Monthly Archive:: September 2015

Apple, Microsoft abandon pro-privacy stance

The following companies just betrayed billions of people.

Apple, Microsoft, Adobe, Symantec, and a handful of other tech companies just began publicly lobbying Congress to pass the Cybersecurity Information Sharing Act (CISA), a bill that would give corporations total legal immunity when they share private user data with the government and with each other. Many of these companies have previously claimed to fight for their users' privacy rights, but by supporting this bill they've made it clear that they've abandoned that position, and are willing to endanger their users' security and civil rights in exchange for government handouts and protection.

Wait, you mean to tell me all that talk about caring about users' privacy was just shallow PR speak gullible people fell for?

I'm so surprised.

After App Store attack, Apple urges devs to validate Xcode

Following the successful attack on the iOS App Store this week, in which hundreds (and maybe even thousands) of applications were infected with malware and distributed by the App Store, Apple has published a support document urging developers to validate their installation of Xcode.

We recently removed apps from the App Store that were built with a counterfeit version of Xcode which had the potential to cause harm to customers. You should always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software.

This successful attack on the App Store is fascinating in that it raises a whole number of interesting questions. First, how many applications have been infected with this attack? The number seems to keep on growing - from a few dozen to hundreds and even thousands - and includes several high-profile, popular applications like the Chinese WeChat (installed on virtually every Chinese iPhone), but also popular games such as Angry Birds 2. In fact, according to SourceDNA, several of the infected applications are still live in the App Store.

Second, how many more applications have been infected with other types of malware? If so many popular applications with this malware could be uploaded to and distributed by the App Store, you have to wonder how many more types of malware are currently lurking in the App Store that we don't know about yet or that haven't been detected by Apple.

Third - and this isn't really a question but more of a tongue-in-cheek pondering - does this attack make iOS the least secure mobile operating system? This single attack alone has definitely successfully infected more iPhones than the total number of Android phones that have ever been infected - which I find strangely hilarious. WeChat alone has about 500 million users, and is installed on pretty much every Chinese iPhone, and several other of the infected applications are also hugely popular. Depending on how many people installed the infected updates, and how many of the applications 'overlap', we're definitely looking at millions of infected iPhones, possible even more.

To quote Apple's own Phil Schiller - "be safe out there".

“A critical Windows component expires in 25 hours”

Please tell me I'm dreaming. While working on the new version of CTLInfo (screenshot below), I ran across an unexpected and rather scary finding: A key security component of Windows, the so-called 'Disallowed' CTL, has a validity of 15 months and is going to expire in 25 hours.

Running certutil -verifyCTL disallowed indeed confirms it on my Windows 10 machine, but like the author, I have no idea what this means. If it really is what it looks like... Wow.

Microsoft has built a Linux distribution – sort of

Late last week, hell had apparently frozen over with the news that Microsoft had developed a Linux distribution of its own. The work was done as part of the company's Azure cloud platform, which uses Linux-based network switches as part of its software-defined networking infrastructure.

While the software is real, Microsoft isn't characterizing it as a Linux distribution, telling us that it's an internal project. That's an important distinction, and we suspect that we're not going to see a Microsoft Linux any time soon.

Microsoft BeOS, and the world will be just.

Yes, the FCC might ban your operating system

Over the last few weeks a discussion has flourished over the FCC's Notification of Proposed Rule Making (NPRM) on modular transmitters and electronic labels for wireless devices. Some folks have felt that the phrasing has been too Chicken-Little-like and that the FCC's proposal doesn’t affect the ability to install free, libre or open source operating system. The FCC in fact says their proposal has no effect on open source operating systems or open source in general. The FCC is undoubtedly wrong.

Be sure to actually read the article.

WSJ: Apple aims to finalize an electric car by 2019

Sources with knowledge of the matter have told The Wall Street Journal that Apple is moving ahead with efforts to build an Apple-branded electric vehicle, which it intends to deliver to the market by 2019.

After a year of feasibility studies, the group within Apple in charge of the electric vehicle project has been given permission to triple its staff, which currently employs 600 people, the Journal reported.

Either carmakers should be shaking in their boots, or Apple is flying too close to the sun.

On ad-blocking

Let's talk ad-blocking.

With the arrival of iOS 9, ad-blocking is coming to mobile in a big way, and it's causing a lot of talk all over the web. It is highlighting the internal struggle some feel about the practice, but also the hypocrisy of some of its staunchest proponents. So far, it seems like the real 'bloodbath' isn't taking place where people thought it would be - namely, publishers - but among personalities.

Popular Chinese iOS apps compromised in malware attack

According to recent reports, some versions of Xcode used by developers in China have been compromised and are being used to inject tracking codes in iOS apps without developer knowledge. Unaware of the injection, those developers then released their compromised iOS apps to the App Store which were then later approved by Apple. At the time of writing this post, the compromised apps are still available in the App store (link is external). Any user who has installed and launched these compromised apps will be a victim of these tracking codes.

This is a significant compromise of Apple's app store. Apple notoriously manually reviews all app submissions and, in comparison to Android stores, has been relatively malware-free. This is the most widespread and significant spread of malware in the history of the Apple app store, anywhere in the world.

This thing is huge. Among the affected applications is WeChat, which is used by 500 million people and installed on probably every Chinese iPhone. Here's another article with more details, but it's from a security software peddler, so get your salt.

Google’s entire codebase: 2 billion lines of code, 86 terabytes

Interestingly, the entirety of Google's codebase - from search and maps to YouTube and Google Docs - resides in a monolithic source code repository available to and used by 95% of Google engineers, or about 25,000 users to be exact.

