An anonymous reader quotes a report from Ars Technica: Sudo, a utility found in dozens of Unix-like operating systems, has received a patch for a potentially serious bug that allows unprivileged users to easily obtain unfettered root privileges on vulnerable systems. The vulnerability, tracked as CVE-2019-18634, is the result of a stack-based buffer-overflow bug found in versions 1.7.1 through 1.8.25p1. It can be triggered only when either an administrator or a downstream OS, such as Linux Mint and Elementary OS, has enabled an option known as pwfeedback. With pwfeedback turned on, the vulnerability can be exploited even by users who aren't listed in sudoers, a file that contains rules that users must follow when using the sudo command.

"Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled," an advisory published by sudo developers said. "The bug can be reproduced by passing a large input to sudo via a pipe when it prompts for a password." The advisory lists two flaws that lead to the vulnerability. The first: pwfeedback isn't ignored as it should be when reading from something other than a terminal. As a result, the saved version of a line erase character remains at its initialized value of 0. The second contributor is that the code that erases the line of asterisks doesn't properly reset the buffer position if there is an error writing data. Instead, the code resets only the remaining buffer length. As a result, input can write past the end of the buffers. Systems with unidirectional pipe allow an attempt to write to the read end of the pipe to result in a write error. Because the remaining buffer length isn't reset correctly when write errors result from line erasures, the stack buffer can be overflowed. The report notes the vulnerability was introduced in 2009 and remained active until 2018, with the release of 1.8.26b1. "Systems or software using a vulnerable version should move to version 1.8.31 as soon as practical," reports Ars. "Those who can't update right away can prevent exploits by making sure pwfeedback is disabled."

An anonymous reader quotes a report from BuzzFeed News: Cards Against Humanity, the card game company, purchased ClickHole.com from its owners at G/O Media on Monday for an undisclosed amount in an all-cash deal, BuzzFeed News has learned. ClickHole's employees will become the majority owners of the site. Although terms were not disclosed, the Wall Street Journal reported in November that the sale price was likely to be less than $1 million. The Onion, which created ClickHole, will remain a part of G/O Media. Max Temkin, the cofounder of Cards Against Humanity, told BuzzFeed News that the deal will allow ClickHole to bring on additional staff -- it currently has only five full-time employees -- and explore new revenue streams. He also said the site would operate independently, with financial support from Cards Against Humanity. ClickHole staffers will not be involved in writing any Cards Against Humanity content. "We're giving them funding, and if they ask us, we'll be an advisor," Temkin told BuzzFeed News, saying that the ClickHole team will operate independently, with financial support. "We just want to give them a chance to do their thing. They're really capable -- really smart and innovative. And I don't know if they've had that opportunity before to try all these creative [ideas for the site]."

Steve Etheridge, editor-in-chief of ClickHole, told BuzzFeed News, "we're leaving a place with a very robust editorial infrastructure to essentially go build a new digital media company from scratch. Cards is giving us total freedom to do our thing, but that freedom comes with a lot of new responsibility, and we really just want to get it right. Our goal is to make ClickHole better than ever before."

Google Fiber, the division of Google parent company Alphabet that provides fiber-to-the-premises service in the U.S., today announced that it will no longer offer traditional TV bundles with news, sports, premium, and local broadcast channels. From a report: Current subscribers to Fiber plans that include TV won't see their existing service modified or changed, but new customers won't have the option of signing up for cable content going forward. "As we return our focus to where we started -- as a gigabit Internet company -- we're also ready to challenge the status quo, to finally come right out and say it: customers today just don't need traditional TV," wrote Fiber in a blog post. "The best TV is already online. And we want to help you watch it, in the ways that work best for your budget and your own viewing preferences."

Google is making it easier for developers to purchase the latest version of its smart glasses, with the company saying on Tuesday that the Glass Enterprise Edition 2 is now available from some hardware resellers. From a report: "We've seen strong demand from developers and businesses who are interested in building new, helpful enterprise solutions for Glass," Google said in a blog post, adding that the new headset was already being used by people with jobs in logistics, manufacturing and field services."

From a report: I'll just pay a little more attention to the Android bit: a total of $80 billion paid out to Android developers, which is significantly less than the $155 billion Apple has paid out via the iOS App Store. Even if you account for Google allowing developers to use their own payment methods and made a bunch of other caveats, I suspect you can't avoid the truth. The vast majority of phones on Earth run Android, and yet it is almost surely the case that there's more money for developers in iPhone apps. That's always been the conventional wisdom, but Google's own numbers all but confirm it.

