Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Thank you, EU (Score 1, Informative) 34

The "Alternative Marketplaces" that are already in Apple's approval queue to launch imminently in the EU are filled with emulators.

The problem here is that the open app ecosystem available to the EU creates a massive disparity between the capabilities of the platform there vs everywhere else in the world. The headlines about emulators coming to EU iPhones have been going for a few weeks now. If you can run emulators in Europe but not in the US, users simply are not going to stand for it.

I was going to say the Apple is about to have their Lunch eaten, but in the context of gradeschool cafeteria analogies, it's really more like they are the bully and they finally got their nose punched in by the little scrawny kid.. only that kid was the EU and maybe not so scrawny. Keep it up!

Comment clinging mostly a cost issue (Score 1) 370

For economy cars its cheaper and has less losses. Robot auto gets the losses to same but that costs more. The less losses part then matter(ed) for gas and to get better acceleration out of the small engines.

Goes for scooters and motorbikes too, cvt is nice and all but for same engine its kinda suck and cheaper smaller engine bikes that sucking kinda matters just for running your errands.

As for ev's so? Are the ev's going to kill small engined econoboxes? Does it even matter when you can just learn to drive it fairly quickly anyway?

Now some 3rd world weirdness perspective. I know some people who "can't" drive an automatic, not really sure why but they just scare it.

Submission + - xz/liblzma Backdoored, Facilitating ssh Compromise

ewhac writes: A backdoor has been discovered in the liblzma data compression library, whose purpose is to facilitate a compromise of ssh. liblzma versions 5.6.0 and 5.6.1 are known to be affected. Debian's "unstable" and "testing" repos yesterday rolled back the library by pushing version "5.6.1+really5.4.5-1" to mitigate the exposure. RedHat is also recommending all users roll back to a pre-5.6.0 release.

The backdoor is not in the source code, but rather is in the test suite contained in the distribution tarballs. Hostile payloads masquerading as test data are decompressed during the ./configure phase to modify the Makefile and drop modified versions of liblzma_la-crc32_fast.o and liblzma_la-crc64_fast.o. When the compromised library is loaded by client programs (such as ssh), these in turn install an audit hook in the dynamic linker, allowing them to intercept lookups/calls to RSA_public_decrypt@....plt, which it then replaces with its own code. This compromise appears to have only been discovered in the last few days; study of the precise nature and scope of the compromise is ongoing.

Submission + - xz/liblzma Backdoored, Facilitating ssh Compromise

ewhac writes: A backdoor has been discovered in the liblzma data compression library, whose purpose is to facilitate a compromise of ssh. liblzma versions 5.6.0 and 5.6.1 are known to be affected. Debian's "unstable" and "testing" repos yesterday rolled back the library by pushing version "5.6.1+really5.4.5-1" to mitigate the exposure. RedHat is also recommending all users roll back to a pre-5.6.0 release.

The backdoor is not in the source code, but rather is in the test suite contained in the distribution tarballs. Hostile payloads masquerading as test data are decompressed during the ./configure phase to modify the Makefile and drop modified versions of liblzma_la-crc32_fast.o and liblzma_la-crc64_fast.o. When the compromised library is loaded by client programs (such as ssh), these in turn install an audit hook in the dynamic linker, allowing them to intercept lookups/calls to RSA_public_decrypt@....plt, which it then replaces with its own code. This compromise appears to have only been discovered in the last few days; study of the precise nature and scope of the compromise is ongoing.

Submission + - Malicious code discovered in popular xz utils (arstechnica.com)

Cognitive Dissident writes: Code designed to compromise SSH connections has been discovered in a widely used compression utility
.

The compression utility, known as xz Utils, introduced the malicious code in versions 5.6.0 and 5.6.1, according to Andres Freund, the developer who discovered it. There are no confirmed reports of those versions being incorporated into any production releases for major Linux distributions, but both Red Hat and Debian reported that recently published beta releases used at least one of the backdoored versions—specifically, in Fedora 40 and Fedora Rawhide and Debian testing, unstable and experimental distributions. Because the backdoor was discovered before the malicious versions of xz Utils were added to production versions of Linux, “it's not really affecting anyone in the real world,” Will Dormann, a senior vulnerability analyst at security firm ANALYGENCE, said in an online interview. “BUT that's only because it was discovered early due to bad actor sloppiness. Had it not been discovered, it would have been catastrophic to the world.”

The really worrying part here is that the developer clearly did it on purpose, and he has been on this project for a solid two years. This raises all sorts of questions about the security of Linux in general. How many other 'deep cover' operatives might be planning or actually in the process of inserting malicious code into the Gnu/Linux code base?

Submission + - Red Hat issues urgent alert for Fedora Linux users due to malicious code (betanews.com)

BrianFagioli writes: In a recent security announcement, Red Hat’s Information Risk and Security and Product Security teams have identified a critical vulnerability in the latest versions of the “xz” compression tools and libraries. The affected versions, 5.6.0 and 5.6.1, contain malicious code that could potentially allow unauthorized access to systems. Fedora Linux 40 users and those using Fedora Rawhide, the development distribution for future Fedora builds, are at risk.

Comment If McKinsey Shows Up, Your Company Is Fscked (Score 3, Interesting) 56

John Oliver on Last Week Tonight did a whole show on McKinsey. The service they actually provide, as has been noted earlier in these comments, is a way for management to deflect responsibility for what they were always planning to do, anyway, which is usually budget cuts and layoffs, and/or massive boosts to executive pay packages.

Here's the show.

Comment Re: Duh (Score 1) 126

ignoring the warning that they should be ready to take over at any time if the computer acts inappropriately.

Oh, and there's no such warning. When you get into the backseat of a robotaxi, it won't even start moving until everybody is wearing their seatbelts. I hardly see any passenger leaping into the front seat and grabbing the controls in a traffic incident.

Comment Re: Duh (Score 1) 126

With the exception of the occasional spectacular failure that makes the news (and refuelling/recharging stops), this is already possible. Not legal, but the technology is there.

Nah. I've rode a couple of robotaxis around the city, and while the ride is nice, it's clear we're nowhere near "get in a car and go to sleep." For one thing, the vehicles aren't even allowed on highways yet. And they require months of training on any particular urban area before they can perform reliably. I don't think there's been any training in rural or even suburban environments, which have different challenges. What you say may eventually be possible, but we're still a long way off.

Slashdot Top Deals

Dynamically binding, you realize the magic. Statically binding, you see only the hierarchy.

Working...