"Without being able to prove it," a Google engineering manager said, "I'd guess that this is probably the largest single repository in use anywhere in the world."

All told, Google's services comprise 2 billion lines of code which, taken together, weigh in at 86 terabytes.

Fascinating.

New leaked images of the BlackBerry Venice

It's no secret that BlackBerry is developing its own Android-powered smartphone. Thanks to numerous renders, images and leaked specifications, we already have a pretty good idea as to what the phone might look like. In case you needed more proof, we've just obtained some new hands-on photos of the unannounced BlackBerry Venice, showing off the device's chassis, sliding keyboard and some software features.

I still can't believe it looks like we're finally going to get the keyboard slider that we deserve. I'm almost too afraid posting about it will jinx it.

iOS 9 released

Today is iOS 9 release day - which means that most likely, most of you have already upgraded. The Ars review concludes:

Last year we said that iOS 8 felt like the second half of the iOS 7 update, the one that completed the transition between iOS' skeuomorphic era and our current reality, where the lines between "mobile device" and "computer" blur a little more every day. iOS 9 takes that foundation and builds on top of it without radically altering things, much in the same way that iOS 6 built on top of the advancements in iOS 4 and iOS 5.

It was a smaller release, and as a result, testing the final build of iOS 9 was frankly kind of a relief.

Apple’s “veto power over new web technologies”

John Gruber, on Apple's incredible power over the web:

As a side note, I think this is more or less what is happening, whether the web community likes it or not, because this largely seems to describe Safari/WebKit's approach to moving forward - and Safari, because of iOS in particular - effectively gives Apple veto power over new web technologies. Apple can't stop Google from adding new features to Chrome/Blink, but Apple can keep any such features from being something web developers can rely upon as being widely available. That implicit veto power is what drove this summer's "Safari is the New IE" drama.

What could possibly go wrong. Meanwhile, John Gruber, on his site's about page:

Web standards are important, and Daring Fireball adheres to them.

OK.

Microsoft is downloading Windows 10 to your PC ‘just in case’

Microsoft has confirmed that Windows 10 is being downloaded to computers whether or not users have opted in.

An INQUIRER reader pointed out to us that, despite not having 'reserved' a copy of Windows 10, he had found that the ~BT folder, which has been the home of images of the new operating system since before rollout began, had appeared on his system. He had no plans to upgrade and had not put in a reservation request.

I'm sure this is somehow my fault.

Apple looking into allowing you to remove crapware from iOS

Why are there apps on the iOS that I can't delete even though I never use them? Why does Apple insist that I keep Tips and Stocks on my iPhone when I'd like nothing more than to delete them? For Cook the question seems a familiar one. "This is a more complex issue than it first appears," he says. "There are some apps that are linked to something else on the iPhone. If they were to be removed they might cause issues elsewhere on the phone. There are other apps that aren't like that. So over time, I think with the ones that aren't like that, we'll figure out a way . ... It's not that we want to suck up your real estate; we're not motivated to do that. We want you to be happy. So I recognize that some people want to do this, and it's something we're looking at."

Great news for iOS users - it seems like soon we'll finally be able to remove all the crapware Apple's been stuffing your iPhone with.

As for the other applications he's referring to, such as mail, the browser, and so on - don't expect any changes to how you cannot set your own browser or mail client as default. The reason is simple: there's going to be a whole lot of Google iPhones out there the day Apple does allow you to change default applications. And we wouldn't want consumers to use what they actually want to use, now would we?

Perish the thought.

Microsoft is surprisingly close to making a decent Android phone

The truth is a little less exciting, with Google inviting manufacturers to participate in legally binding agreements that ensured Google search sat atop everything in exchange for access to the Play Store, but the end result isn't all that different. Microsoft could make its own phone without access to the Google Play Store, but that usually ends poorly for everyone involved. In order to have their apps and services installed on something running Google-powered Android, Microsoft needed to go the long way and offer compelling apps that users would want to install and use instead of the pre-loaded Google counterparts.

You may not be aware of it, but Microsoft is surprisingly close to making this a reality.

They are, indeed. There's a reason Microsoft's applications on Android are way, way better than those for Windows Phone or Windows 10: Microsoft Android is their plan B for when they do eventually end Windows Phone.

Goodbye Windows Phone

Despite being a devoted Microsoft and Windows fan since age five, my first four smartphones were the first four iPhones (1, 3G, 3GS, 4). I don't think I need to explain how amazing the first iPhone was compared with the competition at the time. However, after four generations of it I was bored. What was exciting me was what I was seeing coming out of Redmond in the form of Windows Phone 7.

Here I am almost four years and three handsets down the road and today I made the decision to leave the platform and return to iPhone. It's basically been death by 1,000 cuts...

I went along with Windows Phone 7.x - heck, I imported an HTC HD7 from the US to The Netherlands on release day (it eventually took Microsoft like 18 months to launch in The Netherlands). I also went along with Windows Phone 8.

And I, too, am done. Bitten too many times by Windows Phone's "just wait for the next version". No more.

Let’s talk about iMessage (again)

Yesterday's New York Times carried a story entitled "Apple and other tech companies tangle with U.S. over data access". It's a vague headline that manages to obscure the real thrust of the story, which is that according to reporters at the Times, Apple has not been forced to backdoor their popular encrypted iMessage system. This flies in the face of some rumors to the contrary.

While there's not much new information in here, people on Twitter seem to have some renewed interest in how iMessage works; whether Apple could backdoor it if they wanted to; and whether the courts could force them to. The answers to those questions are respectively: "very well", "absolutely", and "do I look like a national security lawyer?"

As the article states, it all comes down to trust.