Slashdot Mirror
Students, Start-Up Team To Create Android 'Master Key' Patch App
chicksdaddy writes "The saga of the application-signing flaw affecting Google's Android mobile phones took another turn Tuesday when a Silicon Valley startup teamed with graduate students from Northeastern University in Boston to offer their own fix-it tool for hundreds of millions of Android phones that have been left without access to Google's official patch. Duo Security announced the availability of an Android utility dubbed 'ReKey' on Tuesday. The tool allows users to patch the so-called 'Master Key' vulnerability on Android devices, even in the absence of a security update from Android handset makers and carriers who service the phones, according to a post on the Duo Security blog. Jon Oberheide, the CTO of Duo Security, said that ReKey provides an in-memory patch for the master key vulnerability, dynamically instrumenting the Dalvik bytecode routines where the vulnerability originates, patching it in-memory. Oberheide said that ReKey will also 'hook' (or monitor) those routines to notify you if any malicious applications attempt to exploit the vulnerability. Despite the availability of a patch since March, many Android users remain vulnerable to attacks that take advantage of the application signing flaw. That is because Android handset makers have been slow to issue updates for their handsets. For platforms (HTC and Samsung) that have been patched, carriers delayed the rollout to customers further. 'The security of Android devices worldwide is paralyzed by the slow patching practices of mobile carriers and other parties in the Android ecosystem,' said Oberheide. However, the fragmentation of the Android ecosystem is significant enough that it is no longer feasible for Google to take over responsibility for distributing patches. Third parties may need to step in to fill the void."
A related article makes the case that the release of the Master Key vulnerability started an important conversation within the open source community.
Leaves out 99% of the devices out there.
---- Booth was a patriot ----
The patching thing is a bit of a joke. If I had an android phone, I'd want an equivalent to Ubuntu to provide a 3rd-party OS with regular updates. I think 3rd-party Android distributions are out there, do they handle security updates well?
Looks like a great way for someone to create a fake update and publicize it as a third-party patch. Google needs to make good on do no evil by proactively doing good.
The reviews on the Play store are showing a fairly high possibility of a bootloop. While I'm all for open source and public patches where appropriate, I expect I'll be passing on this one for now.
I'm guessing someone's going to sue them for their efforts. As we've seen time and again, no good deed goes unpunished.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
But, but, if it's no longer feasible for Google to provide patches, how come he says his company, with vastly fewer resources, can do it?
It stands to reason that if Google can't patch your phone because of "fragmentation of the ecosystem," nobody else can either. That makes me not at all anxious to install his patch.
force them to give the unlock codes no questions asked even if you are on a phone payment plan.
With desktop Windows and Linux, the latest version works on all (powerful enough) computers. Why can't it be this way on Android?
It is that way on Android, you can install vanilla Android from AOSP on just about any device that's powerful enough if the bootloader is not locked by the OEM. Problem - as I understand it - is most devices aren't powerful enough to run the latest version. Of course this is compounded by fragmentation within versions, for every version of Android most OEMs create their own version of that. That is why the Galaxy S didn't get an official ICS update, the official Android versions for it were forked versions of the AOSP versions and these Samsung forks required more RAM and ROM than the Galaxy S had even though the AOSP version of that Android version worked find on it, that is why fragmentation is a problem.
And by you, I mean all you people who don't merely tolerate the behavior of the cellular phone companies, but actually encourage it by giving them silly amounts of money every month.
It's YOUR DEVICE. We've been down this goddamn road before. Nobody remembers Ma Bell? Nobody remembers Ma Bell owning all devices connected to their precious network? Nobody remembers what a debacle that was? How has this been allowed to arise again?
A smartphone is a stupid name for a pocket computer. And apparently, thanks to the cellular companies, it's going to behave just as badly as a desktop computer of yesteryear. It's like every Windows 98 machine ever shipped was connected to the modern internet yesterday. Madness.
And it's all your fault.
This doesn't solve the actual problem in the handset world, especially with android.
That problem?
Closed source binary drivers for novelty features in specific handsets that are incompatible with newer android builds, due to improved/newer linux kernels being in them.