A group of online archivists have created an open-access directory of over 5,000 scientific studies about coronaviruses that anyone can browse and download without encountering a paywall . From a report: The directory is hosted on The-Eye, a massive online archiving project run by a Reddit user named "-Archivist." Last week, the World Health Organization (WHO) declared a global health emergency amid the spread of the novel coronavirus beyond China, where it originated, into roughly two dozen countries so far. The organizers of the archive see their project as a resource for scientists and non-scientists alike to study the virus. "These articles were always written to be shared with as many people as possible," Reddit user "shrine," an organizer of the archive, said in a call. "From every angle that you look at it, [paywalled research] is an immoral situation, and it's an ongoing tragedy."

In 2015, Liberian public health officials co-authored a New York Times op-ed that lamented the amount of critical Ebola research that was unknown or inaccessible to scientists and health workers at the center of the 2014 epidemic. "Even today, downloading one of the papers would cost a physician here $45, about half a week's salary," the authors wrote. Shrine, who is in his late 20s, said he was inspired to assemble the archive when, last week, he clicked on a new research article about the coronavirus and encountered a $39.95 paywall. He and a few friends started to brainstorm solutions around paywalls like the one he had run into. They came up with the idea of searching for coronavirus-related papers on Sci-Hub, a free scientific research repository sometimes called "the Pirate Bay of science." Sci-Hub's site says it provides free access to over 78 million research articles by downloading HTML and PDF pages off the web, in some cases bypassing paywalls. Because of this, major scientific publishing companies -- most prominently Elsevier -- have repeatedly sued Sci-Hub for copyright infringement. Similarly, by disseminating PDFs from Sci-Hub, the coronavirus archive is in questionable legal territory.

If you used Google Takeout to download an archive of your Google Photos content, there's a chance that someone else may have ended up with your videos. From a report: The company has admitted that for a few days in November last year, "some videos in Google Photos were exported to unrelated users' archives." This means that not only could your videos have ended up on a stranger's computer, but also that you may have received random videos belonging to someone else. Google is not making much of the "technical issue" which it says has now been resolved. But the company apologizes for the "inconvenience" that may have been caused for people downloading their Google Photos archive between November 21 and 25, 2019.

Google Photos is now trialing a "monthly photo prints" subscription program where the company will send you 10 prints that will be "automatically selected from your last 30 days of photos." 9to5Gogole reports: This subscription program is a way to "get your best memories delivered straight to your home every month." For $7.99 per month, subscribers get 4x6 pictures printed on matte, white cardstock that features a 1/8-inch border. While an automatic process leverages Google Photos' smarts, you'll be able to pick one of three themes for your monthly prints. Google touts the first "people and pets" option as being the "most popular." Additionally, you can edit the photos before they're printed.

Delivered in a cardboard envelope, Google imagines these prints as being "perfect to put on the fridge, in a frame, or to give as gifts to the important." Similar to efforts with Smart Displays, this program adds an interesting tactility to images that most people only experience virtually today. Currently, this Google Photos print subscription is classified as a "trial program" in the US. Those selected will see a "You're invited to the monthly photo prints trial" banner to join at the top of Google Photos on the web.

NASA is launching a new air quality measurement tool aboard a Maxar 1300-class satellite to help improve air quality forecasting. Called "TEMPO," which stands for Tropospheric Emissions: Monitoring of Pollution, the new tool will provide hourly measurements of the levels of gases in the atmosphere over North America, including ozone, nitrogen dioxide and aerosols. TechCrunch reports: The TEMPO tool won't launch until 2022, however, which is when the Maxar satellite, called Intelsat 40e, is set to be delivered to geostationary orbit. It's not uncommon for NASA to host its scientific payloads on commercial communications satellites, providing an opportunity for NASA to effectively hitch a ride on a large geostationary satellite that'll cover the territory it wants to cover, while offering significant cost savings versus putting up a dedicated spacecraft. Ball Aerospace developed the TEMPO instrument for NASA, and it'll be transported to Maxar's Palo Alto-based satellite manufacturing facility for incorporation into the Intelsat 40e vehicle ahead of its scheduled launch. The instrument will also be used alongside other tools, including one from the European Space Agency, and South Korea's Geostationary Environment Monitoring Spectrometer, which will all combine to provide a more comprehensive and detailed picture of air quality across the northern hemisphere.

Justice Department officials will meet on Tuesday with representatives of state attorneys general to discuss their investigations of Google and whether the company broke antitrust law. "The probes focus on search bias, advertising and management of Google's Android operating system," adds Reuters. From the report: The meeting is in the afternoon, according to one source, and will include officials from six or seven states, including Texas, according to a second source familiar with the matter. Google, Facebook, Amazon and Apple are all the focus of federal, state and congressional investigations following complaints that the four tech giants abused their clout in dealings with smaller companies. The probes are being carried out by the Justice Department, the Federal Trade Commission, state attorneys general and the House Judiciary Committee. U.S. Attorney General William Barr has said he would like to see them wrapped up this year.

An anonymous reader quotes a report from Ars Technica: West Virginia's legislature last week passed legislation allowing disabled voters to cast votes by smartphone, sending the bill to the desk of Governor Jim Justice. Justice is expected to sign the legislation, according to NBC. It's a decision that alarms many computer security experts, who say that the Internet and smartphones are too vulnerable to hackers.

The legislation would require every county in the state to offer smartphone voting. It doesn't specify any particular voting method, but the state has recently been experimenting with software called Voatz that tries to use a blockchain to help secure elections. West Virginia performed a small-scale pilot project with Voatz in the 2018 election, allowing about 150 overseas voters to vote using the technology. A fundamental problem with online voting, experts say, is that modern computing devices have a huge "attack surface." Even if the voting app itself is completely secure, there might still be vulnerabilities in the user's operating system, network, or the servers used to register users and collect votes. And to swing an election, a hacker doesn't need to change anyone's votes -- just preventing some of a candidate's voters from voting can be sufficient to swing a close election. But West Virginia officials have pressed forward, arguing that it's too difficult for some disabled voters to get to a physical polling place to cast votes. Washington is also considering smartphone voting. The King Conservation District, a district of 1.2 million voters encompassing Greater Seattle, may have the option to cast votes online using a smartphone.

MojoKid writes: When AMD unveiled its forthcoming Ryzen Threadripper 3990X 64-core processor at CES 2020 this year, the company made no bones about comparing its performance to a many-core competitive platform from Intel. Under the hood of the yet formally released high-end workstation AMD chip are 64 physical cores capable of processing 128 threads in SMT, with a 2.9GHz base clock, 4.3GHz boost clock, and 256MB of L3 cache. All that horsepower resides in a single TRX40 socket with a 280 Watt TDP for a suggested retail price of $3990. Conversely, a dual socket Intel Xeon Scalable Platinum 8280 setup will sport 56 cores across two sockets with over a 400 Watt TDP that costs around $20,000. At CES, AMD showed its new 64-core Threadripper beating the dual Xeon Platinum setup in a 3D rendering application called VRAY, and today additional benchmark numbers have surfaced in SiSoft SANDRA, showing Threadripper 3990X out-scoring the Intel setup by around 18 percent. No doubt, AMD's Threadripper 3900X isn't a CPU for the average mainstream desktop user, but when the chips arrive to market in the near future, workstation and content creation professionals will likely be all over AMD's new 64-core beast chip.

For the first time, Google revealed that YouTube generated $15.1 billion in ad revenue in fiscal 2019, including $4.7 billion in the fourth quarter. The company disclosed the numbers in its quarterly earnings report, which also included fiscal 2019. From The Hollywood Reporter: Until now, Google and parent company Alphabet had folded YouTube's revenue in with Google. "To provide further insight into our business and the opportunities ahead, we're now disclosing our revenue on a more granular basis, including for Search, YouTube ads and Cloud," said Alphabet CFO Ruth Porat in a statement. Google and Alphabet CEO Sundar Pichai told analysts Monday on the company's quarterly earnings call that its YouTube TV streaming bundle now has more than two million subscribers, and that YouTube Music and YouTube Premium now have more than 20 million paid subscribers. The unit's subscription revenue now has a $3 billion annual run rate, Pichai said.

YouTube has seen enormous growth, according to the newly-released numbers. In fiscal 2017, YouTube generated $8.15 billion in ad revenue, followed by $11.15 billion fiscal 2018. In other words, YouTube's ad revenue has nearly doubled over the past two years. Google said that YouTube saw $3.6 billion in revenue in Q4 2018. The disclosure reveals just how big of a business YouTube is. The ad-supported video site, which was founded in 2005 and sold to Google in 2006 for $1.65 billion, has long been viewed as one of Google's crown jewels, with an enormous share of the ad-supported streaming video market. Netflix, for comparison, had $20.1 billion in revenue in fiscal 2019, almost entirely from subscriptions. Alphabet also broke out revenue from its Google Cloud unit for the first time, revealing that the division generated $8.9 billion in revenue last year. Overall, Alphabet hit $161.8 billion in revenue in fiscal 2019, including $46.1 billion in Q4.

An anonymous reader quotes a report from The Verge: Microsoft Teams went down this morning for nearly three hours after Microsoft forgot to renew a critical security certificate. Users of Microsoft's Slack competitor were met with error messages attempting to sign into the service on Monday morning, with the app noting it had failed to establish an HTTPS connection to Microsoft's servers. Microsoft confirmed the Teams service was down just after 9AM ET today, and then later revealed the source of the issue. "We've determined that an authentication certificate has expired causing users to have issues using the service," explains Microsoft's outage notification. Microsoft then started rolling the fix out at 11:20AM ET, and by 12PM ET the service was restored for most affected users.

