We turned off ads, and we're running a FUNDRAISER, so donate to our FUNDRAISER! Or become a Patreon!

Monthly Archive:: August 2015

Lenovo used firmware to install persistent crapware

Windows 8 and Windows 10 contain a surprising feature that many users will find unwelcome: PC OEMs can embed a Windows executable in their system firmware. Windows 8 and 10 will then extract this executable during boot time and run it automatically. In this way, the OEM can inject software onto a Windows machine even if the operating system was cleanly installed.

The good news is that most OEMs fortunately do not seem to take advantage of this feature. The bad news is that "most" is not "all." Between October 2014 and April of this year, Lenovo used this feature to preinstall software onto certain Lenovo desktop and laptop systems, calling the feature the "Lenovo Service Engine."

Microsoft provides more detailed on what, exactly, this functionality, dubbed the Windows Platform Binary Table, is supposed to be for (.docx file!), and how it works. From reading the document, it becomes clear that installing tracking software - which is what Lenovo is using this for - is not exactly what Microsoft had in mind.

The Windows PC world is such a mess.

Oracle: stop checking our code for vulnerabilities

Oracle's chief security officer is tired of customers performing their own security tests on Oracle software, and she's not going to take it anymore. That was the message of a post she made to her corporate blog on August 10 - a post that has since been taken down.

Strangely satisfying to watch this trainwreck unfold. Perhaps because the trainwreck in question is one of the most despicable companies in tech?

PC companies should copy one of Apple’s best features

Fiddling with installation media for operating systems is annoying and cumbersome - and sometimes it's even impossible to create said installation media to begin with.

And Apple's solution to this conundrum is very neat: even with a blank hard disk, the system firmware can connect to Wi-Fi or wired Ethernet, go online, and download the operating system directly from Apple. You can do a bare metal restore with nothing more than an Internet connection.

This is just one of those little things that Apple can do relatively easily due to the integration between its hardware and software. Things like this take forever to get done properly on the PC side of things - although on the Linux side of things I used to download the minimal installation ISO and just download the rest of the operating system at install time through FTP or whatever.

In true Linux fashion, this was a manual process. I would love for all this to be automated, as well as for the installation medium - even the minimal one that only boots the installer and connects to FTP - to be eliminated. Apple has done it, and so can the rest of the PC world.

Microsoft’s Android-on-Windows project leaks

Ever since Microsoft announced their Bridge technologies at Build 2015 questions about how they work (and how well) have been asked. The tools let developers port over Android apps (Project Astoria), iOS apps (Project Islandwood), web apps (Project Westminster) and classic Win32 apps (Project Centennial) to Windows 10 including phone.

This morning, the actual tools for Project Astoria have leaked onto the web and users can freely (and illegally) download Android APKs and sideload them to their Windows Phone running Windows 10 Mobile. This follows yesterday's leak of the documentation for the project.

Project Astoria is fascinating. If you look at the leaked documenation, you'll see Microsoft is running (parts of) the Android subsystem and Linux kernel in kernel mode. This should be nice for performance, but at the same time, it doesn't seem like something that'll be good from a security standpoint.

The leaked documentation also explains that in Project Astoria, all activities belong to a back stack within a single task. In regular Android, activities can belong to different tasks, with their own back stacks. If I'm reading this right (and please, do correct me if I'm wrong - this isn't exactly my expertise), this should simplify the back button behaviour - and is probably a consequence of Project Astoria only being able to run one process at a time.

Another fun part of Astoria: there's a WebKit rendering engine in there. Yes, Windows 10 Mobile will have a WebKit rendering engine. Fascinating.

Introducing Qubes OS live USB edition

We have built and uploaded the first ever working Qubes Live USB image! It's based on the recently released 3.0-rc2 release. Now you should be able to run and try Qubes OS of any laptop without needing to install it anywhere!

We've talked about Qubes before, but since it's been a while, here's a quick primer:

Qubes is an open-source operating system designed to provide strong security for desktop computing using Security by Compartmentalization approach. Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers.

This new live USB image should make it a lot easier to give Qubes a go.

Thunderstrike 2: Mac firmware worm details

This is the annotated transcript of our DefCon 23/BlackHat 2015 talk, which presented the full details of Thunderstrike 2, the first firmware worm for Apple's Macs that can spread via both software or Thunderbolt hardware accessories and writes itself to the boot flash on the system's motherboard. The original slides are available.

While I think it's unlikely this worm will pose any real threat in the real world, I find it amazing that we're living in a world where this is possible in the first place.

Hello, Windows 10 IoT Core

Windows 10 IoT Core is a new edition for Windows targeted towards small, embedded devices that may or may not have screens. For devices with screens, Windows 10 IoT Core does not have a Windows shell experience; instead you can write a Universal Windows app that is the interface and "personality" for your device. IoT core designed to have a low barrier to entry and make it easy to build professional grade devices. It's designed to work with a variety of open source languages and works well with Visual Studio.

Internet of Things, coming to you from a proud tradition of the tech industry being horrible at coming up with decent names.