Take for instance, my horribly crippled, antique android device:
SGH-T839 (Sidekick 4G)
This device runs Froyo, and has been officially abandoned by T-mobile and Samsung for almost 2 years now. It has a 1ghz hummingbird cpu, and approx 512mb of ram, of which about 300mb is useable for programs. It has a strange camera driver, to make use of both rear facing and front facing cameras, and a strange hardware keyboard driver.
It is otherwise very similar inside to an older galaxy based device.
The only roms in existence for this device are recooked images of the (bloated as hell) stock rom. There is no CM support. There is no official ICS upgrade, despite it being theoretically possible. Nada. This, despite the complete source for the kernel of the device being GPLed by samsung when they EOLed it, and said sources being publicly available.
The device had a root access ad bootloader unlocker within weeks of release.
This community patch is the only security fix I have been able to apply to this handset in a very long time.
IMHO, better option is to require handset makers to offer at least one major android revision upgrade per device lifecycle.
This device was born froyo, it will eventually die froyo. I would rather it die ICS. Most times, EOLed devices are physically capable of running the next higher android release, but the maker refuses to sink the development money. I would pay 50$ extra or more for having the garantee of getting the next major android release during the product lifespan. The handset makers don't see that their refusal to provide extended support in this fashion hurts their brands, and hurts the device ecosystem. All they see is "the next big thing!" On the horizon.
They don't want to "waste time" with "old, legacy devices" like mine. They are much more interested in selling me a brand new device, that they will EOL in 1 year.
That is because Android handset makers have been slow to issue updates for their handsets.
I have a Google Nexus 4, supposedly gets all the updates right away, first to get new versions of Android, etc. I haven't seen an update since I bought the phone 6+ months ago. Samsung has apparently patched their phones; Google announced a code fix months ago.
What's Google's excuse for not patching my device? No carriers involved, current model, etc.
Please help metamoderate.
Personally, for devices with crippled rom capacity, I would be willing to have the basic kernel image with the sdcard and FS drivers in the rom, and have the rest of the android platform in a filesystem on the sdcard, mounted in with symbolic links.
Alternatives are things like cramfs enabled kernels with cramfs packed rom block devices.
Also, for devices with low RAM, tell the user it will run like ass, then make a build that loads zram, puts a swap partition on the /dev/zram0 device, then turns swap on. That can cut ram consumption by system daemons by nearly 50%, if the block device is sized sensibly, ans swappiness is set sanely. Because zram is a compressed ramdisk block device, the swap operations just munch a bit of CPU, and are quite speedy. Turning it on is commonplace in community rom builds.
... android patches YOU!!!!
This sig is not paradoxical or ironic.
It is that way on Android, you can install vanilla Android from AOSP on just about any device that's powerful enough if the bootloader is not locked by the OEM. Problem - as I understand it - is most devices aren't powerful enough to run the latest version.
Most devices require closed source binary blobs to drive much of the hardware. So yes, you can install AOSP on any phone so long as you don't mind not having a working cellular radio, wifi, gps, screen, bluetooth, ...
http://blog.nexusuk.org
Whilst it's common (and often justified) to have a pop at the carriers for delaying or preventing updates to devices, it's worth pointing out that I've got access to a whole range of Android devices direct from a number of different OEMs and not a single one of them has yet received an OTA update to fix this vulnerability.
The carriers may still slow down this process, but it's already going slow enough with just the OEMs involved.
Avantslash - View Slashdot cleanly on your mobile phone.
Thought I'd point out that it's the vertical integration design of Android that has led to this carrier conundrum in which updates and upgrades are forced to go through the carriers, but the carriers are focused on new sales not maintaining old hardware. So the engineering resources they're willing to invest are minimal, leaving users out in the cold.
This is something that's of interest to me in the design of Firefox OS, which completely separates out the the Linux kernel, and the two layers on top of that (the Gecko engine and the UI). All of these can be updated independently. Updates to the kernel require the carrier's knowledge of the underlying hardware, but most security, feature & performance updates will be to the top layers. So updates should be installable when they're first released. This should help to avoid a lot of what we're seeing with the carrier foot-dragging (or outright abandonment) hurting consumers.
I'm unfamiliar though with the the design of Ubuntu Touch and Tizen. Does anyone know if they have a similar advantage?
That'd unlock the SIM card slot, I'm not sure what it would do for getting new software onto the device.
No kidding!!! What do you say at this point?
