Google Engineer Admits Scrubbing Java References in Android

Found on eWEEK on Friday, 13 May 2016
Browse Software

One email shown to the jury referred to Bornstein calling for any mention of the "J word" to be removed when Android was released in 2007, months after Apple had introduced the first iPhone. The list of words to be scrubbed also included "Oracle," "license" and "Sun," Oracle contended.

As a result, Oracle has been on a seven-year legal mission to reclaim damages -- in the realm of $9.3 billion -- it believes it is owed by Google.

If you use someone else's code, at least admit it. It's not that complex.

The NYPD Was Ticketing Legally Parked Cars; Open Data Put an End to It

Found on Slashdot on Thursday, 12 May 2016
Browse Legal-Issues

Data analyst Ben Wellington claims that that the NYPD has been systematically ticketing legally parked cars for years. Doing so, he says, helps NYPD collect millions of dollars every year.

"Mr. Wellington's analysis identified errors the department made in issuing parking summonses. It appears to be a misunderstanding by officers on patrol of a recent, abstruse change in the parking rules. We appreciate Mr. Wellington bringing this anomaly to our attention. The department's internal analysis found that patrol officers who are unfamiliar with the change have observed vehicles parked in front of pedestrian ramps and issued a summons in error."

What a convenient misunderstanding.

How Linux Kernel Development Impacts Security

Found on eWEEK on Wednesday, 11 May 2016
Browse Software

At CoreOS Fest, Greg Kroah-Hartman, maintainer of the Linux kernel, declares that almost all bugs can be security issues.

From a security perspective, the rate of change and bug fixes are also noteworthy, as Kroah-Hartman emphatically said almost all bugs can be a security issue. Because he doesn't always know which bug could be a security vulnerability, he said all patches are important.

Otherwise bugs would probably be called features by marketing people.

Judge: Star Trek fanfic creators must face CBS, Paramount copyright lawsuit

Found on Ars Technica on Tuesday, 10 May 2016
Browse Legal-Issues

In a blog post about the upcoming trial dates, leader of Axanar Productions Alec Peters seemed undeterred by the news, writing, "I am happy to say our trial got moved up to January 31, 2017... That means, we could win this case and have Axanar back in production in March, 2017. Yes, we will finish Axanar!"

In another blog post, Peters wrote that Axanar Productions is trying to settle with CBS and Paramount "so we can move forward with telling the story of AXANAR in a way that satisfies both the studios and the over ten thousand fans who financially supported our project.”

Sue the fans and stiffle their creativity and, in the long run, their interest in the series. That's not really a good idea.

Researcher arrested after reporting pwnage hole in elections site

Found on The Register on Monday, 09 May 2016
Browse Legal-Issues

Vanguard Cybersecurity man David Levin was arrested after disclosing SQL injection vulnerabilities that revealed admin credentials in the Lee County state elections web site.

"Dave didn't cause these problems, he only reported them," Sinclair says, adding that the elections office could not previously detect intrusions.

Just sell the next vulnerability on their site on some underground boards.

Microsoft to Windows Live Mail 2012 users: Switch now

Found on Infoworld on Sunday, 08 May 2016
Browse Software

Windows Live Mail 2012 users are on notice: Switch to a modern email client or lose access to any Microsoft email accounts they have.

Ironically, Gmail users will be able to still access the Windows Live Mail 2012 client -- that service operates with the older protocols supported in Windows Live Mail.

Imagine a world where there would be well established and implemented protocols for something like emails; who knows, maybe one could name them SMTP, IMAP or POP3.

Crack'n'hack stack Phrack's back, Jack!

Found on The Register on Saturday, 07 May 2016
Browse Various

The release comes four years after the previous publication and more than 30 years since the first issue of Phrack was posted. Issue number 69 will also usher in a new publishing format Phrack calls "Paper Feed" that will see new articles posted between issue releases.

First released in 1985 via BBS, Phrack has been staffed by dozens of editors and contributors in its three-plus decades. The long-running zine has also hosted a number of notable articles, including the famed Hacker Manifesto and Smashing The Stack For Fun And Profit.

"That is not dead which can eternal lie"

Stop resetting your passwords, says UK govt's spy network

Found on The Register on Friday, 06 May 2016
Browse Various

The UK government has, on World Password Day, repeated its advice against the common security practice of routinely changing passwords.

"The problem is that this doesn’t take into account the inconvenience to users – the ‘usability costs’ – of forcing users to frequently change their passwords," says CESG. "The majority of password policies force us to use passwords that we find hard to remember."

There is no problem with routinely changing your passwords at all. With so many online services which require authentication, and the fact that you should never use the same password for two different services, you have to handle dozens of passwords already. That's where password managers come into play: you just update your password in there and only have to remember your master password. With that approach, you can store hundreds of unique, complex passwords easily and change them from time to time. Of course, there are reasons why government agencies don't want that...

Microsoft no longer allows administrators to block Windows Store access in Windows 10 Pro

Found on ZDNet on Thursday, 05 May 2016
Browse Software

Up until a month ago, admins could use Group Policy to shut off employees' access to Windows Store if they were running Windows 10 Pro. Controlling this access is a requirement for some businesses.

A Microsoft spokesperson confirmed the change, noting that businesses who need to shut off Store access have no recourse other than Windows 10 Enterprise.

Driving visibility and use of Windows Store has been one of Microsoft's goals with Windows 10.

There is barely any other company who tries this hard to annoy their paying customer base. Usually, you would listen to their requests and demands, and deliver a product tailored to that. Not Microsoft. That company prefers to force unwanted changes down the throats of their users.

Hacker trades 272 million passwords for social media likes

Found on CNet News on Wednesday, 04 May 2016
Browse Internet

The passwords and usernames belonged to accounts from Russia's largest email provider, Mail.Ru, as well as a smaller number of accounts each from Gmail, Yahoo Mail and Microsoft Hotmail. Though it doesn't mean there was a breach of the email services themselves, the cache, first reported by Reuters, contains a huge amount of data.

Even though the hacker practically gave the login information away for free in the data dump revealed Wednesday, it's valuable to email users, who would do well to change their passwords often and never reuse them on other accounts, Holden said.

People better get used to those numbers. It looks like password dumps get bigger every time, even though everybody talks about security.