|
|
Subscribe / Log in / New account

Brief items

Security

Major Browsers to Prevent Disabling of Click Tracking Privacy Risk (BleepingComputer)

BleepingComputer reports that browser developers are removing the ability to disable "ping=" click tracking. "Google Chrome also enables this tracking feature by default, but in the current Chrome 73 version it includes a 'Hyperlink auditing' flag that can be used to disable it from the chrome://flags URL. In the Chrome 74 Beta and Chrome 75 Canary builds, though, this flag has been removed and there is no way to disable hyperlink auditing." Firefox still allows this "feature" to be disabled (and disables it by default).

Comments (49 posted)

Security quotes of the week

Secret Service agent Samuel Ivanovich, who interviewed [Yujing] Zhang on the day of her arrest, testified at the hearing. He stated that when another agent put Zhang's thumb-drive into his computer, it immediately began to install files, a "very out-of-the-ordinary" event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer, Ivanovich said. The analysis is ongoing but still inconclusive, he testified.
The Miami Herald reports on a security breach at Mar-a-Lago

As a taxpayer, I'm very concerned about where Agent Ivanovich's laptop is and where it's been since he plugged a malicious USB into it. If this was the Secret Service quick reaction playbook, perhaps Zhang planned to get caught all along (not joking).
Jake Williams comments on the above

To effect the remote steering attack, the researchers had to bypass several redundant layers of protection, but having done this, they were able to write an app that would let them connect a video-game controller to a mobile device and then steer a target [Tesla] vehicle, overriding the actual steering wheel in the car as well as the autopilot systems. This attack has some limitations: while a car in Park or traveling at high speed on Cruise Control can be taken over completely, a car that has recently shifted from R to D can only be remote controlled at speeds up to 8km/h.

[...] Much more seriously, they were able to use "small stickers" on the ground to effect a "fake lane attack" that fooled the autopilot into steering into the opposite lanes where oncoming traffic would be moving. This worked even when the targeted vehicle was operating in daylight without snow, dust or other interference.

Cory Doctorow

Comments (none posted)

Kernel development

Kernel release status

The current development kernel is 5.1-rc4, released on April 7. Linus said: "Smaller than rc3, I'm happy to say. Nothing particularly big in here, just a number of small things all over."

Stable updates: none have been released in the last week. The 5.0.7, 4.19.34, 4.9.169, and 4.14.111 updates were sent out for review on April 4, but have not yet been released.

Comments (2 posted)

Microsoft Research: A fork() in the road

Here's a research paper from Andrew Baumann, Jonathan Appavoo, Orran Krieger, and Timothy Roscoe, published on the Microsoft Research site, arguing that the fork() system call is a fundamental design mistake. "As the designers and implementers of operating systems, we should acknowledge that fork’s continued existence as a first-class OS primitive holds back systems research, and deprecate it. As educators, we should teach fork as a historical artifact, and not the first process creation mechanism students encounter." The discussion of better alternatives is limited, though.

Comments (140 posted)

Quote of the week

It only takes a night for me to forget how my code works. Then I need a whole day long to recollect. But once I'm done the next night starts.

So I'm not against comments, thanks :-)

Frederic Weisbecker

Comments (none posted)

Distributions

Schaller: Preparing for Fedora Workstation 30

Christian Schaller describes a long list of desktop improvements coming in the Fedora 30 release. "Screen sharing support for Chrome and Firefox under Wayland. The Wayland security model doesn’t allow any application to freely grab images or streams of the whole desktop like you could under X. This is of course a huge improvement in security, but it did cause some disruption for valid usecases like screen sharing with things like BlueJeans and Google Hangouts. We been working on resolving that with the help of PipeWire. We been at it for some time and things are now coming together. Chrome 73 ships with everything needed to make this work with Chrome."

Comments (36 posted)

Distribution quotes of the week

The absense of a centralized, informal Debian package repository where trusted users could upload their own packaging scripts has been long-forgotten. As an inevitable result, many user packaging scripts exist in the wild, scattered like stars in the sky, with varied packaging quality. Their existence reflects our users' demand, especially the experienced ones', that has not been satisfied by the Debian archive. Such idea about informal packaging repository has been demonstrated successful by the Archlinux User Repository (AUR). Hence, it should be valuable to think about it for Debian.
Mo Zhou

I think this is one of the strongest slates of candidates we've had for DPL in years. Voting is going to be extremely difficult for me for the best reasons possible. I think all of the candidates would do an excellent job as DPL in their own ways; personally, I kind of want to pick all of them. :)
Russ Allbery

Comments (1 posted)

Development

Development quotes of the week

We answer this question in the affirmative: it is possible to smear paint on the wall without creating a valid Perl program. We employ an empirical approach, using optical character recognition (OCR) software, which finds that merely 93% of paint splatters parse as valid Perl. We analyze the properties of paint-splatter Perl programs, and present seven examples of paint splatters which are not valid Perl programs.
Colin McMillen

So to be 100% clear: Mailpile is not dead!

Far from it, I'm way too proud of this app to just walk away and let it die. But for now, Mailpile has been demoted to a part time job at most, and a beloved hobby at worst. Considering how unproductive I had become, you may not even notice any difference...

Bjarni Rúnar

Releasing a proprietary project as open source is a bit like an iceberg. Some very visible tasks, like choosing a brand or license, can take a huge amount of attention, while most of the work is under the surface, and not related to the open source code at all.
Dave Neary

Comments (4 posted)

Page editor: Jake Edge
Next page: Announcements>>


Copyright © 2019, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds