Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Google

Submission + - Google To Pay Bounties for Chrome Browser Bugs (computerworld.com)

CWmike writes: Google has announced a bug-bounty program that will pay $500 for each vulnerability reported for the Chrome browser and its open-source code. In a post to the Chromium project's blog, Chris Evans, said the base bounty would be $500, but that "particularly severe or particularly clever" bugs would reap rewards of $1,337 each. New high- or critical-ranked vulnerabilities in Chrome, Chromium — the open-source project that Google uses to craft Chrome — and plug-ins that ship with Chrome, such as Google Gears, are eligible for bounties, said Evans. 'The more people involved in scrutinizing Chromium's code and behavior, the more secure our millions of users will be,' he said. Of the eight IE vulnerabilities that Microsoft patched last week with its emergency update, five had been discovered by researchers who received rewards from TippingPoint's Zero Day Initiative (ZDI), which receives and pays for 'a lot of browser bugs.' But Pedram Amini, manager of the security research team at 3com's TippingPoint, says, 'Chrome is a gray area for us right now.' For instance, TippingPoint will again sponsor the 'Pwn2Own hacking contest at the CanSecWest security conference in late March, but has not decided whether it will include Chrome in the browser hacking competition, as it did last year.
Security

Submission + - Researchers: Verified by Visa is insecure (idg.com.au)

angry tapir writes: "A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers. The system is called 3-D Secure (3DS) but known better under the names Verified by Visa and MasterCard SecureCode. Steven J. Murdoch, a security researcher at the University of Cambridge, and security engineering professor Ross Anderson contend are several flaws with 3DS. One of their main points is how 3DS is integrated into Web sites during a transaction — e-Commerce Web sites display 3DS in an iframe."
Desktops (Apple)

Submission + - Unity Game Engine Free! (unity3d.com)

mehemiah writes: I think this is old news but somehow it wasn't posted here. Unity Game engine is now Free! Only the pay versions allow iPhone and Wii development however. If this seems insignificant to you, you may never have used a free game engine before. If you have, you probably weren't on a mac. Unity was the first native game engine for the mac. It now supports Windows and has server parts that run on linux. It still maintains its mac native look but most of its scripting languages are in .net so I think it uses mono internally.

Feed Techdirt: New Attempt To Get Around Section 230 In Apparent Effort To Bury Small Site With (techdirt.com)

We've seen all sorts of attempts to get around Section 230 safe harbors by various companies -- almost all of which have failed. But they keep on trying. Paul Alan Levy alerts us to a new case, in which he (and Public Citizen) are helping out, that involves a company called Vision Media TV, whose business has been heavily criticized in the press. According to the various reports, the company calls organizations to get them to take part in a TV show with a semi-famous host, which they claim will be shown on TV. Eventually, the reports claim, it comes out that the "production costs" are over $20,000 and the TV coverage is either non-existent or significantly less than suggested. I've actually received similar calls (though I don't know if it was from Vision Media). It seems like it should be pretty common knowledge that if someone is asking you to pay to get on a TV program (especially one you haven't actually seen on TV), you should proceed with caution.

However, Vision Media TV disagrees very much with those news reports, though it has not sued the likes of the NY Times that wrote them. Instead, it has gone after smaller players. The latest case, which Paul wrote about, involves the rather useful site 800notes.com, which lets people discuss telemarketers. There was a section of people discussing the calls from Vision Media, and so Vision asked 800notes to take them down. Of course, 800notes is protected (reasonably) by Section 230 safe harbors. Vision Media TV apparently responded by suggesting that it knows how to get around Section 230 safe harbors and later filed suit against the site, suggesting that it would be a lot less expensive to just remove the comments than to deal with the lawsuit.

To get around Section 230, the company apparently tried a bunch of things. Public Citizen summarizes in its brief:

It pleaded claims for "false light," "tortious interference with business opportunity," and "trade libel," and attached a potpourri of documents that were apparently intended to show the loss of business that the message board postings had occasioned. In an effort to plead around Forte's Section 230 immunity, Vision Media repeatedly but generally alleged that Forte had authored some content on the web site, that she had deliberately removed favorable postings about Vision Media to make it look worse, that she had "substantially alter[ed] and edit[ed' others['] posts," and that she had "actively encourage[d] circumvention of legally binding agreements" that forbade unidentified persons from disparaging Vision Media.... The complaint also mentioned in passing Vision Media's trademark and used the terms "dilute" and "infringement," but did not plead any claim under the trademark laws. Although the complaint went on for 16 pages and included 20 pages of exhibits, the complaint neither set forth the allegedly defamatory (or false light) posts nor specified the portions of posts that were allegedly authored by Forte.
The point about her removing favorable posts is explained because Forte was alerted to about two dozen favorable posts about Vision Media that showed up at around the same time, but came from just two IP addresses -- so she made the reasonable assumption that they were spam and deleted them. However, she did suggest to Vision Media that they identify themselves and respond to critics publicly -- which the company did, and those posts remain on the site, showing that she has no problem with positive posts, just not ones that appear to be spammy.

Anyway, it appears that all of this is to hope that the company can at least get around a quick Section 230 dismissal to burden the site with legal costs, and Levy and the crew at Public Citizen are making the case that Section 230 obviously applies here. Hopefully the judge agrees.

Permalink | Comments | Email This Story



NASA

Submission + - cocaine bag found inside a shuttle hangar (floridatoday.com)

Arvisp writes: Dozens of Kennedy Space Center employees are undergoing drug tests as authorities investigate the discovery of a small plastic bag that contained cocaine inside a restricted shuttle hangar called Orbiter Processing Facility No. 3, where shuttle Discovery is being prepared for a March mission to the International Space Station.

"We do not allow people who work on the orbiter to use illegal substances, and we're going to take care of this," Kennedy Space Center Director Robert Cabana said Thursday

Submission + - Paypal vulnerable to XSS attacks

An anonymous reader writes: A rather simple exploit has been found with Paypal which enables hackers to inject HTML code into a "secure" payment page. This means that with a bit of knowlegde someone could easily steal the cookies of anyone who clicked his carefully crafted link. The exploit is below: https://www.paypal.com/xclick/business=alert("Sup")

Slashdot Top Deals

An Ada exception is when a routine gets in trouble and says 'Beam me up, Scotty'.

Working...