YouTube on Monday reinforced its guidelines on tackling fake or misleading election-related content on its platform as the United States gears up for the presidential election later this year. From a report: YouTube will remove any content that has been "technically doctored" or manipulated or misleads the user about the voting process or makes false claims about a candidate, it said in a blog.

A German artist illustrated [video] how it is possible to create a virtual traffic jam in Google Maps by walking around the streets of Berlin with 99 cell phones. Qbertino shares a report: Google Maps utilizes GPS and location data from mobile devices to determine if there is traffic congestion on a particular street. The app will then redirect users to less trafficked streets to avoid traffic. Using a hand cart filled with 99 active cell phones connected to Google Maps, artist Simon Weckert showed how he could create fake traffic jams in Google Maps simply by walking around the streets of Berlin. As he would be walking, rather than driving, Google Maps would perceive it to be a traffic jam due to a large number of devices reporting the same slow speed. Google's response to the matter, via blog 9to5Google: Speaking with 9to5Google, a spokesperson from Google has responded to this situation to clarify a few things. In normal usage, Google does use a large number of devices running Maps in a single place as proof of a traffic jam, something this rare and very specific case took advantage of. In the statement below, though, the company does hint that it might use cases like this to further improve how Maps handles traffic data. "Whether via car or cart or camel, we love seeing creative uses of Google Maps as it helps us make maps work better over time."

Only three of the world's Top 100 international airports pass basic security checks, according to a report published last week by cyber-security firm ImmuniWeb. From a report: The three are the Amsterdam Schiphol Airport in the Netherlands, the Helsinki Vantaa Airport in Finland, and the Dublin International Airport in Ireland. According to ImmuniWeb, these three "may serve a laudable example not just to the aviation industry but to all other industries as well." The three are the only airports that passed a long list of security tests that involved checks of their public websites, official mobile applications, and searches for leaks of sensitive airport or passenger data in places like cloud services, public code repositories, or the dark web.

AmiMoJo writes: Zhaoxin, a fabless chip maker based in Shanghai, has produced a homegrown x86 CPU line that's apparently ready for the DIY scene. The Zhaoxin KaiXian KX-6000 series of processors were originally shown off in 2018, but since then we had heard little about them. Now it seems that the KX-U6780A will come to market this quarter, as listed on Chinese retail site Taobao with a March release date. For the uninitiated, Zhaoxin is a joint venture between VIA Technologies and the Shanghai Municipal Government. Zhaoxin's current CPU designs have origins in Centaur Technology, a company acquired by VIA in 1999. The VIA Nano Isaiah core design, built by Centaur, would serve as the architecture for Zhaoxin's first CPUs.

The Isaiah design was Centaur's first superscalar CPU capable of out-of-order execution. This is what seemed to pave the way for Zhaoxin's in-house designed LuJiaZui cores, as they too are built around a superscalar, out of order architecture. LuJiaZui seems to be an iterative migration from the Wudaokou architecture, but also supports modern instruction set extensions such as AVX and SSE4.2, which is an important evolution for China and its domestic CPU goals. The KaiXian KX-U6880A appears to be the series flagship, with the slightly lower clocked KX-U6780A slotting in just beneath it. All KX-6000 series chips are based on the LuJiaZui architecture, boasting eight cores and eight threads.

Google has gradually been adding print services to its Photos platform in recent years, and now it's testing a particularly novel one: a $7.99 a month subscription service that'll send subscribers physical prints of 10 algorithmically-selected photos each month. From a report: The trial is both U.S.-only and invitation-only, and eligible Google Photos' users will be invited to try the service via a message at the top of the screen when they log into the service on a laptop or desktop. Users will be able to ask that preference be given to one of three image categories when Google Photos makes it selections. The first will favor people and pets, the second will focus on landscapes, cityscapes and the outdoors, while the third will be a mix of everything. Users can update their preference each month if they're getting too many pics of their pooch... assuming such a thing is even possible.

"Google has started testing a feature that will display the search query in the Chrome address bar rather than the actual page's URL when performing searches on Google," reports Bleeping Computer: This experimental feature is called "Query in Omnibox" and has been available as a flag in Google Chrome since Chrome 71, but is disabled by default. In a test being conducted by Google, this feature is being enabled for some users and will cause the search keyword to be displayed in the browser's address bar, or Omnibox, instead of the URL that you normally see...

When this feature is not enabled, Google will display the URL of the search in the Omnibox as you would expect. This allows you to not only properly identify the site you are on, but also to easily share the search with another user.
It's been 18 months since Wired reported that Google "wants to kill the URL.

This week now finds Bleeping Computer arguing that instead of removing URLs in one fell swoop, Google "is gradually eroding the various elements of a URL until there is nothing left."