Google announces new CEO, massive company restructure

Google has just announced a major reorganisation if its company structure, as well as a new CEO. Basically, the company has created a sort of umbrella corporation containing all the independent business that (used to!) make up Google. In this new structure, Google is just one company within Alphabet, but so are Alphabet's other ventures, such as its medical companies, the driverless car company, and so on, and so forth.

What is Alphabet? Alphabet is mostly a collection of companies. The largest of which, of course, is Google. This newer Google is a bit slimmed down, with the companies that are pretty far afield of our main Internet products contained in Alphabet instead. What do we mean by far afield? Good examples are our health efforts: Life Sciences (that works on the glucose-sensing contact lens), and Calico (focused on longevity). Fundamentally, we believe this allows us more management scale, as we can run things independently that aren’t very related. Alphabet is about businesses prospering through strong leaders and independence. In general, our model is to have a strong CEO who runs each business, with Sergey and me in service to them as needed. We will rigorously handle capital allocation and work to make sure each business is executing well. We'll also make sure we have a great CEO for each business, and we'll determine their compensation. In addition, with this new structure we plan to implement segment reporting for our Q4 results, where Google financials will be provided separately than those for the rest of Alphabet businesses as a whole.

Alphabet will be headed by Sergey Brin and Larry Page, but Google will get a new CEO in Sundar Pichai.

This new structure will allow us to keep tremendous focus on the extraordinary opportunities we have inside of Google. A key part of this is Sundar Pichai. Sundar has been saying the things I would have said (and sometimes better!) for quite some time now, and I've been tremendously enjoying our work together. He has really stepped up since October of last year, when he took on product and engineering responsibility for our Internet businesses. Sergey and I have been super excited about his progress and dedication to the company. And it is clear to us and our board that it is time for Sundar to be CEO of Google. I feel very fortunate to have someone as talented as he is to run the slightly slimmed down Google and this frees up time for me to continue to scale our aspirations. I have been spending quite a bit of time with Sundar, helping him and the company in any way I can, and I will of course continue to do that. Google itself is also making all sorts of new products, and I know Sundar will always be focused on innovation - continuing to stretch boundaries. I know he deeply cares that we can continue to make big strides on our core mission to organize the world's information. Recent launches like Google Photos and Google Now using machine learning are amazing progress. Google also has some services that are run with their own identity, like YouTube. Susan is doing a great job as CEO, running a strong brand and driving incredible growth.

Possible bonus perk: this is an antitrust lightning rod.

It's going to take me a while to adjust to this somewhat strange - for now - naming scheme.

There’s no such thing as post-PC

The post-PC era is a term that was made popular by Apple at its introduction of the iPad in 2010, and one that a lot of people took to mean the PC will eventually die and tablets and smartphones will take its place. The PC isn't exactly healthy right now, but it's also nowhere near death, no matter how many stories try to exaggerate its continued decline.

I've never been a fan of the term "post-PC era", since it's obviously just a marketing ploy.

Google brings Vulkan to Android

In order to address some of the sources of CPU overhead and provide developers with more explicit control over rendering, w've been working to bring a new 3D rendering API, Vulkan, to Android. Like OpenGL ES, Vulkan is an open standard for 3D graphics and rendering maintained by Khronos. Vulkan is being designed from the ground up to minimize CPU overhead in the driver, and allow your application to control GPU operation more directly. Vulkan also enables better parallelization by allowing multiple threads to perform work such as command buffer construction at once.

Google’s $6 billion miscalculation on the EU

That wasn't all. Vestager (pronounced Vestayer) announced a new investigation into whether Google had abused its dominant position with the Android operating system for smartphones. She suggested other cases were possible, too - regarding Google’s expansion into the markets for local search, maps, images, travel, etc. For Google, this was a nightmare portending years of scrutiny, a fine of up to $6 billion, and edicts that could forever limit the effectiveness of its products. The company must file a response to Vestige's "statement of objections" by Aug. 17.

In the span of just 15 months, Google somehow lost Europe.

I honestly don't believe this will go that far - I'm sure Google's learned from Microsoft's mistakes in Europe, and that it will give in just enough to avoid serious consequences.

Moto G (2015): this is Motorola’s real flagship

The Moto G often feels like the culmination of everything that Motorola has learned in the course of making its other phones. Yes, it's a stripped-down version of Motorola's so-called flagship, the Moto X, but it's by no means an afterthought. It's reason to question what a "flagship" really is. If a flagship is literally the standard-bearer, then it's worth remembering that the Moto G is the Motorola phone that most people are going to use - it's the phone that's going to define Motorola. When you consider that the Moto G is Motorola's "best selling smartphone ever," Motorola's top-of-the-line phones start to seem more like testing grounds than devices designed to take over the market. Given how impressive and popular the Moto G is, it's hard to see it as anything but Motorola's actual flagship.

I wouldn't only call the Moto G the culmination of everything Motorola has learned, but also what Android has learned. I just can't get over the fact that they managed to pack so much quality and smartphone into this cheap device.

