Monthly Archive:: September 2018

Mojave’s security protections face usability challenges

Back in 2016, security researcher and developer Jonathan Zdziarski released a tool called Little Flocker that could protect Macs at the file level. Much as a firewall analyzes and blocks network traffic, Little Flocker locked down the file system and allowed only authorized applications access to only approved files.

Little Flocker was too complex to manage for average users, but it quickly became a darling among Mac security experts.

When Zdziarski took a job at Apple in 2017, he sold Little Flocker to the security vendor F-Secure, which released it as Xfence. Zdziarski's job change started the clock ticking on when we might see similar capabilities built into macOS. With macOS 10.14 Mojave, Apple has added file-level protections, plus some additional security enhancements. And you know what? Mojave is running into the same usability issues that users of Little Flocker endured.

I had never heard of this functionality. It seems like one of those things particularly Apple ought to be good at to integrate in a user-friendly manner.

Microsoft extends paid updates for Windows 7 beyond 2020

As previously announced, Windows 7 extended support is ending January 14, 2020. While many of you are already well on your way in deploying Windows 10, we understand that everyone is at a different point in the upgrade process.

With that in mind, today we are announcing that we will offer paid Windows 7 Extended Security Updates (ESU) through January 2023. The Windows 7 ESU will be sold on a per-device basis and the price will increase each year. Windows 7 ESUs will be available to all Windows 7 Professional and Windows 7 Enterprise customers in Volume Licensing, with a discount to customers with Windows software assurance, Windows 10 Enterprise or Windows 10 Education subscriptions. In addition, Office 365 ProPlus will be supported on devices with active Windows 7 Extended Security Updates (ESU) through January 2023. This means that customers who purchase the Windows 7 ESU will be able to continue to run Office 365 ProPlus.

Lots of corporate customers are still using Windows 7, and for many, there's little reason to upgrade. Microsoft is just catering to those customers, while making sure it'll be nigh-impossible for regular consumers to benefit from this paid-for extended support.

Qualcomm finally has a new chip for Android smartwatches

It's been two and a half years since Qualcomm last released a major new smartwatch chip, and in the time since, Android smartwatches have languished. But in the coming months, they could finally start seeing some meaningful improvements: Qualcomm is releasing a new processor for watches, called the Snapdragon Wear 3100, that's meant to extend battery life, enhance always-on displays, and offer more versatility when it comes to sports devices and fitness sensors.

Good news, since the Android Wear world had really died down. This new chip should breath some much-needed new life in the market. It also highlights the distinct and profound advantage Apple has in that it designs its own chips.

Huawei, Honor caught cheating on benchmarks

Does anyone remember our articles regarding unscrupulous benchmark behavior back in 2013? At the time we called the industry out on the fact that most vendors were increasing thermal and power limits to boost their scores in common benchmark software. Fast forward to 2018, and it is happening again.

Companies lie. They lie all the time. As with anything related to performance measuring and comparisons - wait for trusted third party benchmarks from places like AnandTech and GamersNexus. Company-provided figures are almost always anything from unrealistic best-case scenarios at best, or downright lies at worst.

Dozens of iOS, Android apps secretly share location data

During preparation for a workshop at DEF CON in August on locating privacy leaks in network traffic, we discovered a number of applications on both iOS and Android that were broadcasting precise location data back to the applications' developers - in some cases in unencrypted formats. Research released late Friday by Sudo Security's Guardian mobile firewall team provided some confirmation to our findings - and demonstrated that many apps are sharing location data with firms that market location data information without the users' knowledge.

Is anyone still surprised by this? Apple was recently also forced to remove one of the most popular apps in the Mac App Store because it turned out to be spyware. The one redeeming feature of closed application stores is that they're safer - if that advantage turns out to be a lot less solid than proponents of walled gardens proclaim, why do we keep insisting on maintaining them?

