Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Android updates suck (Score 1) 136

Maybe. I believe the media exploit from a year or two ago on Android was patched on phones assumed abandoned by OEMs.

Sadly, for many customers they rely on the goodwill of their OEM and telco to provide serious patches. I expect shops like Samsung, Lenovo/Moto, LG, Sony, and HTC to patch pretty much any phone sold in the past 3 years or so.

Budget buyers, no-name brands, etc are most likely going to be hacked constantly until they replace the phone. KRACK is bad but WPA-AES means they can't inject data and that's on top of TLS blocking that as well. Blueborn, on the other hand, is much more serious and could provide root remotely.

Submission + - Some Motherboards Plagued by BIOS Firmware Implementation Flaws (bleepingcomputer.com)

An anonymous reader writes: Alex Matrosov, a security researcher for Cylance, has discovered several flaws in how some motherboard vendors implemented Intel UEFI BIOS firmware into their products. These flaws allow an attacker to bypass BIOS firmware protections, such as Intel Boot Guard and Intel BIOS Guard, to disable and alter UEFI BIOS firmware, such as placing a rootkit.

In total, Matrosov found six vulnerabilities in four motherboards he tested: ASUS Vivo Mini (CVE-2017-11315), Lenovo ThinkCentre systems (CVE-2017-3753), MSI Cubi2 CVE-2017-11312 and CVE-2017-11316), and Gigabyte BRIX series (CVE-2017-11313 and CVE-2017-11314). The motherboards Matrosov tested were based on AMI Aptio UEFI BIOS, a popular UEFI BIOS firmware package, also used by other motherboard OEMs such as MSI, Asus, Acer, Dell, HP, and ASRock.

"Some vendors don’t enable the protections offered by modern hardware, such as the simple protection bits for SMM and SPI flash memory (BLE, BWE, PRx), which Intel introduced years ago," Matrosov explained the problem. "This makes them easy targets for attackers since they have no active memory protections at the hardware level."

Submission + - EFF jumps in to defend bloggers being sued by Prenda (eff.org)

NewYorkCountryLawyer writes: "The Electronic Frontier Foundation has entered the fray to defend the bloggers sued by Prenda Law Firm. Prenda, oblivious to such well known legal niceties as the Federal Rules of Civil Procedure, the affirmative defense of truth, the difference between a defamatory statement of fact and the expression of a negative opinion, and the First Amendment, has immediately — and illegally — sought to subpoena information leading to the identities of the bloggers. I would not be surprised to see these "lawyers" get into even more hot water than they're already in. And I take my hat off to the EFF for stepping in here."

Comment Re:uhh... does anyone still use mutt? (Score 2) 93

I actually just switched from Apple Mail back to Mutt, because a combination of Mail and an Exchange server ate a huge chunk of my email archive. I'm not sure if I'm really more productive, but I feel a lot more comfortable knowing I have a degree of control of what's going on, and that stuff is being stored in an open format (Mail switched from Maildir to something weirder a while back). Losing a chunk of my email archive was pretty traumatic.

The main thing holding me back was a decent email search feature -- I'd been watching notmuch for a while, and when I heard about muttkz, I compiled it and switched. I use davmail, offlineimap and muttkz. I use notmuch to search around 10 years of email.

I don't think this is a route I'd recommend for many others -- I've used mutt for years before Mail, and only switched over in the last couple of years. But it worked for me, and you did ask.

d.

Comment Re:People should be free, but only on your terms? (Score 2) 169

What form of expression would be acceptable to tell people that you're not working with somebody, and for what reason? Or is it important to keep this information confidential?

Or in other words, he has done pretty much exactly what you have done: expressed an opinion online. Why is what you are saying now not some sort of "hissy fit" about how somebody you don't even know disagrees with what you think? You certainly seem to be using stronger, more strongly opinonated language than Mitch Altman.

Comment Re:No *official* port. (Score 2) 333

But the suite of google apps aren't (maps, gmail, access to the market, etc). Google has tons of leverage.

I think the obvious solution here is to put in a simple skinning API and let the devs go nuts with it. Sense, TW, etc would just be apk's that skin the GUI elements. End users should be able to disable this if they wish.