Welcome to the mobile phone handset business model. This was the business model for these suppliers long before Android came along, do you really think they are going to change now? Instead of fixing older handsets they want to release new variants every few months to tempt the unwary with a new bright shiny thing.
The only company doing anything different, no matter how much Slashdot hate them, is Apple. The limited hardware targets they have to deal with allows them to provide longer support and its something that they've done since day one. Sadly the Android/iOS holy war prevents this advantage being seen.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
As long as 4.x requires half a GB of RAM, there will still be 2.x devices.
Blame the carriers for charging as much per month for service on an unsubsidized phone as on a contract. Blame the CDMA2000 carriers for not using CSIM and refusing to activate phones they didn't sell.
Most devices require closed source binary blobs to drive much of the hardware. So yes, you can install AOSP on any phone so long as you don't mind not having a working cellular radio, wifi, gps, screen, bluetooth, ...
So explain how you believe all the custom android versions, ubuntu touch, firefox os run on various devices, or are you suggesting they only run on hardware that has fully open source drivers and no binary blobs?
Most devices require closed source binary blobs to drive much of the hardware. So yes, you can install AOSP on any phone so long as you don't mind not having a working cellular radio, wifi, gps, screen, bluetooth, ...
So explain how you believe all the custom android versions, ubuntu touch, firefox os run on various devices, or are you suggesting they only run on hardware that has fully open source drivers and no binary blobs?
The custom android versions, such as Cyanogenmod, bundle the binary blobs for popular devices (which were extracted from the official images). Go try and run that stuff on a less popular device and you'll struggle. For example, the Samsung Captivate Glide was stuck with Gingerbread until Samsung released an ICS upgrade because the binary blobs in Gingerbread aren't compatible with ICS and Jellybean. Even now, there are various problems with the third party Captivate Glide firmwares due to bugs in the binary blobs (e.g. the GPS reports an incorrect number of satellites, and this is unfixable because that is handled by a closed source binary blob).
I have no experience of Ubuntu Touch and Firefox OS - I assume they either use the existing Android binary blobs, or only run on an extremely small number of devices.
http://blog.nexusuk.org
Google on the other hand has absolutely zero say when it comes to the OEMs
"Absolutely zero" is strong language. Google Play Store is not FOSS, and Google could sue any OEM that ships an infringing copy of Google Play Store on a device. Google licenses the Gapps only for distribution as part of the preload on devices that pass the tests for conformance to a particular Android version's Compatibility Definition Document. To get 2.x (and the underpowered hardware that needs 2.x) out of the channel, Google could declare a date after which Gapps are no longer available on new 2.x phones. I guess it doesn't do so because it depends on ad revenue from 2.x users who would have otherwise chosen a feature phone.
Think the OEMs give a rat's ass about a store that makes GOOGLE money but NOT them?
Say an OEM decides to go this route of shipping a device running outdated AOSP and its own store. How would it go about attracting Android application developers to its own store? In order to get its own 30% cut, such an OEM would have to spend time==money hosting, curating, and promoting its own store. I seem to remember only Amazon making a wholehearted effort at setting up its own store for the Kindle Fire. Other 1.x/2.x devices without the Gapps, such as seventh and eighth generation Archos tablets, ended up building a bad reputation once users discovered that they couldn't find their favorite apps in AppsLib (the store that Archos devices shipped with) or SlideME (a commonly sideloaded store).
For example, the Samsung Captivate Glide was stuck with Gingerbread until Samsung released an ICS upgrade because the binary blobs in Gingerbread aren't compatible with ICS and Jellybean.
Which is exactly the same as with desktop Windows and Linux, if you change the driver model and the manufacturer doesn't provide drivers then you're stuck whether it's desktop or mobile. If you don't change the driver model (like ICS->JB) then you're probably fine, again like on the desktop. Mobile is no different.
I have no experience of Ubuntu Touch and Firefox OS - I assume they either use the existing Android binary blobs, or only run on an extremely small number of devices.
Yes they use the existing ones.
For example, the Samsung Captivate Glide was stuck with Gingerbread until Samsung released an ICS upgrade because the binary blobs in Gingerbread aren't compatible with ICS and Jellybean.
Which is exactly the same as with desktop Windows and Linux, if you change the driver model and the manufacturer doesn't provide drivers then you're stuck whether it's desktop or mobile. If you don't change the driver model (like ICS->JB) then you're probably fine, again like on the desktop. Mobile is no different.