Creator of TempleOS, Terry Davis, has passed away

Terrence Andrew Davis, sole creator and developer of TempleOS (née LoseThos), has passed away at age 48. Davis suffered from mental illness - schizophrenia - which had a severe impact on his life. He claimed he created his operating system after having spoken with and receiving instructions from god, and he was a controversial figure, also here on OSNews, for his incomprehensible rants and abrasive style towards OSNews readers and staff. We eventually had to ban him, but our then-editor Kroc Kamen worked with him in 2010 to publish an article about his operating system despite his ban.

Davis was clearly a gifted programmer - writing an entire operating system is no small feat - and it was sad to see him affected by his mental illness. I mourn his passing, and I wish his family and friends all the strength they need in these trying times. His family and friends are asking people to donate to "organizations working to ease the pain and suffering caused by mental illness", such as The Brain & Behaviour Research Foundation or the National Alliance on Mental Illness.

I hope he found peace - wherever he may be.

On the road to pure Go X11 GUIs

And so I've placed a bet on Go. It is just as conceptually simple as C, sports a friendly BSD-style license, and already has its own parallel ecosystem. No stinky LLVM, in fact no traces of C at all! It's an overlooked revolution! I can follow symbols through packages however deep I want to and I always end up in Go or its assembly. Well, so long as nothing ugly uses Cgo.

Right, now that I've embraced the garbage collector, how do I make an interface that doesn't look like it dates back to the '80s? And can I avoid Cgo?

Google wants to kill the URL

"People have a really hard time understanding URLs," says Adrienne Porter Felt, Chrome's engineering manager. "They're hard to read, it's hard to know which part of them is supposed to be trusted, and in general I don't think URLs are working as a good way to convey site identity. So we want to move toward a place where web identity is understandable by everyone - they know who they're talking to when they're using a website and they can reason about whether they can trust them. But this will mean big changes in how and when Chrome displays URLs. We want to challenge how URLs should be displayed and question it as we're figuring out the right way to convey identity."

Judging by the reactions across the web to this news, I'm going to have the minority opinion by saying that I'm actually a proponent of looking at what's wrong with the status quo so we can try to improve it. Computing is actually an incredibly conservative industry, and far too often the reaction to "can we do this better?" is "no, because it's always been that way".

That being said, I'm not a fan of such an undertaking in this specific case being done by a for-profit, closed entity such as Google. I know the Chromium project is open source, but it's effectively a Google project and what they decide goes - an important effort such as modernizing the URL scheme should be an industry-wide effort.

Ars Technica’s Xbox Adaptive Controller review

Microsoft's newest game accessory, the Xbox Adaptive Controller, probably isn't for you. That's just an odds game, when counting the percentage of people who fall into the "limited mobility" camp that this strange, unique controller is aimed at.

But that's the incredible thing about the XAC: that it's targeting a particularly fractured audience. Limited mobility is a giant, vague category, after all, with so many physical ailments to account for (let alone psychological ones). And previous answers in the gaming sphere have typically been specialized, one-of-a-kind controllers for single hands, feet, heads, and more.

XAC wins out in an odd way: by leaving some major work in users' hands. This $99 lap-sized device is truly incomplete on its own, as it's designed from the ground up to require add-on joysticks, buttons, and more. As a result, there's no way to fully review the possibilities Microsoft's XAC opens up for disabled gamers. Still, we've put a retail unit through its paces to see what kind of accessibility canvas this revolutionary "controller" opens up - and exactly how it works - to help limited-mobility gamers and their caretakers decide if its functionality, ease-of-use, and practical cost is right for them.

This is one of the most amazing products Microsoft has ever created. This must've taken a considerable amount of research, development, time, and money - and all that for what is a relatively small group of underserved people in the videogame community. I love how every little detail about this product - from packaging to the final product - is designed solely for people with limited mobility.

US, others ask companies to build backdoors into encryption

The US, UK, and three other governments have called on tech companies to build backdoors into their encrypted products, so that law enforcement will always be able to obtain access. If companies don't, the governments say they "may pursue technological, enforcement, legislative, or other measures" in order to get into locked devices and services.

Their statement came out of a meeting last week between nations in the Five Eyes pact, an intelligence sharing agreement between the US, UK, Canada, Australia, and New Zealand. The nations issued a statement covering a range of technology-related issues they face, but it was their remarks on encryption that stood out the most.