Google could use its muscle to make this happen. Shame they won't. In the meantime, the released stats show a big move from android to iphone because people seem to prefer Apple's way of doing things. Heck, I had a phone with a published security vulnerability and it took almost 12 months to patch it. That's 100% unacceptable.

Comment Re:Best use of money? (Score 4, Insightful) 205

Don't bother with this crowd. These guys clearly have no practical experience with Exchange and are the same people who have been yelling "ZOMG POSTFIX AND EVOLUTION/CHANDLER/THUNDERBIRD WILL KILL OUTLOOK" 10+ years ago.

As much as I dislike defending my vendors, I have to say the Exchange is surprisingly nimble and the number of devices I can support with a very modest server is pretty surprising. The idea that you're getting 10x the number of users on similiar hardware with a similiar featureset is the same bullshit these FOSS guys have been peddling for years. I just with the FOSS crew could write a usable, supported, efficient Exchange/Activesync replacement. That product doesn't exist and the current crop are all nightmares. Heh, there's a reason why they won't let you test this junk.

Comment Re:oh, really? (Score 2) 372

Considering no US money is being spent on this plant and they have bought a Delaware plant for stage II, my comment on your ignorance still stands.

Tesla managed to get around this issue by buying a retired Toyota plant in the US as a stopgap the same way these guys are using Finland as a stopgap.

You can argue whether or not the DOE should be making these investments, but not finding a facility here in the US is perfectly understandable. Regardless, in a year or two they'll be in Delaware and Tesla will move to its permanent factory in Cali. Yet guys like you dont give two shits about this, because you just want to complain about the government, not really understand or care how electric car investment works, or why certain decisions are made. Took yer jerbs, indeed.

Comment Re:oh, really? (Score 0) 372

This is too informative and logical for slashdot. Please instead stick to right-wing libertarian talking points, anti-government rhetoric, and stick to as much Ayn Rand as possible. Thanks!

The idea that this is a little more complex than "they too our jerbs" or "damn federal government is a scam" is too much for most people here. Just look at the comments.

Facts and reasonable discussion don't get ad impressions. Uninformed commentators on hot button issues do.

Comment Re:A slightly unrelated topic... (Score 4, Insightful) 988

>This cancer is not "perfectly treatable".

Except this particular cancer was relatively easily treatable with surgery.

>And Jobs seemed to have waited with surgery only until it was clear that the tumour wouldn't shrink.

How was it going to shrink exactly? The homeopathic bullshit he was engaged in wasn't going to do anything anyway. He signed his own death warrant.

>But yes, maybe he would have lived longer if he hadn't waited. Maybe not.

All facts point to yes, he would have. Oh well, that's his decision. I can't stop people from killing themselves, but we can at least use him as a cautionary tale for those who are entranced by woo medicine.

Comment Re:Kindergarten (Score 2) 988

Jobs accuses everyone of theft. He did it with MS and he did it with Google. Shame he was such an IP and patent fascist.

He was your typical American CEO. He's all take, mine-mine-mine, and fuck you. The fact that the base of all his OS's are built on open principles and open source doesn't matter to him. He's allowed to take and he's allowed to own ideas like sorting with a linked list, but no one else.

Comment Re:Why so hard. (Score 1) 967

>Why is it so hard to accept that human actions can have consequences ?

Because big business and conservative ideologues don't want to pay the bills. Its the same with fighting the EPA. We're destined to fight this battle every few years because the conservative noise machine is so powerful and its followers are unusually credulous.

Comment Re:So? (Score 1) 298

Its so silly. Just the other day I was using Apache Tomcat and Java and then later making a flowchart in Visio. Later I was using Firefox and Silverlight and chatted on Skype. Oh, I had to upload a large file using Filezilla, but only after scanning it with ClamAV to be safe. Last week, I was updating the FCKeditor in Drupal while chatting on Pidgin.

But Libreoffice! Ugh, what a silly name!

Look dude, just because you're scared of anything that sounds remotely foreign doesn't mean your position is valid outside of a Tea Party convention. Hell, considering most open source types think "The Gimp" is a perfectly acceptable name for software, Libreoffice is quite the step up.

Slashdot Top Deals

You can't take damsel here now.

Working...