These unlucky people have names that break computers

Found on BBC News on Sunday, 27 March 2016
Browse Software

When Jennifer Null tries to buy a plane ticket, she gets an error message on most websites. The site will say she has left the surname field blank and ask her to try again.

But to any programmer, it’s painfully easy to see why “Null” could cause problems for a database. This is because the word “null” is often inserted into database fields to indicate that there is no data there.

For people like Null, though, it’s likely that they will encounter headaches for a long time to come. Some might argue that those with troublesome names might think about changing them to save time and frustration.

Others might argue that developers do their job right and validate input, instead of trying to stuff everything unchecked into the database via stitched-together SQL queries, instead of using a sane approach, like prepared statements.

Mud sticks: Microsoft, Windows 10 and reputational damage

Found on The Register on Friday, 25 March 2016
Browse Software

So, Windows 10 isn't the saviour of the PC industry after all – and is beginning to look more like a Windows Vista than a Windows XP.

Two things were unusual about this edition of Windows, and each alone could have posed issues for any big software company. One was a result of the new ethos of "Windows as a service," meaning that the software wasn't finished.

The other, and I believe more damaging, factor was that all this was performed in public. Through the Insider programme, Windows 10 development turned into a giant user feedback experiment, and this is when the reputational harm was done.

Not mentioned, but another big reason, is the forcefulness used by Microsoft to shove the new operating system down the throats of the users. Automatic upgrades sneak in with the normal security update cycles, a decision which made many users disable updates altogether, leading to more unpatched Windows machines out there which can join botnets.

How one developer just broke Node, Babel and thousands of projects in 11 lines of JavaScript

Found on The Register on Wednesday, 23 March 2016
Browse Software

When NPM took Kik away from the developer, he was furious and unpublished all of his NPM-managed modules. "This situation made me realize that NPM is someone’s private land where corporate is more powerful than the people, and I do open source because Power To The People," Koçulu blogged.

With left-pad removed from NPM, these applications and widely used bits of open-source infrastructure were unable to obtain the dependency, and thus fell over. Thousands, worldwide. Left-pad was fetched 2,486,696 downloads in just the last month, according to NPM. It was that popular.

One of the big problems is that soc-called developers prefer to include all verious sorts of (sometimes even obscure) modules, creating a dependeny hell when it would just take a few lines of your own code to avoid all that.

Windows 10 Upgrade Reportedly Starting Automatically on Windows 7 PCs

Found on Softpedia on Saturday, 12 March 2016
Browse Software

A post on reddit that has received quite a lot of attention in the last few hours reveals that “Windows 7 computers are being reported as automatically starting the Windows 10 upgrade without permission,” with several users confirming in the comment section that this is indeed the case.

“Depending upon your Windows Update settings, this may cause the upgrade process to automatically initiate on your device. Before the upgrade changes the OS of your device, you will be clearly prompted to choose whether or not to continue,” he said.

How come nobody has sued Microsoft yet? Not only are they misleading users with "updates", but now also enforcing an OS upgrade, wasting thousands of man-hours because users have to get used to the new OS, or keep their admins busy with questions and complains.

Windows patch KB 3139929: When a security update is not a security update

Found on InfoWorld on Thursday, 10 March 2016
Browse Software

If Microsoft's documentation is correct, installing Patch Tuesday's KB 3139929 security update for Internet Explorer also installs a new Windows 10 ad-generating routine called KB 3146449.

It's important to note that KB 3146449 is not installed separately. You can't remove it. If you look in your installed updates list, KB 3146449 doesn't appear. Instead, it's baked into the IE security patch KB 3139929. The only way to get rid of the new advertising inside Internet Explorer 11 is to remove the security patch entirely.

Another reminder to keep automatic updates always disabled. It's a pain to see that you have to invest your time to keep adware, spam and nagware off a system when you just want to update it.

DRM defeaters defeated? SlySoft ceases operations

Found on Ars Technica on Wednesday, 24 February 2016
Browse Software

In a cryptic message posted on its website, SlySoft, a company that made several applications devoted to defeating DRM schemes, announced that it has shut down. “Due to recent regulatory requirements we have had to cease all activities relating to SlySoft Inc.,” reads the brief message. “We wish to thank our loyal customers/clients for their patronage over the years.”

Headquartered in the Caribbean nation of Antigua, the software firm had been the target of vitriol and legal threats from the film industry throughout the years.

Maybe they can find another country which does not give in under US pressure, or does not care about it and re-open. Otherwise, DVD and BD sales might go down, since most of the users legally bought the media and just want to use it on the different media systems they own; something that the content industry has failed to offer. Users could also skip trailers, piracy warning and whatever else, and skip right to the movie. A problem which pirates never had.

Avast SafeZone Browser Lets Attackers Access Your Filesystem

Found on Softpedia on Sunday, 07 February 2016
Browse Software

While Chromodo was caught disabling a crucial security feature called Same Origin Policy (SOP), Avast's Chromium fork is much worse, bringing a series of problems, one of which allows attackers to list and read files from your computer after you click a simple malicious link.

An attacker wouldn't even need an info-stealing malware strain if they knew their target had Avast's SafeZone installed, a browser that was dumping everything out in the open.

"Additionally, you can send arbitrary *authenticated* HTTP requests, and read the responses," Mr. Ormandy also explained. "This allows an attacker to read cookies, email, interact with online banking and so on."

It makes you wonder what is worse: the malware itself, or the products which claim to protect you.

Microsoft makes Windows 10 a 'recommended update' for Windows 7 and 8.1 users

Found on Betanews on Wednesday, 03 February 2016
Browse Software

Microsoft has been accused of pushing Windows 10 rather aggressively, and the company's latest move is going to do nothing to silence these accusations. For Windows 7 and Windows 8.1 users, Windows 10 just became a 'recommended update' in Windows Update.

For anyone who has Automatic Updates turned on, this means that they will simply be given the option of downloading and installing (assuming installation files have not already been downloaded, that is...). If the 'Give me recommended updates the same way I receive important update' option is enabled, the update will not only be downloaded, but the installation will be started.

It always has been a good decision to disable Automatic Updates right after you installed Windows. It was a good idea for security updates, but using it to force users to an OS upgrade is reason enough to turn it off.

Hot Potato Exploit Gives Attackers the Upper Hand in Multiple Windows Versions

Found on Softpedia on Saturday, 23 January 2016
Browse Software

All of these security flaws have been left unpatched by Microsoft, with the explanation that by patching them, the company would effectively break compatibility between the different versions of their operating system.

Some proof-of-concept videos were also uploaded on YouTube, and you can see the researchers break Windows versions such as 7, 8, 10, Server 2008 and Server 2012.

Compatibility is ranked higher than security? That's some pretty bad ranking there.

Linux Foundation quietly drops community representation

Found on Matthew Garrett on Thursday, 21 January 2016
Browse Software

These changes all happened shortly after Karen Sandler announced that she planned to stand for the Linux Foundation board during a presentation last September.

Karen is the executive director of the Software Freedom Conservancy, an organisation involved in the vitally important work of GPL enforcement. The Linux Foundation has historically been less than enthusiastic about GPL enforcement, and the SFC is funding a lawsuit against one of the Foundation's members for violating the terms of the GPL.

Of the people, by the people, for the people. That's what the idea behind Linux was.