Break encryption, or we'll break you.

US wireless carriers throttle Netflix, YouTube

The largest U.S. telecom companies are slowing internet traffic to and from popular apps like YouTube and Netflix, according to new research from Northeastern University and the University of Massachusetts, Amherst.

The researchers used a smartphone app called Wehe, downloaded by about 100,000 consumers, to monitor which mobile services are being throttled when and by whom, in what likely is the single largest running study of its kind.

The opponents of net neutrality told us we could take our business elsewhere to a carrier that doesn't throttle, so the free market will work itself out.

That was sarcasm.

Google turns 20

No technology company is arguably more responsible for shaping the modern internet, and modern life, than Google. The company that started as a novel search engine now manages eight products with more than 1 billion users each. Many of those people use Google software to search the repository of human knowledge, communicate, perform work, consume media, and maneuver the endlessly vast internet in 2018. On Tuesday, September 4th, Google turned 20 years old, marking one of the most staggeringly influential runs for any corporation in history.

Even though I got into computing way before Google became a household name, it still feels like Google is a lot older than it actually is - almost as if it's always been there. While the company has - like every other technology company - terrible ethics, there's no denying it's a major success story.

Note 5, S6 edge+ will not get monthly security updates

Samsung has now confirmed that the Galaxy Note 5 and the Galaxy S6 edge+ will no longer receive monthly security updates. It's not surprising as the Galaxy S6 has already dropped off the list of devices receiving monthly security updates earlier this year. The aforementioned devices will not be receiving security patches regularly every month going forward.

Those are €800-1000 computers released only 3 years ago, probably available in stores for years, maybe even now - and just like that, no more security updates. Why do we and our lawmakers just allow these companies to get away with this? It's high, high time we mandate a minimum lifespan for these expensive devices.

Firefox 62.0 released

Earlier today, Mozilla pushed Firefox 62 for desktop and Android. With the release, Mozilla has introduced an UI refresh for the new tabs page as well as several dialogs like for adding or editing a bookmark, several performance enhancements to speed up browsing, and some security enhancements.

The first change that users will notice is the refreshed new tab page; with Firefox 62 users can now display up to four rows of top sites, Pocket stories and highlights. Currently, you get one row of top sites, and depending on your location you may not even get shown Pocket stories. Another UI changes that you’ll notice is in the menu where you can toggle tracking protection on and off easily.

On the performance side of things, Windows users will now get improved graphics rendering without accelerated hardware using Parallel-Off-Main-Thread Painting. Additionally, support for CSS Shapes allows for richer web page layouts, and CSS Variable Fonts support allows the browser to render "beautiful typography" with a single font file.

I don't feel it makes any sense to highlight every browser release, but randomly picking a release to talk about here on OSNews only makes sense - especially for a loyal mainstay like Firefox.

PlayStation 2’s repair services end after almost 20 years

18 years ago, Sony launched what would become one of the biggest icons in the gaming industry, the PlayStation 2. The level of popularity of the console is still unmatched to this day, and it remains at the top spot as the best-selling gaming platform of all time.

Perhaps because of that tremendous popularity, Sony kept the PlayStation 2 around for a long time. It was only in 2013 - not long before the PlayStation 4 made its way to the market - that the company decided to stop manufacturing it. Now, it's time for the final nail in the coffin. After a whopping 18 years of providing support and repair services, Sony Japan will no longer service consoles that arrive at the PlayStation Clinic after September 7. Back in June, the company had warned customers that they would have to make any support requests before August 31, and it seems that this is the last week for consoles to be serviced.

I hope my bright pink PlayStation 2 Slimline doesn't break down any time soon.

Our USB-C dongle hell is almost over

It's almost the end of 2018, but I'm finally able to say that almost all of my day-to-day devices have been replaced with a USB-C option, or can be replaced in the near future.

I bought a fully specced out Dell XPS 13, and it's the first laptop I've ever had that charges over USB-C. Cool and all, but I quickly realized that only the 27W charger it came with actually charges it; other USB-C chargers simply don't work because they're not powerful enough.

I'm not quite sure USB-C is there, yet.