Well, it depends - my machines aren't running any closed source drivers. In fact, its pretty easy to buy PC hardware that is entirely supported by open software, whereas the same is not true for mobile phones.
However, what you're saying doesn't really take anything away from my original point - you can't just install a brand new Android on any old phone because you're going to need compatible binary drivers which the vendors won't supply. Similarly, a PC that requires binary drivers also isn't very upgradable without the vendor's cooperation - the difference here is that the vendors are more inclined to release updated binary drivers for PC hardware than they are for mobile hardware. This isn't always the case though - I've been stuck unable to upgrade the OS for months on machines because nVidia wouldn't release compatible binary drivers, which is one of the reasons I don't buy nVidia hardware anymore.
TL;DR - there is no difference between PCs and mobiles when it comes to hardware that requires binary drivers - without the vendor's support for the upgraded OS you're screwed.
So no, the problem isn't "the device isn't powerful enough"; the problem is "there are no compatible binary drivers available".
http://blog.nexusuk.org
I have a Nexus 4, not a Nexus 7, and yes, according to the scanner tool, it's still unpatched.
Please help metamoderate.
Well, it depends - my machines aren't running any closed source drivers.
But the fact is performance and stability are rubbish because the drivers are generally just reverse engineered from the hardware, which you could just as easily do on mobile as well but the performance and stability problems are much more obvious on low performance device like them.
In fact, its pretty easy to buy PC hardware that is entirely supported by open software, whereas the same is not true for mobile phones.
Which ones outside of perhaps the Lemote Yeelong?
So no, the problem isn't "the device isn't powerful enough"; the problem is "there are no compatible binary drivers available".
Well no actually, many devices aren't powerful enough, but yes the fact that there are a lack of compatible binary drivers is a problem, and equally a problem on desktops, like i said, they're no different. I'm sure you'll find the vast majority of desktops - just like mobile phones - are not "entirely supported by open software".
Well, it depends - my machines aren't running any closed source drivers.
But the fact is performance and stability are rubbish because the drivers are generally just reverse engineered from the hardware, which you could just as easily do on mobile as well but the performance and stability problems are much more obvious on low performance device like them.
Not really. The drivers are frequently written by the hardware vendor in an official capacity. For example, my graphics and wifi drivers were written by Intel - the same people who made the graphics and wifi hardware.
Also, I'm going to go with [citation needed] WRT the idea that reverse engineered drivers are unstable - in my experience, a lot of the reverse engineered Linux drivers have been of higher quality than the official Windows drivers from the vendors. Sure, sometimes reverse engineered drivers aren't as good, but I think the door swings both ways on this and you can't just equate "reverse engineered" with "rubbish" and "official" with "excellent".
In fact, its pretty easy to buy PC hardware that is entirely supported by open software, whereas the same is not true for mobile phones.
Which ones outside of perhaps the Lemote Yeelong?
Well, my crappy Acer Travelmate laptop is entirely supported by open drivers (ok, there is closed firmware running on some of the hardware, but I'm talking about stuff running on the CPU that has to be integrated into the OS in such a way as to prevent arbitrary OS upgrades without the vendor's help). I can install Fedora on that machine and it Just Works.
So no, the problem isn't "the device isn't powerful enough"; the problem is "there are no compatible binary drivers available".
Well no actually, many devices aren't powerful enough, but yes the fact that there are a lack of compatible binary drivers is a problem, and equally a problem on desktops, like i said, they're no different.
Sure, a lot of older devices aren't powerful enough. But the only reason a relatively top-end phone bought a year ago can't run the latest Android is because of closed drivers and the vendor's unwillingness to release new drivers compatible with the latest OS (and AFAIK even the Nexus devices require closed drivers for some of the hardware, so to some extent you're still at the mercy of Google).
I'm sure you'll find the vast majority of desktops - just like mobile phones - are not "entirely supported by open software".
Ah, I didn't say anything about the "vast majority" at all (although I wouldn't be surprised if most of the "non-gaming" PCs were entirely supported by open drivers - they tend not to have nVidia card, which are the current main culpret in the desktop world. That said, a lot of nVidia hardware is now supported by open drivers, albeit not as well as by the official closed drivers).
