Slashdot Mirror

Trailrunner7 writes: Researchers at HP's Zero Day Initiative have disclosed full details and proof-of-concept exploit code for a series of bugs they discovered that allow attackers to bypass a key exploit mitigation in Internet Explorer. The disclosure is a rarity for ZDI. The company typically does not publish complete details and exploit code for the bugs it reports to vendors until after the vulnerabilities are fixed. But in this case, Microsoft has told the researchers that the company doesn't plan to fix the vulnerabilities, even though the bugs were serous enough to win ZDI's team a $125,000 Blue Hat Bonus from Microsoft. The reason: Microsoft doesn't think the vulnerabilities affect enough users.

The vulnerabilities that the ZDI researchers submitted to Microsoft enable an attacker to fully bypass ASLR (address space layout randomization), one of the many mitigations in IE that help prevent successful exploitation of certain classes of bugs. ZDI reported the bugs to Microsoft last year and disclosed some limited details of them in February. The researchers waited to release the full details until Microsoft fixed all of the flaws, but Microsoft later informed them that they didn't plan to patch the remaining bugs because they didn't affect 64-bit systems.

merbs writes: Thus far, no other candidate has said they're going to make climate change their top priority. Martin O'Malley has not only done that, but he has outlined a plan that would enact emissions reductions in line with what scientists say is necessary to slow global climate change—worldwide emissions reductions of 40-70 percent by 2050. He's the only candidate to do that, too. His plan would phase out fossil-fueled power plants altogether, by midcentury.

lpress writes: OneWeb has announced that Airbus will manufacture their Internet-connectivity satellites and told us more about their plans and progress. Both OneWeb and their competitor SpaceX have the same goal — global Internet connectivity and backhaul using satellite constellations, but their technologies and organizational strategies are different. SpaceX will use many more satellites than OneWeb, but they will be smaller, shorter-lived, cheaper and orbit at a lower altitude. They are also keeping more of the effort in-house. This is competitive capitalism at its best — let's hope both succeed.

An anonymous reader writes: Louisiana Governor Bobby Jindal has vetoed a plan to acquire license plate reading cameras in the state. Law enforcement agencies nationwide use such cameras to scan cars and compare them to a "hot list" of stolen or wanted vehicles. That data is kept for weeks, or even years In some cases. Jindal wrote in a signing statement: "Senate Bill No. 250 would authorize the use of automatic license plate reader camera surveillance programs in various parishes throughout the state. The personal information captured by these cameras, which includes a person’s vehicle location, would be retained in a central database and accessible to not only participating law enforcement agencies but other specified private entities for a period of time regardless of whether or not the system detects that a person is in violation of vehicle insurance requirements. Camera programs such as these that make private information readily available beyond the scope of law enforcement, pose a fundamental risk to personal privacy and create large pools of information belonging to law abiding citizens that unfortunately can be extremely vulnerable to theft or misuse. For these reasons, I have vetoed Senate Bill No. 250 and hereby return it to the Senate."

An anonymous reader writes: San Diego city officials Monday expressed support for a plan called "Vision Zero" to make San Diego's roadways safer for pedestrians and bicyclists over the next 10 years. Vision Zero aims to eliminate traffic deaths in the city by 2025 by improving crosswalks, raising medians, creating buffers between vehicle and bicycle lanes, and improving sidewalks. NBC 7 in San Diego reports: "Allison Street next to La Mesa City Hall provides a blueprint of sorts. Diagonal parking lines reduce the size of the street. Jim Stone, Executive Director of Circulate San Diego, says studies show smaller streets help slow traffic. Then there's the crosswalk with lights on the ground and signs that alert drivers when someone crosses. The curb extension also provides better visibility. 'They can see cars coming but more importantly the cars can see them coming,' Stone said about the curb extensions. 'So it's a great way to improve pedestrian safety.'"

HughPickens.com writes: The NY Times reports that although no single lapse or mistake in security enabled two killers to break out of the Clinton Correctional Facility two weeks ago, it is now clear that an array of oversights, years in the making, set the stage for the prison break and for the ensuing manhunt. According to the Times, a sense of complacency had taken hold that in some ways might have been understandable: "There had not been an escape from the 170-year-old prison in decades, and officials say no one had ever broken out of the maximum-security section. ... 'As the months go by, years go by, things get less strict,' says [retired corrections officer] Keith Provost. ... [U]nlike many prisons and jails across the country, there are no video cameras on the cellblocks at the Clinton facility that might have detected suspicious activity." And although prison rules forbid putting sheets across cell bars to obstruct viewing, in practice, officers say, inmates frequently were allowed to hang sheets for lengthy periods. Officials say there is a good chance that the two men had been at work on their plan for weeks, maybe months. Night after night, the authorities have come to believe, the two men stuffed their beds with crude dummies, slipped out of holes they had cut in the back of their cells and climbed down five stories using the piping along the walls. They then set to work inside the tunnels under the prison, spending hours preparing their path of escape before returning to their cells unobserved. No contemporary prison break has reminded me so much of the 1962 breakout from Alcatraz (theories on survival aside).

