I'm not sure if android allows it, but you can't modify binaries in place on IOS, so killing the app will close any connections. Updating will help too. Not using what's app is similarly effective.

Re: How do I know?

You can't really detect that. However, if you kill the app, which will happen automatically if you install the update, it will kill any compromised sessions and prevent new ones from starting. You would not know whether you have been attacked or, if you were, what if any data was extracted. There is no log of this from the application itself, as any logs could be written by the malware.

Re: OS level security?

It doesn't seem that it is escaping the sandbox at all. Unfortunately, from within WhatsApp's sandbox, the malware can access contacts, call history, microphone, and camera* because of videocalls. That's enough to compromise the user of the device quite a bit, even if it doesn't let you read email, browser history, or other types of data on the phone.

*If the videocall or voice call function has never been used on an IOS device, this exploit shouldn't allow those to be taken because the permission has not been granted. This distinction does not apply to android, and if a voice or video call was ever used, it wouldn't apply to IOS either.

Re: The question is

I don't think they were saying that this hack was created by NSO/anyone external, but that the expertise needed to find and exploit it in the wild, as has been happening, is likely that of NSO/someone external. I thought the exact same thing when I read that line, but the paragraph after that makes it look like the above suggestion. Given that this program is not open source and has an encryption layer on all its network traffic, I would say that it is at least somewhat hard to find and probably signifies some level of sophistication on the part of the attacker abusing it.

San Francisco votes no to facial-recognition tech for cops, govt – while its denizens create it

It can be done

This is perhaps the first example of such an ordinance, and I hope it leads to many more. Those who profess to support such legislation but don't do anything about it because they think it's not going to pass may now see that it can be done and get going on spreading such restrictions. Here's hoping they do so across all cities, countries, and continents.

Apple won't be appy: US Supremes give green light to massive lawsuit over App Store prices

Re: January 2018

How does that have any relevance to this question? It is possible for a completely honest company to have a bunch of money. It is possible for the worst monopolist on earth to be losing money anyway. Are you trying to say that Apple must be a monopolist because they have a lot of money? It seems a lot more logical to argue that Apple are a monopolist because they engage in monopolistic practices.

Re: Possible contributing factor to the 6% drop?

I think there is a lot to argue about that, and I think the margin should be lower or zero, but it is worth keeping in mind that you can have a payment system in an app that bypasses Apple's in-app purchasing system (E.G. please sign into your account, from which you will pay your bill with your credit card information). It is more difficult than letting a user press a button and authenticate with Apple, but it can be done and is in many applications. This option is very much not available when purchasing apps, although you can go the route of having a free application that makes you sign into an account and pay from there, which developers don't choose to do very often.

Re: Optional

But the case is not at all about operating systems. They're not saying that there should be some alternative to IOS that runs on iPhones. At most, they're saying that IOS should allow sideloading, and they may simply be saying that there should be more control of app pricing and a lower commission. If a case did happen with the decision saying that apple needs to provide an alternative OS loading facility, it would be problematic for every manufacturer of android devices that has ever produced a bootloader that isn't unlocked. Even those that were hacked to provide the functionality didn't actually intend to provide consumer choice. So that probably wouldn't succeed, but is definitely not what's at issue in this case.

What's that? Uber isn't actually worth $82bn? Reverse-gear IPO shows the gig (economy) is up

Re: PT Barnum

I'm not sure about that. From a user perspective, there are probably many advantages to the app method of getting a car. You don't have to try to catch one in transit. You don't have to call in and prearrange something. If taxi places started using apps, you'd still have to a) know which taxi locations are available and b) have installed their app when you are going to the place. And this does at least produce a larger supply of available transports. So there do seem to be real benefits to the users of these applications.

Of course, there are many major downsides as well, both to the increased number of people driving about and the companies administrating the application. I'm not saying they're perfect, or even good. I can't say I use their services very frequently, either. But I don't think it's child's play for a taxi company to duplicate their benefits.

Who pwns the watchmen? Maybe Russians selling the source code for three US antivirus vendors

Re: Isn't this good news?

This is when security through obscurity actually has a chance, because security for an antivirus is very different than security for an operating system. The difference is this:

OS security: Malware can't get in, malware can't escalate, etc.

AV security: malware can't evade

In other words, malware wants to break into and exploit things in the operating system, but just wants to hide from antivirus. So the operating system components need to be audited by a lot of people to understand how they work and try to identify any holes before the malware people find them, but the antivirus system needs to prevent the malware writers from doing the same kind of thing to its code.

Amazon agrees to stop selling toxic jewelry, school supplies to kids, coughs up some couch change ($700,000)

Re: If I were a betting man...

I remember a time where Amazon was nicer. Not perfect, of course, but you could usually find what you were looking for, which would be sold there. You could get a relatively exhaustive list of all the options for that thing and compare them. Then you could read the reviews and clearly figure out which were fakes, then purchase the thing, which would be sent to you easily enough. It was a very useful experience then. I think this was around the time I used to think of Google as an ally because they opposed crazy break-the-internet suggestions and released a bunch of code as open source. All of this has dramatically worsened. Google's worsening is clearly intentional, but I don't even know why Amazon let that happen to them. They have a lot of resources from selling all of this; one would think they would eventually realize that there are a few things, like having the search results at least match a little bit the search query, that couldn't help but enhance their business.

Panic as panic alarms meant to keep granny and little Timmy safe prove a privacy fiasco

Re: A list of approved contacts?

Or we could go old school and have one of those paper clip reset buttons. It's not like reset is a function that really needs to be activated all that often.