I said that it was relatively easy to get a PC that is entirely supported by open drivers. And it is, so long as you actually pay attention to what hardware you're getting rather than buying the first thing you see in PC World - there are a *lot* of PCs available that match this criteria from a lot of different vendors. Conversely, I think you'd struggle to find *any* mobile phones on the market that require no closed drivers so however carefully you shop around you're always going to be at the mercy of the vendor.
I would *love* to see a market where you can buy a phone and then install one of a variety of distros on it, regularly reinstalling with upgrades for the next 10 years. But we're no where near there yet, and the primary reason phones lose support is because they each require their own custom bunch of binary drivers which may not be compatible with the current OS and require a lot of custom fiddling about by someone interested to get it all working (which means your particular phone has to be popular enough to get the development time from third parties who aren't getting paid to do it).
http://blog.nexusuk.org
Not really. The drivers are frequently written by the hardware vendor in an official capacity. For example, my graphics and wifi drivers were written by Intel - the same people who made the graphics and wifi hardware.
Outside of Intel, most of the hardware vendors don't do open source drivers and realistically intel graphics is the ass-end of desktop graphics hardware.
Also, I'm going to go with [citation needed] WRT the idea that reverse engineered drivers are unstable - in my experience, a lot of the reverse engineered Linux drivers have been of higher quality than the official Windows drivers from the vendors.
nVidia is prime example, they are unstable and lag behind in OpenGL support.
Sure, sometimes reverse engineered drivers aren't as good, but I think the door swings both ways on this and you can't just equate "reverse engineered" with "rubbish" and "official" with "excellent".
I didn't equate "official" with "excellent", but obviously reverse engineered drivers by their very nature are going to be behind the official ones in features, performance and stability.
Well, my crappy Acer Travelmate laptop is entirely supported by open drivers (ok, there is closed firmware running on some of the hardware, but I'm talking about stuff running on the CPU that has to be integrated into the OS in such a way as to prevent arbitrary OS upgrades without the vendor's help). I can install Fedora on that machine and it Just Works.
You can do that on just about any machine, it just doesn't work well and hardware support is mostly pretty crappy.
Sure, a lot of older devices aren't powerful enough. But the only reason a relatively top-end phone bought a year ago can't run the latest Android is because of closed drivers and the vendor's unwillingness to release new drivers compatible with the latest OS (and AFAIK even the Nexus devices require closed drivers for some of the hardware, so to some extent you're still at the mercy of Google).
Yeah I'll absolutely agree with that, any driver model change requires the OEM to update the older drivers and unfortunately with the speed of changes in technology and the turnover they just have no incentive to do so, which is pretty crap.
Ah, I didn't say anything about the "vast majority" at all
Well there are a minority of phones that are open source too that you could use if you wanted (Neos, Aava, the Tizen device), most people just don't want them.
Conversely, I think you'd struggle to find *any* mobile phones on the market that require no closed drivers so however carefully you shop around you're always going to be at the mercy of the vendor.
There are, it's just nobody wants them, which i suppose is understandable given the alternative operating systems are hardly attractive alternatives.
Outside of Intel, most of the hardware vendors don't do open source drivers and realistically intel graphics is the ass-end of desktop graphics hardware.
I certainly wouldn't call them the "ass end" - it depends what you want. If you want a top of the line gaming machine that you have to fart around with tweaking drivers to make them work, etc. all the time then Intel isn't for you. If you just want a machine that can run a modern desktop and keeps working with no farting around then Intel hardware is excellent. I'm after the latter - I have absolutely no interest in gaming. Whilst PC gamers are a significant market segment, they are certainly not the majority of PC owners, so for most people Intel hardware is probably the best choice.
Plenty of other hardware vendors write drivers or release the specs allowing others to write drivers without reverse engineering - look at all the SATA and SCSI controllers, for example - mostly vendor-written drivers.
I didn't equate "official" with "excellent", but obviously reverse engineered drivers by their very nature are going to be behind the official ones in features, performance and stability.
This certainly isn't my experience - frequently the vendor written Windows drivers are bloatware, unstable with proprietary APIs whilest the reverse engineered Linux drivers are much higher quality. Certainly not always the case, but I don't think there's a lot of correllation between the quality of a driver and whether or not it was reverse engineered.