Open sourcing the Windows Bridge for iOS

We're releasing the iOS bridge as an open-source project under the MIT license. Given the ambition of the project, making it easy for iOS developers to build and run apps on Windows, it is important to note that today’s release is clearly a work-in-progress - some of the features demonstrated at Build are not yet ready or still in an early state. Regardless, we'd love for the interested and curious to look at the bridge, and compare what we're building with your app's requirements. And, for the really ambitious, we invite you to help us by contributing to the project, as community contributors - with source code, tests, bug reports, or comments. We welcome any and all participation in building this bridge.

I can think of a few developers who are probably poking around this code as we speak. Good move by Microsoft.

We’re heading straight for AOL 2.0

The biggest internet players count users as their users, not users in general. Interoperability is a detriment to such plays for dominancy. So there are clear financial incentives to move away from a more open and decentralized internet to one that is much more centralized. Facebook would like its users to see Facebook as 'the internet' and Google wouldn't mind it if their users did the same thing and so on. It's their users after all. But users are not to be owned by any one company and the whole power of the internet and the world wide web is that it's peer to peer, in principle all computers connected to it are each others equals, servers one moment, clients the next.

If the current trend persists we're heading straight for AOL 2.0, only now with a slick user interface, a couple more features and more users. I personally had higher hopes for the world wide web when it launched. Wouldn't it be ironic if it turned out that the end-run the WWW did around AOL because it was the WWW was open and inclusive ended up with different players simply re-implementing the AOL we already had and that we got rid of because it was not the full internet.

The writing's been on the wall for a while now.

Windows 10 is coming to the Xbox One in November

Microsoft first revealed its redesigned Xbox One dashboard back at E3 earlier this year, and now the company is announcing that it will arrive on consoles in November. Powered by Windows 10, the new dashboard includes features that focus on speed and performance, and a design that's a lot more simplified.

Just imagine if the Xbox One had a developer switch, so you could do all sorts of cools tuff with Windows 10 on it.

Microsoft also improves parental leave

As we ask our employees to bring their "A" game to work every day to achieve our mission, we believe it's our responsibility to create an environment where people can do their best work. A key component of this is supporting our employees with benefits that matter most to them. This is why today we're announcing enhancements to our U.S. corporate employee benefits in three areas that employees consistently rank among the most important: having time to renew; saving for the future; and flexibility needed to spend time with new children.

And yet another technology company investing just a little bit more into its employees. I think these changes bring Microsoft more in line with Google's policies, and from a European point of view this is still pretty abysmal, but it's a major step forward for new fathers and mothers, and that's a great thing.

How the Stagefright bug changed Android security

It's been 10 days since Zimperium's Joshua Drake revealed a new Android vulnerability called Stagefright - and Android is just starting to recover. The bug allows an attacker to remotely execute code through a phony multimedia text message, in many cases without the user even seeing the message itself. Google has had months to write a patch and already had one ready when the bug was announced, but as expected, getting the patch through manufacturers and carriers was complicated and difficult.

But then, something unexpected happened: the much-maligned Android update system started to work. Samsung, HTC, LG, Sony and Android One have already announced pending patches for the bug, along with a device-specific patch for the Alcatel Idol 3. In Samsung's case, the shift has kicked off an aggressive new security policy that will deploy patches month by month, an example that's expected to inspire other manufacturers to follow suit. Stagefright seems to have scared manufacturers and carriers into action, and as it turns out, this fragmented ecosystem still has lots of ways to protect itself.

Seeing is believing, but the signs are at least somewhat positive. I doubt all of these will get the fix, though.

That being said, as the linked article explains, this bug really isn't as worrisome as people made it out to be. Security researchers (often working for companies selling security software) have cried wolf so many times I really don't take any of them seriously at this point, no matter which operating system's users they are trying to scare into buying their crap.

Netflix announces unlimited parental leave

At Netflix, we work hard to foster a "freedom and responsibility" culture that gives our employees context about our business and the freedom to make their own decisions along with the accompanying responsibility. With this in mind, today we're introducing an unlimited leave policy for new moms and dads that allows them to take off as much time as they want during the first year after a child's birth or adoption.

Great, great move by Netflix - especially considering it's an American company. Technology companies are raking in more cash than ever before, and it's great to see a small number of them investing that money back into their own employees, and not into foreign tax havens or CxO's pockets.

Here’s how to fix Windows 10’s privacy

Windows 10, by default, has permission to report a huge amount of data back to Microsoft. By clicking through "Express Settings" during installation, you allow Windows 10 to gather up your contacts, calendar details, text and touch input, location data, and a whole lot more. The OS then sends it all back to Microsoft so that it can be used for personalisation and targeted ads.

That isn't to say you should be happy about this state of affairs, however. If you'd like to retain most of your privacy and keep your personal data on your PC, Windows 10 can be configured in that way. Just be warned that there are quite a few toggles that need to be turned off, and you'll lose some functionality as well (Cortana won't work, for example).

Or, you know, don't use Windows.