An anonymous reader writes: Several days ago, news broke that Samsung's keyboard software on their Galaxy series of cell phones had a glaring security issue that left 600 million devices vulnerable to attackers. The company has now fixed the flaw internally, and is making plans to roll out security updates to affected devices. They say the likelihood of an actual attack is low, because a particular set of conditions need to be met before any damage could be done.

ptorrone writes: Open source hardware pioneer and founder of Adafruit Limor "Ladyada" Fried sat down and interviewed the new CEO of MakerBot, Jonathan Jaglom. She asked some really tough questions had some suggestions for them, too, if they're going to turn things around. Discussed: Is there a desire for MakerBot to patch things up with the open source community? Jaglom wants to assure the 3D-printing community there are not any plans for filament DRM, and it was nice to hear him say "patents are not the way to win." Lastly, Fried suggested the open-sourcing of some specific elements of the MakerBot to get back to its open-source hardware roots.

ourlovecanlastforeve writes: A few days ago Sprint announced their intent to stop throttling certain customers' bandwidth in the wake of the FCC fining ATT $100,000,000 for doing the same. Sprint has now begun circulating an internal memo to their front-line reps that the 12-month warranty on non-branded accessories, a featured selling point, will be eliminated. Additional rumors are emerging that Sprint may increase prices on unlimited data plans and stop offering wireline long distance service.

An anonymous reader writes: Amazon has a new plan to keep self-published authors honest: they're only going to pay them when someone actually reads a page. Peter Wayner at the Atlantic explores how this is going to change the lives of the authors — and the readers. Fat, impressive coffee table books are out if no one reads them. Thin, concise authors will be bereft. Page turners are in.

New submitter sackvillian writes: An article in Wired reports on the ongoing development of the Fairphone 2, planned for European release in September. The phone is the follow-up to the Indiegogo-funded original that inevitably had room for improvement. The manufacturers promise a modular phone with an emphasis on repairability and expandability, with otherwise respectable specs (Qualcomm Snapdragon 801, 2GB RAM, Dual SIM, 8MP camera). It runs on a customized Android 5.1. So, the inevitable question arises — would you be willing to sacrifice some performance (and pay a significant premium) for a phone that's repairable, moddable, and ethical?

stephendavion writes: Twitter will start curating tweets on live events, the microblogging service said, as it plans major changes to make its real-time news feed more user friendly. Dubbed Project Lightning, the changes will let users follow events instead of just people, and instantly upload photos and videos that can be shared across websites, social news and entertainment website Buzzfeed reported on Thursday. Another reader points out coverage at Wired, which argues that this is a bigger change for Twitter than it sounds: "What Project Lightning represents, more than anything, is the long-overdue death of the Twitter timeline. (Or its demotion, at the very least, in the hope it’ll quietly resign.) With this change, Twitter doesn’t have to look like an endlessly flowing, context-free stream of tweets; instead, you can see a hand-curated set of tweets, links, images, and videos related to what’s happening right now. ... In short, this effort puts a stake through the idea that Twitter is a social network. It’s not. It never should have tried to be. It’s not about people, jokes, and #brands. It’s about information, about news and pictures and stories."

schwit1 writes: UrtheCast has released high resolution videos of three Earth cities taken from its camera on ISS. Take a look. The cameras are quite successful in capturing the motion of vehicles on highways and road, which is amazing considering the vibrations that ISS experiences merely from astronaut movements. Quartz reports: "The company plans to offer the imagery in several tiers, from a free video feed on its website to an API that will allow customers, including corporations, governments and individuals, to purchase imagery data from its database or make real-time requests for a look at a given spot on the earth. The cameras scan the ground under the ISS, which tracks the earth between about 51 degrees north and south latitude."