Well, my crappy Acer Travelmate laptop is entirely supported by open drivers (ok, there is closed firmware running on some of the hardware, but I'm talking about stuff running on the CPU that has to be integrated into the OS in such a way as to prevent arbitrary OS upgrades without the vendor's help). I can install Fedora on that machine and it Just Works.
You can do that on just about any machine, it just doesn't work well and hardware support is mostly pretty crappy.
Except on my machine it does work well, including all of the hardware. Which was pretty much my point - there's a lot of PC hardware out there that does just work perfectly with only open drivers.
http://blog.nexusuk.org
I certainly wouldn't call them the "ass end" - it depends what you want.
Ok, generally "lowest performance" and worst graphics feature support.
If you want a top of the line gaming machine that you have to fart around with tweaking drivers to make them work, etc. all the time then Intel isn't for you.
If you believe that highend graphics machines requires tweaking drivers just to make them work then you're clearly doing something wrong.
I'm after the latter - I have absolutely no interest in gaming.
The idea that the only people interested in anything but lowend integrated graphics is gamers is just ignorant.
This certainly isn't my experience - frequently the vendor written Windows drivers are bloatware, unstable with proprietary APIs whilest the reverse engineered Linux drivers are much higher quality.
Which vendor-written ones are "bloatware" with "unstable proprietary APIs" compared to the "much higher quality" Linux drivers?
Except on my machine it does work well, including all of the hardware.
Just like on an openmoko handset or an aava.
Which was pretty much my point - there's a lot of PC hardware out there that does just work perfectly with only open drivers.
And in the end even if that is true it doesn't matter because just as the general populace doesn't care for open source drivers and running linux they also don't care about the available open source phones, both are confined to a niche. Moreover there's nothing to stop the development of open drivers for much of the available smartphone hardware but doing so and having it stable is another story.
If you believe that highend graphics machines requires tweaking drivers just to make them work then you're clearly doing something wrong.
I used to use nVidia graphics cards before Intel appeared on the scene - I had far too many incidents of upgrading the kernel, or Xorg, etc. and discovering that the drivers no longer worked, then having to roll back the upgrade and wait for 6 months before nVidia got their finger out. Too many incidents of nVidia releasing broken drivers resulting in an upgrade breaking some functionality I was using. Too many bugs in the drivers that many people on the nVidia forums were reporting to be met with absolutely no response from nVidia, combined with a completely opaque bug reporting system. And finding that nVidia dropped support for old hardware long before I was ready to give it up (I don't like being forced into upgrading perfectly good hardware just because the vendor drops support).
Conversely, the Intel drivers are pretty much rock solid. When bugs are found, they can be reported and tracked using Intel's publicly accessible Bugzilla. Intel have (in my experience) resolved bugs rapidly and I've been able to check the progress of the bug fixing rather than having to sit on my hands for 2 years checking the change logs (which is what I did with nVidia), and when Intel finally decide not to support the hardware any more, the community pick up the slack to some extent because the drivers are open and well documented.
So I stand by my opinion that in my experience, nVidia hardware is more powerful but also a hell of a lot more hassle for the user, whereas Intel hardware is powerful enough to meet pretty much all non-gaming needs and Just Works.
I'm after the latter - I have absolutely no interest in gaming.
The idea that the only people interested in anything but lowend integrated graphics is gamers is just ignorant.
For home users, that pretty much is the case - there are only a few niche cases where high-end graphics are required outside of games.
Of course, for business use there are a few more cases (e.g. CAD work, etc) but still, it is a minority - we've standardised on Intel graphics because we don't need anything more powerful, they are a lot less effort, and we don't have to retire ancient hardware just because the vendor drops support.
Which was pretty much my point - there's a lot of PC hardware out there that does just work perfectly with only open drivers.
And in the end even if that is true it doesn't matter because just as the general populace doesn't care for open source drivers and running linux they also don't care about the available open source phones, both are confined to a niche.
That is irrelevant. The original question raised was "why can't we just install the latest OS like we do with PC hardware" and the answer I gave was "because there are no open drivers for much of the mobile hardware, whereas a large proportion of PC hardware does have good open drivers". None of this was about what the "general populace" cares about - I was simply explaining why phones and PCs can't currently be treated the same way in terms of software upgrades.
http://blog.nexusuk.org