An anonymous reader writes: Let's Encrypt, the project that hopes to increase the use of encryption across websites by issuing free digital certificates, is planning to issue the first ones next month. Backed by the EFF, the Mozilla Foundation, the Linux Foundation, Akamai, IdenTrust, Automattic, and Cisco, Let's Encrypt will provide free-of-charge SSL and TSL certificates to any webmaster interested in implementing HTTPS for their products. The Stack reports: "Let's Encrypt's root certificate will be cross-signed by IdenTrust, a public key CA owned by smartphone government ID card provider HID Global. Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000. It is also a complication for operators to set up encryption for larger web services. Let's Encrypt aims to remove these obstacles by eliminating the related costs and automating the entire process."

mikejuk writes: Microsoft, after putting a lot of effort into persuading us that Universal Apps are the way of the future, pulls the plug on Skype modern app, to leave just the desktop version. Skype is one of Microsoft's flagship products and it has been available as a desktop Win32 app and as a Modern/Metro/WinRT app for some time. You would think that Skype would support Universal Apps, there are few enough of them — but no. According to the Skype blog: 'Starting on July 7, we're updating PC users of the Windows modern application to the Windows desktop application, and retiring the modern application.' Microsoft is pushing Windows 10 Universal Apps as the development platform for now and the future, but its Skype team have just disagreed big time. If Microsoft can't get behind the plan why should developers? (Also at Windows Central and VentureBeat.)

New submitter surfdaddy writes: In order to protect the entrenched big aerospace companies, the Congress has increased NASA's budget for FY2016 but has cut funding for "commercial crew." Commercial crew is the funding used by SpaceX for the planned initial manned launches in the first half of 2017. With this cut, the launch of U.S. astronauts from U.S. soil using U.S. rockets will be delayed two years, and we will continue to send millions of dollars to Russia for launch services. "Senate appropriators suggested that NASA’s plans announced earlier this year to procure Soyuz seats for missions in 2018 indicated that the agency was not confident at even this early stage that the two companies with commercial crew contracts, Boeing and SpaceX, could remain on schedule to begin flights in 2017. ...

jfruh writes: As part of a new user agreement created in preparation for its spinoff from eBay as an independent company, PayPal told users that the only way to avoid advertising robocalls from PayPal and its 'partners' was to stop using the service. This caused something of a firestorm, and now the FCC is saying the policy may violate Federal law, which requires an explicit opt-in to receive such messages.

An anonymous reader writes: Last week, The Guardian got its hands on documents indicating NASA would be working with Verizon to monitor civilian and commercial drones around the U.S. using phone network towers. Now, NASA has confirmed its plans for a drone traffic control system, saying that it wants to help "define" this new generation of aviation. They are testing ways of communicating with drones in flight, both for providing helpful information to drones and collecting information about them. For example, the ATC system could send real-time weather updates to the drones, and inform them of no-fly zones. It could also monitor a drone's battery life and compare its flight path to surrounding terrain. NASA has gathered over 100 organizations to contribute to this project, and they're looking for more. "One of the biggest challenges to integrating UAS into the national airspace beyond line of sight is developing a system that enables the aircraft to see and be seen by other aircraft." This is where the involvement of Verizon and other telecoms is important. NASA is holding a convention next month to develop the idea further.

An anonymous reader writes: At its pre-E3 press conference today, Oculus announced a partnership with Microsoft. The company plans to launch a new Rift headset early next year that will be packaged with a wireless Xbox One controller. Oculus will ship the controllers with the recently announced Xbox wireless adapter. Xbox chief Phil Spencer said. "We believe we'll be able to create state of the art virtual reality experiences with the Oculus Rift on top of Windows."

theodp writes: During public hearings on WA State's House Bill 1813, which took aim at boys' historical over-representation in K-12 computer classes, the Office of the WA State Superintendent of Public Instruction voiced concerns that by relying on the generosity of corporations, wealthy individuals, and nonprofits to fund STEM, computer science, and technology programs, learning opportunities would be limited to a small group of students, creating disparity of opportunity. "If this is a real priority," pleaded Chris Vance, "fund it fully" (HB 1813, like the White House K-12 CS plan, counts on philanthropy to make up for tax shortfalls). But legislators in the WA House and Senate — apparently more swayed by the pro-HB 1813 testimony of representatives from Microsoft and Microsoft-backed TEALS and Code.org — overwhelmingly passed the bill, sending it to Governor Jay Inslee for his signature. Not to worry. On Wednesday, the bill was signed into law by Gov. Inslee, who was perhaps influenced by the we-need-to-pass-HB-1813 blogging of Microsoft General Counsel and Code.org Board member Brad Smith, who coincidentally is not only responsible for Microsoft's philanthropic work, but was also co-chair of Gov.-elect Inslee's transition team. The WA state legislative victory comes less than 24 hours after the San Francisco School Board voted to require CS instruction beginning with preschool.